[chainsmt]

Summary

Pin the Stellar CLI used by the bindings check workflow to 22.8.2, the latest stable 22.x release that still supports this repository's Soroban contract SDK. The install stays reproducible with --locked, and the job prints stellar --version before pnpm bindings:check.

Problem

.github/workflows/bindings-check.yml installed the CLI with cargo install stellar-cli --locked and no version. Cargo then selects whatever release is newest on crates.io at job time. The current newest stable CLI is 28.1.0. That line depends on soroban-sdk 23 or newer, while this repo's workspace pins soroban-sdk = "22" and Cargo.lock resolves 22.0.11.

An unpinned install can change the compiler, the contract spec tools, and the TypeScript binding generator between runs. pnpm bindings:check diffs generated bindings against packages/round-bindings/src/index.ts. A newer CLI can fail that diff, or worse, regenerate bindings that no longer match the SDK 22 contract, without any review of the CLI upgrade. --locked alone does not pin the package version; it only respects the lockfile of whichever version Cargo chooses.

Solution

The workflow now installs a reviewed version:

cargo install stellar-cli --version 22.8.2 --locked
stellar --version

22.8.2 was published on crates.io on 2025-07-09 and is not yanked. It is the newest stellar-cli 22 release. soroban-cli 22.8.2 depends on soroban-sdk 22.0.4, soroban-spec 22.0.4, and soroban-spec-tools ^22.8.2. The next stable line, stellar-cli 23.0.0, depends on soroban-sdk ^23, so it does not support this contract. No CLI version was already named in this repo (Cargo.toml, docs, or rust-toolchain.toml only say stable and soroban-sdk = "22"), so the pin is the latest stable CLI that matches that SDK.

stellar --version runs in its own step immediately after the install and before pnpm bindings:check, so the job log records the binary that generated the bindings. The rest of the workflow is unchanged: Rust stable with wasm32v1-none, the contract cache, system packages, pnpm 10.13.1, Node 22, and the frozen lockfile install.

The pin is documented in docs/CI.md under "Bindings check", including the install command and why 23+ is out of range.

Acceptance

• Focused automated check: scripts/check-bindings-cli.test.mjs reads the workflow and docs. It requires cargo install stellar-cli --version 22.8.2 --locked, requires stellar --version to appear before pnpm bindings:check, and requires docs/CI.md to name that version and the same install command. The bindings workflow runs this test on checkout, before the CLI install.
• Behavior outside this scope is unchanged. Contract tests, coverage, and the bindings generation script are the same. Only the CLI install line, the version print, the assertion step, and the short CI note were added.
• The new configuration is documented in docs/CI.md.

Tests

node --test scripts/check-bindings-cli.test.mjs

Result: 3 passed, 0 failed.

• installs an explicit stellar-cli version with --locked
• prints stellar --version before pnpm bindings:check
• documents the pinned CLI version

Closes #510