[bgm-malbeclabs]

Summary of Changes

• The sdk-compat-test job now reads the Solana mainnet RPC from the SOLANA_RPC_URL repository secret, because api.mainnet-beta.solana.com answers GitHub runners with 403 "Your IP or provider is blocked from this endpoint".
• The job has failed this way on every run since 2026-10-29 21:47 UTC, on main and on PRs. The Go revdist test fails first, so the Python and TypeScript compat tests behind it have not run since then.
• Every compat test now takes SOLANA_RPC_URL as an override and falls back to the public endpoint when it is unset or empty. The Go revdist test gains the override, and the Python revdist test now treats an empty value as unset.
• The serviceability compat tests read the DoubleZero ledger, not Solana, so their override is renamed from SOLANA_RPC_URL to LEDGER_RPC_URL. Without the rename, the new secret would send their ledger reads to Solana.
• The job skips fork and Dependabot PRs, because GitHub gives them no secrets and the fallback endpoint would fail. The job is not a required check.
• Any PR from a branch in this repository can read the secret from the job's environment. The secret is a Solana RPC key with a small blast radius, and only this job uses it.

Testing Verification

• The serviceability compat tests pass against the mainnet-beta ledger: 5 in Python and 5 in TypeScript.
• The Go revdist compat tests pass from a workstation with SOLANA_RPC_URL unset. Minutes later the same endpoint answered that workstation with 403 as well, so the public endpoint is not reliable outside CI either.
• The secret is not set yet. Until it is, the job keeps failing exactly as it does on main today.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the SDK compatibility-test RPC configuration changes.

No open issues 🎉

What changed in this PR

This PR configures SDK compatibility tests to use a secret-backed Solana RPC endpoint in CI, while keeping DoubleZero ledger requests separate.

Changes:

• The CI job supplies SOLANA_RPC_URL from a repository secret and skips fork and Dependabot pull requests.
• The Go revenue distribution tests gain the override, and the Python tests use the public fallback for empty values.
• The serviceability tests use LEDGER_RPC_URL so the Solana override cannot redirect their ledger requests.

The repository secret still needs configuration before CI can use the replacement endpoint.

File	Description
sdk/​serviceability/​typescript/​serviceability/​tests/​compat.test.ts	Renames the ledger override to LEDGER_RPC_URL.
sdk/​serviceability/​python/​serviceability/​tests/​test_compat.py	Renames the ledger override and handles empty values.
sdk/​revdist/​python/​revdist/​tests/​test_compat.py	Uses the public Solana endpoint when the override is empty.
sdk/​revdist/​go/​compat_test.go	Applies the Solana override to both compatibility client helpers.
CHANGELOG.md	Documents the separate Solana and ledger overrides.
.github/​workflows/​sdk.yml	Supplies the RPC secret and skips PRs without secret access.

_{Review effort: Balanced}

[nikw9944]

Every compat test that reads Solana now takes SOLANA_RPC_URL and falls back to the public endpoint when the value is empty (Go compatSolanaRPCURL, Python or, TypeScript ||). After the LEDGER_RPC_URL rename, no serviceability compat test reads SOLANA_RPC_URL, so the job-wide secret cannot send ledger reads to Solana. The job condition matches the fork and Dependabot gates in e2e.yml.