sdk: read the compat tests' Solana RPC from a CI secret

.github/workflows/sdk.yml

@@ -72,6 +72,11 @@ jobs:
         run: make check-fixtures
 
   sdk-compat-test:
+    # Needs secrets.SOLANA_RPC_URL, which GitHub withholds from fork and Dependabot PRs.
+    if: >-
+      github.event_name != 'pull_request' ||
+      (github.event.pull_request.head.repo.full_name == github.repository &&
+      github.actor != 'dependabot[bot]')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -86,3 +91,5 @@ jobs:
       - run: make sdk-compat-test
         env:
           REVDIST_COMPAT_TEST: "1"
+          # The public Solana RPC refuses GitHub runners' addresses.
+          SOLANA_RPC_URL: ${{ secrets.SOLANA_RPC_URL }}

CHANGELOG.md

@@ -16,6 +16,8 @@ All notable changes to this project will be documented in this file.
   - `DeleteDevice` closes only the device's own resource accounts: its `TunnelIds` account, then its `DzPrefixBlock` accounts.
 - Geolocation
   - The foundation check reads the program config and the serviceability global state only from their PDAs. An account at another address fails with `InvalidSeeds`.
+- SDK
+  - The compat tests read the Solana mainnet RPC from `SOLANA_RPC_URL`, which CI sets from a secret because the public endpoint refuses GitHub runners. The serviceability compat tests read the ledger from `LEDGER_RPC_URL`, not `SOLANA_RPC_URL`.
 
 ## [v0.46.0](https://github.com/malbeclabs/doublezero/compare/client/v0.45.0...client/v0.46.0) - 2026-10-27
 

sdk/revdist/go/compat_test.go

@@ -51,18 +51,27 @@ func compatNetworkConfig(t *testing.T) *config.NetworkConfig {
 	return cfg
 }
 
+// compatSolanaRPCURL is the Solana mainnet RPC the compat tests read. SOLANA_RPC_URL
+// overrides the public endpoint, which refuses requests from CI runners' addresses.
+func compatSolanaRPCURL(cfg *config.NetworkConfig) string {
+	if url := os.Getenv("SOLANA_RPC_URL"); url != "" {
+		return url
+	}
+	return cfg.SolanaRPCURL
+}
+
 func compatClient(t *testing.T) (*Client, solana.PublicKey) {
 	t.Helper()
 	cfg := compatNetworkConfig(t)
-	rpcClient := NewRPCClient(cfg.SolanaRPCURL)
+	rpcClient := NewRPCClient(compatSolanaRPCURL(cfg))
 	ledger := &rpcLedgerClient{rpc: NewRPCClient(cfg.LedgerPublicRPCURL)}
 	return NewWithLedger(rpcClient, cfg.RevenueDistributionProgramID, ledger), cfg.RevenueDistributionProgramID
 }
 
 func compatRPCClient(t *testing.T) *solanarpc.Client {
 	t.Helper()
 	cfg := compatNetworkConfig(t)
-	return NewRPCClient(cfg.SolanaRPCURL)
+	return NewRPCClient(compatSolanaRPCURL(cfg))
 }
 
 func fetchRawAccount(t *testing.T, rpcClient *solanarpc.Client, addr solana.PublicKey) []byte {

sdk/revdist/python/revdist/tests/test_compat.py

@@ -27,7 +27,7 @@ def compat_client() -> Client:
     from revdist.config import PROGRAM_ID, LEDGER_RPC_URLS
     from revdist.rpc import new_rpc_client
 
-    rpc_url = os.environ.get("SOLANA_RPC_URL", "https://api.mainnet-beta.solana.com")
+    rpc_url = os.environ.get("SOLANA_RPC_URL") or "https://api.mainnet-beta.solana.com"
     return Client(
         new_rpc_client(rpc_url),
         new_rpc_client(LEDGER_RPC_URLS["mainnet-beta"]),
@@ -36,7 +36,7 @@ def compat_client() -> Client:
 
 
 def _rpc_url() -> str:
-    return os.environ.get("SOLANA_RPC_URL", "https://api.mainnet-beta.solana.com")
+    return os.environ.get("SOLANA_RPC_URL") or "https://api.mainnet-beta.solana.com"
 
 
 async def fetch_raw_account(addr: Pubkey) -> bytes:

sdk/serviceability/python/serviceability/tests/test_compat.py

@@ -30,7 +30,7 @@ def skip_unless_compat() -> None:
 
 
 def _rpc_url() -> str:
-    return os.environ.get("SOLANA_RPC_URL", LEDGER_RPC_URLS["mainnet-beta"])
+    return os.environ.get("LEDGER_RPC_URL") or LEDGER_RPC_URLS["mainnet-beta"]
 
 
 def _program_id() -> Pubkey:

sdk/serviceability/typescript/serviceability/tests/compat.test.ts

@@ -36,7 +36,7 @@ function skipUnlessCompat(): void {
 }
 
 function rpcUrl(): string {
-  return process.env.SOLANA_RPC_URL || LEDGER_RPC_URLS["mainnet-beta"];
+  return process.env.LEDGER_RPC_URL || LEDGER_RPC_URLS["mainnet-beta"];
 }
 
 function programId(): PublicKey {