From 5cea350df6cad54925e8c99ebe99e9d1b0ea1aa2 Mon Sep 17 00:00:00 2001
From: Pileks <jure@metadao.fi>
Date: Fri, 4 Sep 2026 14:15:16 +0200
Subject: [PATCH 1/2] use local anchor test action

---
 .github/actions/anchor-test/action.yml | 55 ++++++++++++++++++++++++++
 .github/workflows/anchor-test.yaml     |  2 +-
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 .github/actions/anchor-test/action.yml

diff --git a/.github/actions/anchor-test/action.yml b/.github/actions/anchor-test/action.yml
new file mode 100644
index 00000000..f22e983c
--- /dev/null
+++ b/.github/actions/anchor-test/action.yml
@@ -0,0 +1,55 @@
+name: 'Anchor Test'
+description: 'An "anchor test" action that runs in ~1 minute.'
+branding:
+  icon: anchor
+  color: blue
+inputs:
+  node-version:
+    description: 'Version of node.js to use'
+    required: false
+    default: '20.11.0' # LTS
+  solana-cli-version:
+    description: 'Version of Solana CLI to use'
+    required: false
+    default: '1.17.16' # stable
+  anchor-version:
+    description: 'Version of Anchor to use'
+    required: false
+    default: '0.29.0' # latest
+  features:
+    description: 'Features to pass to cargo'
+    required: false
+    default: 'default'
+runs:
+  using: 'composite'
+  steps:
+    - uses: metadaoproject/setup-anchor@v3.4
+      with:
+        node-version: ${{ inputs.node-version }}
+        solana-cli-version: ${{ inputs.solana-cli-version }}
+        anchor-version: ${{ inputs.anchor-version }}
+    - name: Cache node_modules
+      uses: actions/cache@v4
+      with:
+        path: ./node_modules/
+        key: node-modules-${{ runner.os }}-build-${{ inputs.node-version }}-${{ hashFiles('yarn.lock') }}
+    - name: Install node_modules
+      run: yarn
+      shell: bash
+    - name: Create keypair
+      run: solana-keygen new --no-bip39-passphrase
+      shell: bash
+    - name: Make Anchor.toml compatible with runner
+      run: sed -i 's:/user/:/runner/:' Anchor.toml
+      shell: bash
+    - name: Install Cargo toolchain
+      uses: actions-rs/toolchain@v1
+      with:
+        toolchain: stable
+        profile: minimal
+        components: rustc
+    - name: Cache Cargo dependencies
+      uses: Swatinem/rust-cache@v2
+    - name: Run tests
+      run: anchor test -- --features ${{ inputs.features }}
+      shell: bash
diff --git a/.github/workflows/anchor-test.yaml b/.github/workflows/anchor-test.yaml
index 5c10b713..032b316f 100644
--- a/.github/workflows/anchor-test.yaml
+++ b/.github/workflows/anchor-test.yaml
@@ -37,7 +37,7 @@ jobs:
           cd sdk
           yarn build
 
-      - uses: metadaoproject/anchor-test@876dde6990e0a3d22e1cf1c702b4e4c64aa47d15 # v2.3
+      - uses: ./.github/actions/anchor-test
         with:
           anchor-version: '0.29.0'
           solana-cli-version: '1.17.31'

From 2977f4412776f01c946875fc83d22b7f259f3306 Mon Sep 17 00:00:00 2001
From: Pileks <jure@metadao.fi>
Date: Fri, 4 Sep 2026 14:35:38 +0200
Subject: [PATCH 2/2] pin action version, adjust repo guard

---
 .github/actions/anchor-test/action.yml | 6 +++---
 .github/repo-guard.toml                | 7 ++++++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/actions/anchor-test/action.yml b/.github/actions/anchor-test/action.yml
index f22e983c..fe2f8b98 100644
--- a/.github/actions/anchor-test/action.yml
+++ b/.github/actions/anchor-test/action.yml
@@ -23,7 +23,7 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - uses: metadaoproject/setup-anchor@v3.4
+    - uses: metadaoproject/setup-anchor@aeeb5505f3fd3d52a1080d14863c6aa428c9fdf9 # v3.4
       with:
         node-version: ${{ inputs.node-version }}
         solana-cli-version: ${{ inputs.solana-cli-version }}
@@ -43,13 +43,13 @@ runs:
       run: sed -i 's:/user/:/runner/:' Anchor.toml
       shell: bash
     - name: Install Cargo toolchain
-      uses: actions-rs/toolchain@v1
+      uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
       with:
         toolchain: stable
         profile: minimal
         components: rustc
     - name: Cache Cargo dependencies
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
     - name: Run tests
       run: anchor test -- --features ${{ inputs.features }}
       shell: bash
diff --git a/.github/repo-guard.toml b/.github/repo-guard.toml
index 35c5ae1b..2b27009c 100644
--- a/.github/repo-guard.toml
+++ b/.github/repo-guard.toml
@@ -72,7 +72,10 @@ package_min_age_days = 14
 [actions.sha_allowlist]
 "metadaoproject/anchor-test" = ["876dde6990e0a3d22e1cf1c702b4e4c64aa47d15"]               # v2.3
 "metadaoproject/anchor-verifiable-build" = ["6d8fc1999ea4b7ff701e8b166903b398741e1c50"] # v0.4
-"metadaoproject/setup-anchor" = ["7d1e9699eb18c33ba5f32f6a9952f0e90515996a"]             # v3.2
+"metadaoproject/setup-anchor" = [
+  "7d1e9699eb18c33ba5f32f6a9952f0e90515996a",                                            # v3.2
+  "aeeb5505f3fd3d52a1080d14863c6aa428c9fdf9",                                            # v3.4
+]
 "nick-fields/retry" = [
   "ce71cc2ab81d554ebbe88c79ab5975992d79ba08",                                            # v3
   "14672906e672a08bd6eeb15720e9ed3ce869cdd4",                                            # v2
@@ -82,6 +85,8 @@ package_min_age_days = 14
 "EndBug/add-and-commit" = ["a94899bca583c204427a224a7af87c02f9b325d5"]                   # v9.1.4
 "peter-evans/find-comment" = ["3eae4d37986fb5a8592848f6a574fdf654e61f9e"]               # v3
 "peter-evans/create-or-update-comment" = ["71345be0265236311c031f5c7866368bd1eff043"]   # v4
+"actions-rs/toolchain" = ["16499b5e05bf2e26879000db0c1d13f7e13fa3af"]                    # v1.0.7
+"Swatinem/rust-cache" = ["6323deb102c322ba6fcbdcafc7e3dddab59af2b6"]                     # v2.9.2
 
 [sensitive_diff]
 # Files where any change should be surfaced for security review even if no