feat: warn on soldeer.lock revision mismatch during build

[silvekkk]

Warns when git revision in soldeer.lock differs from actual dependency revision.

Closes #12357

Not sure If should add test here, let me know if need

[grandizzy]

@silvekkk I think that could work too (cc @mario-eth ) but the original ticket was meant for foundry.lock and deps installed with forge install and updated with forge update

[grandizzy]

updated ticket name to reflect that. thank you!

[mario-eth]

cc @beeb

[beeb]

Ideally, this check would be more thorough and do the same consistency check we do in soldeer install (hashing all the files in the dependencies). It would be best if it reused the logic and types from soldeer_core too.

[silvekkk]

• Add SHA256 checksum verification for dependencies
• Check both checksum and git revision
• Provide clear warnings for integrity failures
• Follow soldeer's verification approach

is this what in your mind? @beeb cc @grandizzy @mario-eth

[beeb]

@silvekkk You reimplemented everything which is not great, because if we ever decide to change something about the lockfile or dependencies folder structure, your code will break.

Please add a dependency to soldeer_core in forge/Cargo.toml using soldeer-core.workspace = true.

You can then use the following:

• https://docs.rs/soldeer-core/0.9.0/soldeer_core/lock/fn.read_lockfile.html
• https://docs.rs/soldeer-core/0.9.0/soldeer_core/install/fn.check_dependency_integrity.html

[silvekkk]

@beeb Thanks for the feedback! I'vereverted and refactored to use the soldeer_core APIs:

• Added soldeer-core dependency
• Using read_lockfile() and check_dependency_integrity() as you suggested
• Removed all custom implementation

[beeb]

Thanks for the changes. Although this all feels very LLM generated, I left some comments.

[silvekkk]

Thanks for the changes. Although this all feels very LLM generated, I left some comments.

Yeah, about 50–60% of the later commits were actually done with Claude’s help. I asked it to add comments, clean up the structure, and handle a few checks I probably overlooked, and final review.
Haha, trust me—if you’d seen my original code, you probably wouldn’t even have felt like leaving a comment. (It was that bad.) best 20$ I paid ever