Fix mainnet snapshot mirror digest handling

[UnArbosFive]

Summary

• publish the mainnet snapshot through the existing current-run artifact helper
• obtain the API-normalized sha256: digest instead of passing the raw upload-action output
• run cache-boundary validation when the snapshot workflow changes
• assert the mainnet mirror path cannot regress to the raw digest output

Context

The snapshot artifact upload succeeds, but the mirror publisher rejects the upload action’s unprefixed digest. That makes the trusted producer run fail, so the local artifact cache correctly refuses it and consumers fall back to GitHub.

Validation

• .github/scripts/test-r2-artifact-mirror.py
• YAML parsing for refresh-mainnet-snapshot.yml and validate-sccache.yml
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
subtensor	Ready	Preview	Aug 1, 2026 12:32pm

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

VERY HIGH account-age/public-repo scrutiny, tempered by repository admin status and substantial merged contributions; no Gittensor association; branch snapshot-artifact-digest-prefix → main.

The change replaces direct use of the upload action’s raw digest with the existing allowlisted current-run helper, which resolves exactly one non-expired artifact from the immutable current workflow run and validates the API-normalized SHA-256 digest. No AI-review trust-boundary files, dependency surfaces, runtime code, or credential permissions are changed.

Findings

No findings.

Conclusion

The small, purpose-matched diff narrows artifact selection to the current run and introduces no security vulnerability or malicious behavior.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👍

Gittensor association: UNKNOWN; newer but high-activity repository administrator, reviewed with external-contributor scrutiny.

The workflow now resolves the uploaded snapshot through the existing current-run helper, which obtains and validates the API-normalized sha256: digest before publishing. The accompanying boundary assertion and validation-workflow path trigger cover the regression. No runtime/spec-version change or auto-fix is required.

PR #2853 overlaps only in shared CI infrastructure and addresses an unrelated TypeScript SDK change; it is not duplicate work.

Findings

No findings.

Conclusion

The change is minimal, consistent with the PR description, and correctly reuses the established artifact-selection boundary. No blocking domain issues found.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍