feat(cli): Add program ID mismatch check before building

.github/workflows/reusable-tests.yaml

@@ -436,7 +436,7 @@ jobs:
             path: tests/safety-checks
           - cmd: cd tests/custom-coder && anchor test --skip-lint && npx tsc --noEmit
             path: tests/custom-coder
-          - cmd: cd tests/custom-discriminator && anchor test
+          - cmd: cd tests/custom-discriminator && anchor test --skip-lint && npx tsc --noEmit
             path: tests/custom-discriminator
           - cmd: cd tests/validator-clone && anchor test --skip-lint && npx tsc --noEmit
             path: tests/validator-clone
@@ -460,7 +460,7 @@ jobs:
             path: tests/bench
           - cmd: cd tests/idl && ./test.sh
             path: tests/idl
-          - cmd: cd tests/lazy-account && anchor test
+          - cmd: cd tests/lazy-account && anchor test --skip-lint
             path: tests/lazy-account
     steps:
       - uses: actions/checkout@v3

cli/src/lib.rs

@@ -1317,6 +1317,11 @@ pub fn build(
     check_anchor_version(&cfg).ok();
     check_deps(&cfg).ok();
 
+    // Check for program ID mismatches before building (skip if --skip-lint is used)
+    if !skip_lint {
+        check_program_id_mismatch(&cfg, program_name.clone())?;
+    }
+
     let idl_out = match idl {
         Some(idl) => Some(PathBuf::from(idl)),
         None => Some(cfg_parent.join("target").join("idl")),
@@ -4236,6 +4241,51 @@ fn keys_sync(cfg_override: &ConfigOverride, program_name: Option<String>) -> Res
     })
 }
 
+/// Check if there's a mismatch between the program keypair and the `declare_id!` in the source code.
+/// Returns an error if a mismatch is detected, prompting the user to run `anchor keys sync`.
+fn check_program_id_mismatch(cfg: &WithPath<Config>, program_name: Option<String>) -> Result<()> {
+    let declare_id_regex = RegexBuilder::new(r#"^(([\w]+::)*)declare_id!\("(\w*)"\)"#)
+        .multi_line(true)
+        .build()
+        .unwrap();
+
+    for program in cfg.get_programs(program_name)? {
+        // Get the pubkey from the keypair file
+        let actual_program_id = program.pubkey()?.to_string();
+
+        // Check declaration in program files
+        let src_path = program.path.join("src");
+        let files_to_check = vec![src_path.join("lib.rs"), src_path.join("id.rs")];
+
+        for path in files_to_check {
+            let content = match fs::read_to_string(&path) {
+                Ok(content) => content,
+                Err(_) => continue,
+            };
+
+            let incorrect_program_id = declare_id_regex
+                .captures(&content)
+                .and_then(|captures| captures.get(3))
+                .filter(|program_id_match| program_id_match.as_str() != actual_program_id);
+
+            if let Some(program_id_match) = incorrect_program_id {
+                let declared_id = program_id_match.as_str();
+                return Err(anyhow!(
+                    "Program ID mismatch detected for program '{}':\n  \
+                    Keypair file has: {}\n  \
+                    Source code has:  {}\n\n\
+                    Please run 'anchor keys sync' to update the program ID in your source code or use the '--skip-lint' flag to skip the lint checks.",
+                    program.lib_name,
+                    actual_program_id,
+                    declared_id
+                ));
+            }
+        }
+    }
+
+    Ok(())
+}
+
 fn localnet(
     cfg_override: &ConfigOverride,
     skip_build: bool,

client/example/run-test.sh

@@ -28,15 +28,15 @@ main() {
     local events_pid="2dhGsWUzy5YKUsjZdLHLmkNpUDAXkNa9MYWsPc4Ziqzy"
     local optional_pid="FNqz6pqLAwvMSds2FYjR4nKV3moVpPNtvkfGFrqLKrgG"
 
-    cd ../../tests/composite && anchor build && cd -
+    cd ../../tests/composite && anchor build --skip-lint && cd -
     [ $? -ne 0 ] && exit 1
-    cd ../../examples/tutorial/basic-2 && anchor build && cd -
+    cd ../../examples/tutorial/basic-2 && anchor build --skip-lint && cd -
     [ $? -ne 0 ] && exit 1
-    cd ../../examples/tutorial/basic-4 && anchor build && cd -
+    cd ../../examples/tutorial/basic-4 && anchor build --skip-lint && cd -
     [ $? -ne 0 ] && exit 1
-    cd ../../tests/events && anchor build && cd -
+    cd ../../tests/events && anchor build --skip-lint && cd -
     [ $? -ne 0 ] && exit 1
-    cd ../../tests/optional && anchor build && cd -
+    cd ../../tests/optional && anchor build --skip-lint && cd -
     [ $? -ne 0 ] && exit 1
 
     #

tests/custom-discriminator/tests/custom-discriminator.ts

@@ -45,7 +45,7 @@ describe("custom-discriminator", () => {
         "confirmed"
       );
       const myAccount = await program.account.myAccount.fetch(
-        pubkeys.myAccount
+        pubkeys.myAccount as anchor.web3.PublicKey
       );
       assert.strictEqual(myAccount.field, field);
     });

tests/safety-checks/Anchor.toml

@@ -1,6 +1,15 @@
+[toolchain]
+
+[features]
+resolution = true
+skip-lint = false
+
 [programs.localnet]
-unchecked_account = "Fg6PaFpoGXkYsidMpWTK6W2BeZ7FEfcYkg476zPFsLnS"
-account_info = "Fg6PaFpoGXkYsidMpWTK6W2BeZ7FEfcYkg476zPFsLnS"
+account_info = "99YPYSHjNekPHmMB7yrTxZCV2k2pRMKEqwwcqE62NqdA"
+unchecked_account = "4es8ojkX4URUyar2pbuLXQ4WoFtUizb5EupfaEgHjYQF"
+
+[registry]
+url = "https://api.apr.dev"
 
 [provider]
 cluster = "localnet"

tests/safety-checks/programs/unchecked-account/Cargo.toml

@@ -6,7 +6,7 @@ edition = "2018"
 
 [lib]
 crate-type = ["cdylib", "lib"]
-name = "safety_checks"
+name = "unchecked_account"
 
 [features]
 no-entrypoint = []

tests/safety-checks/test.sh

@@ -2,36 +2,42 @@
 
 echo "Building programs"
 
-#
-# Build the UncheckedAccount variant.
-#
-pushd programs/unchecked-account/
-output=$(anchor build 2>&1 > /dev/null)
+mkdir -p tmp
+
+# Test unchecked-account
+mv programs/account-info tmp/
+mv programs/ignore-non-accounts tmp/
+output=$(anchor keys sync && anchor build 2>&1 > /dev/null)
 if ! [[ $output =~ "Struct field \"unchecked\" is unsafe" ]]; then
-   echo "Error: expected /// CHECK error"
+   echo "Error: expected /// CHECK error in programs/unchecked-account"
    exit 1
 fi
-popd
+mv tmp/account-info programs/
+mv tmp/ignore-non-accounts programs/
 
-#
-# Build the AccountInfo variant.
-#
-pushd programs/account-info/
-output=$(anchor build 2>&1 > /dev/null)
+# Test account-info
+mv programs/unchecked-account tmp/
+mv programs/ignore-non-accounts tmp/
+output=$(anchor keys sync && anchor build 2>&1 > /dev/null)
 if ! [[ $output =~ "Struct field \"unchecked\" is unsafe" ]]; then
-   echo "Error: expected /// CHECK error"
+   echo "Error: expected /// CHECK error in programs/account-info"
    exit 1
 fi
-popd
-
-#
-# Build the control variant.
-#
-pushd programs/ignore-non-accounts/
-if ! anchor build ; then
-   echo "Error: anchor build failed when it shouldn't have"
+mv tmp/unchecked-account programs/
+mv tmp/ignore-non-accounts programs/
+
+# Test ignore-non-accounts
+mv programs/unchecked-account tmp/
+mv programs/account-info tmp/
+if ! anchor keys sync && anchor build ; then
+   echo "Error: anchor build failed when it shouldn't have in programs/ignore-non-accounts"
    exit 1
 fi
-popd
+mv tmp/unchecked-account programs/
+mv tmp/account-info programs/
+
+rmdir tmp
+
+git reset --hard
 
 echo "Success. As expected, all builds failed that were supposed to fail."