Extend CI with Slither and SMT Checker #22
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CI" | |
| concurrency: | |
| cancel-in-progress: true | |
| group: ${{github.workflow}}-${{github.ref}} | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| env: | |
| FOUNDRY_PROFILE: ci | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Install Foundry | |
| uses: foundry-rs/foundry-toolchain@v1 | |
| with: | |
| version: nightly | |
| - name: "Show the Foundry config" | |
| run: "forge config" | |
| - name: Run Forge build | |
| run: | | |
| forge --version | |
| forge build --sizes | |
| id: build | |
| - name: "Cache the build so that it can be re-used by the other jobs" | |
| uses: "actions/cache/save@v3" | |
| with: | |
| path: "out" | |
| key: "foundry-build-${{ github.sha }}" | |
| - name: "Store the contract artifacts in CI" | |
| uses: "actions/upload-artifact@v3" | |
| with: | |
| name: "contract-artifacts" | |
| path: "artifacts" | |
| - name: "Add build summary" | |
| run: | | |
| echo "## Build result" >> $GITHUB_STEP_SUMMARY | |
| echo "✅ Passed" >> $GITHUB_STEP_SUMMARY | |
| test: | |
| needs: ["build"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: "Install Foundry" | |
| uses: "foundry-rs/foundry-toolchain@v1" | |
| - name: "Restore the cached build" | |
| uses: "actions/cache/restore@v3" | |
| with: | |
| fail-on-cache-miss: true | |
| key: "foundry-build-${{ github.sha }}" | |
| path: "out" | |
| - name: "Run the tests against the build" | |
| run: "forge test" | |
| env: | |
| FOUNDRY_PROFILE: ci | |
| CENTRIFUGE_CHAIN_ORIGIN: ${{ secrets.CENTRIFUGE_CHAIN_ORIGIN }} | |
| MAINNET_RPC_URL: ${{ secrets.MAINNET_RPC_URL }} | |
| POLYGON_RPC_URL: ${{ secrets.POLYGON_RPC_URL }} | |
| SETUP_TEST_DATA: false | |
| - name: "Add test summary" | |
| run: | | |
| echo "## Unit tests result" >> $GITHUB_STEP_SUMMARY | |
| echo "✅ Passed" >> $GITHUB_STEP_SUMMARY | |
| lint: | |
| needs: ["build"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: "Install Foundry" | |
| uses: "foundry-rs/foundry-toolchain@v1" | |
| - name: "Restore the cached build" | |
| uses: "actions/cache/restore@v3" | |
| with: | |
| fail-on-cache-miss: true | |
| key: "foundry-build-${{ github.sha }}" | |
| path: "out" | |
| - name: Check formatting | |
| run: forge fmt --check | |
| env: | |
| FOUNDRY_PROFILE: ci | |
| coverage: | |
| needs: ["build"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Install Foundry | |
| uses: foundry-rs/foundry-toolchain@v1 | |
| - name: Run coverage | |
| run: forge coverage --report summary --report lcov | |
| # To ignore coverage for certain directories modify the paths in this step as needed. The | |
| # below default ignores coverage results for the test and script directories. Alternatively, | |
| # to include coverage in all directories, comment out this step. Note that because this | |
| # filtering applies to the lcov file, the summary table generated in the previous step will | |
| # still include all files and directories. | |
| # The `--rc lcov_branch_coverage=1` part keeps branch info in the filtered report, since lcov | |
| # defaults to removing branch info. | |
| - name: Filter directories | |
| run: | | |
| sudo apt update && sudo apt install -y lcov | |
| lcov --remove lcov.info 'test/*' 'script/*' --output-file lcov.info --rc lcov_branch_coverage=1 | |
| # This step posts a detailed coverage report as a comment and deletes previous comments on | |
| # each push. The below step is used to fail coverage if the specified coverage threshold is | |
| # not met. The below step can post a comment (when it's `github-token` is specified) but it's | |
| # not as useful, and this action cannot fail CI based on a minimum coverage threshold, which | |
| # is why we use both in this way. | |
| - name: Post coverage report | |
| if: github.event_name == 'ci' # This action fails when ran outside of a pull request. | |
| uses: romeovs/lcov-reporter-action@v0.3.1 | |
| with: | |
| delete-old-comments: true | |
| lcov-file: ./lcov.info | |
| github-token: ${{ secrets.GITHUB_TOKEN }} # Adds a coverage summary comment to the PR. | |
| - name: Verify minimum coverage | |
| uses: zgosalvez/github-actions-report-lcov@v2 | |
| with: | |
| coverage-files: ./lcov.info | |
| minimum-coverage: 60 # Set coverage threshold. | |
| slither-analyze: | |
| needs: ["build"] | |
| runs-on: "ubuntu-latest" | |
| permissions: | |
| actions: "read" | |
| contents: "read" | |
| security-events: "write" | |
| steps: | |
| - name: "Check out the repo" | |
| uses: "actions/checkout@v3" | |
| with: | |
| submodules: "recursive" | |
| - name: "Run Slither analysis" | |
| uses: "crytic/slither-action@v0.3.0" | |
| id: "slither" | |
| with: | |
| fail-on: "none" | |
| sarif: "results.sarif" | |
| solc-version: "0.8.21" | |
| target: "src/" | |
| - name: "Upload SARIF file to GitHub code scanning" | |
| uses: "github/codeql-action/upload-sarif@v2" | |
| with: | |
| sarif_file: ${{ steps.slither.outputs.sarif }} | |
| - name: "Add Slither summary" | |
| run: | | |
| echo "## Slither result" >> $GITHUB_STEP_SUMMARY | |
| echo "✅ Uploaded to GitHub code scanning" >> $GITHUB_STEP_SUMMARY |