diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml index 1abc1a07..65b4dfda 100644 --- a/.github/workflows/coverage.yaml +++ b/.github/workflows/coverage.yaml @@ -1,4 +1,4 @@ -name: Test +name: Coverage on: push: diff --git a/.github/workflows/slither.yaml b/.github/workflows/slither.yaml new file mode 100644 index 00000000..a9601aa7 --- /dev/null +++ b/.github/workflows/slither.yaml @@ -0,0 +1,55 @@ +name: Slither + +on: + push: + branches: + - main + pull_request: + branches: + - "*" + types: + - synchronize + - opened + - reopened + - ready_for_review + +jobs: + slither: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + submodules: recursive + + - name: Install Node.js + uses: actions/setup-node@v2 + with: + node-version: "18" + + - name: Install Foundry + uses: foundry-rs/foundry-toolchain@v1 + + - name: Install Dependencies + run: yarn install + + - name: Compile contracts + run: yarn compile + + - name: Run Slither + uses: crytic/slither-action@main + id: slither + continue-on-error: true + with: + sarif: results.sarifs + node-version: "18" + fail-on: none + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: ${{ steps.slither.outputs.sarif }} diff --git a/.gitignore b/.gitignore index b857c4e9..23576439 100644 --- a/.gitignore +++ b/.gitignore @@ -35,4 +35,4 @@ abi crytic-export out -cache_forge \ No newline at end of file +cache_forge diff --git a/foundry.toml b/foundry.toml index 5c1df4c3..937218cb 100644 --- a/foundry.toml +++ b/foundry.toml @@ -5,4 +5,6 @@ libs = ['node_modules', 'lib'] test = 'test' cache_path = 'cache_forge' no-match-contract = '.*EchidnaTest$' -auto_detect_solc = true \ No newline at end of file +auto_detect_solc = true +optimizer = true +optimizer_runs = 10_000 diff --git a/slither.config.json b/slither.config.json new file mode 100644 index 00000000..05d0dcb0 --- /dev/null +++ b/slither.config.json @@ -0,0 +1,7 @@ +{ + "compile_force_framework": "hardhat", + "detectors_to_exclude": "", + "filter_paths": "artifacts,cache,data,dist,docs,lib,node_modules,pkg,scripts,tasks,test,testing,typechain-types", + "hardhat_ignore_compile": true, + "npx_disable": true +}