Skip to content

Commit c24169e

Browse files
roderikroderik
committed
feat: initial steps toward a monorepo
feat: regular checkout for docker step fix: demgrep fix fix: improve security checks fix: semgrepignore fix: semgrep finding fix: do not error on perfmance tips fix: do not fail on perf checks fix: fail and continue feat: ensure builx is used fix: buildx
1 parent 56e08bc commit c24169e

File tree

10 files changed

+266
-27
lines changed

10 files changed

+266
-27
lines changed

‎.github/renovate.json

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
33
"extends": [
44
"config:recommended",
5-
":automergeMinor",
6-
":automergePr",
7-
":automergeRequireAllStatusChecks",
85
":gitSignOff",
96
":pinVersions",
107
":semanticCommits",
@@ -15,14 +12,16 @@
1512
":prHourlyLimitNone",
1613
"security:openssf-scorecard",
1714
"schedule:nonOfficeHours",
18-
":disableDependencyDashboard"
15+
"group:all"
16+
],
17+
"labels": [
18+
"dependencies"
1919
],
20-
"labels": ["dependencies"],
2120
"rebaseWhen": "conflicted",
2221
"packageRules": [],
2322
"hostRules": [
2423
{
2524
"timeout": 3000000
2625
}
2726
]
28-
}
27+
}

‎.github/scripts/comment.js

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
module.exports = async ({ github, context, header, body }) => {
2+
const comment = [header, body].join("\n");
3+
4+
const { data: comments } = await github.rest.issues.listComments({
5+
owner: context.repo.owner,
6+
repo: context.repo.repo,
7+
issue_number: context.payload.number,
8+
});
9+
10+
const botComment = comments.find(
11+
(comment) =>
12+
// github-actions bot user
13+
comment.user.id === 41898282 && comment.body.startsWith(header)
14+
);
15+
16+
const commentFn = botComment ? "updateComment" : "createComment";
17+
18+
await github.rest.issues[commentFn]({
19+
owner: context.repo.owner,
20+
repo: context.repo.repo,
21+
body: comment,
22+
...(botComment
23+
? { comment_id: botComment.id }
24+
: { issue_number: context.payload.number }),
25+
});
26+
};

‎.github/workflows/solidity.yml

Lines changed: 200 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,203 @@ permissions:
3030
statuses: write
3131

3232
jobs:
33-
ci:
34-
name: CI
35-
uses: settlemint/smart-contracts-actions/.github/workflows/solidity.yml@main
36-
secrets:
37-
TOKEN: ${{ secrets.GITHUB_TOKEN }}
38-
with:
39-
docker-image-name: solidity-empty
40-
runs-on: solidity-empty
41-
ignition-module: "ignition/modules/Counter.ts"
42-
subgraph-contract-address-key: "CounterModule#Counter"
33+
codescanning:
34+
name: Code Scanning
35+
runs-on: ubuntu-latest
36+
container:
37+
image: returntocorp/semgrep
38+
steps:
39+
- name: Checkout
40+
uses: actions/checkout@v4
41+
with:
42+
submodules: recursive
43+
44+
- name: Install canvas dependencies
45+
run: |
46+
apk update
47+
apk add --no-cache cairo-dev jpeg-dev pango-dev giflib-dev build-base g++ pkgconfig
48+
49+
- name: Fetch semgrep rules
50+
uses: actions/checkout@v4
51+
with:
52+
repository: decurity/semgrep-smart-contracts
53+
path: rules
54+
55+
- run: semgrep ci --sarif --output=semgrep.sarif || true
56+
env:
57+
SEMGREP_RULES: rules/solidity/security rules/solidity/performance
58+
59+
- uses: crytic/[email protected]
60+
id: slither
61+
with:
62+
sarif: slither.sarif
63+
slither-args: --filter-paths "lib/" --filter-paths "node_modules/"
64+
solc-version: 0.8.24
65+
fail-on: none
66+
67+
- name: Upload findings to GitHub Advanced Security Dashboard
68+
uses: github/codeql-action/upload-sarif@v3
69+
with:
70+
sarif_file: semgrep.sarif
71+
if: always()
72+
73+
- name: Upload findings to GitHub Advanced Security Dashboard
74+
uses: github/codeql-action/upload-sarif@v3
75+
with:
76+
sarif_file: ${{ steps.slither.outputs.sarif }}
77+
if: always()
78+
79+
test:
80+
services:
81+
foundry:
82+
image: ghcr.io/settlemint/btp-anvil-test-node:latest
83+
ports:
84+
- '8545:8545'
85+
name: Test
86+
runs-on: ubuntu-latest
87+
steps:
88+
- name: Checkout
89+
uses: actions/checkout@v4
90+
with:
91+
submodules: recursive
92+
93+
- name: Install Foundry
94+
uses: foundry-rs/foundry-toolchain@v1
95+
with:
96+
version: nightly
97+
98+
- uses: actions/setup-node@v4
99+
with:
100+
node-version: 20
101+
102+
- name: Install Node dependencies
103+
run: npm install
104+
105+
- name: Run Forge build
106+
run: |
107+
forge --version
108+
forge build --sizes
109+
110+
- name: Run Hardhat build
111+
run: |
112+
npx hardhat compile
113+
114+
- name: Run Forge tests
115+
run: |
116+
forge test -vvv
117+
118+
- name: Run Hardhat test
119+
run: |
120+
npx hardhat test
121+
122+
- name: Setup LCOV
123+
if: github.ref_name != 'main'
124+
uses: hrishikesh-kadam/setup-lcov@v1
125+
126+
- name: Run Forge Coverage
127+
if: github.ref_name != 'main'
128+
run: |
129+
forge coverage --report lcov --report summary
130+
id: coverage
131+
132+
- name: Deploy to the local node
133+
run: |
134+
npx hardhat ignition deploy --network localhost ignition/modules/main.ts
135+
136+
- name: Install YQ
137+
uses: alexellis/arkade-get@master
138+
with:
139+
print-summary: false
140+
yq: latest
141+
142+
- name: Build the subgraph
143+
run: |
144+
if [ ! -d "subgraph" ] || [ -z "$(ls -A subgraph)" ]; then
145+
echo "Subgraph directory is missing or empty"
146+
exit 0
147+
fi
148+
npx graph-compiler --config subgraph/subgraph.config.json --include node_modules/@openzeppelin/subgraphs/src/datasources subgraph/datasources --export-schema --export-subgraph
149+
yq -i e '.specVersion = "1.2.0"' generated/scs.subgraph.yaml
150+
yq -i e '.features = ["nonFatalErrors", "fullTextSearch", "ipfsOnEthereumContracts"]' generated/scs.subgraph.yaml
151+
yq -i e '.dataSources[].mapping.apiVersion = "0.0.7"' generated/scs.subgraph.yaml
152+
yq -i e '.dataSources[].network = "localhost"' generated/scs.subgraph.yaml
153+
yq -i e '.templates[].mapping.apiVersion = "0.0.7"' generated/scs.subgraph.yaml
154+
yq -i e '.templates[].network = "localhost"' generated/scs.subgraph.yaml
155+
npx graph codegen generated/scs.subgraph.yaml
156+
npx graph build generated/scs.subgraph.yaml
157+
158+
- name: Report code coverage
159+
if: github.ref_name != 'main'
160+
uses: zgosalvez/[email protected]
161+
with:
162+
coverage-files: lcov.info
163+
minimum-coverage: 90
164+
github-token: ${{ secrets.GITHUB_TOKEN }}
165+
update-comment: true
166+
167+
docker:
168+
needs:
169+
- test
170+
name: Docker
171+
runs-on: ubuntu-latest
172+
steps:
173+
- name: Checkout
174+
uses: actions/checkout@v4
175+
with:
176+
submodules: recursive
177+
178+
- name: Set up QEMU
179+
uses: docker/setup-qemu-action@v3
180+
181+
- name: Set up Docker Buildx
182+
uses: docker/setup-buildx-action@v3
183+
184+
- name: Install Cosign
185+
uses: sigstore/cosign-installer@v3
186+
187+
- name: Login to GitHub Container Registry
188+
uses: docker/login-action@v3
189+
with:
190+
registry: ghcr.io
191+
username: ${{ github.repository_owner }}
192+
password: ${{ secrets.GITHUB_TOKEN }}
193+
194+
- name: Docker meta
195+
id: docker_meta
196+
uses: docker/metadata-action@v5
197+
with:
198+
images: |
199+
ghcr.io/${{ github.repository }}
200+
tags: |
201+
type=schedule
202+
type=ref,event=branch
203+
type=ref,event=pr
204+
type=semver,pattern={{version}}
205+
type=semver,pattern={{major}}.{{minor}}
206+
type=semver,pattern={{major}}
207+
type=sha
208+
209+
- name: Build and push
210+
uses: docker/build-push-action@v5
211+
id: build-and-push
212+
with:
213+
platforms: linux/amd64,linux/arm64
214+
provenance: true
215+
sbom: true
216+
push: true
217+
load: false
218+
tags: ${{ steps.docker_meta.outputs.tags }}
219+
labels: ${{ steps.docker_meta.outputs.labels }}
220+
no-cache: true
221+
222+
223+
- name: Sign the images with GitHub OIDC Token
224+
env:
225+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
226+
TAGS: ${{ steps.docker_meta.outputs.tags }}
227+
run: |
228+
images=""
229+
for tag in ${TAGS}; do
230+
images+="${tag}@${DIGEST} "
231+
done
232+
cosign sign --yes ${images}

‎.semgrepignore

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Common large paths
2+
node_modules/
3+
build/
4+
dist/
5+
vendor/
6+
.env/
7+
.venv/
8+
.tox/
9+
*.min.js
10+
.npm/
11+
.yarn/
12+
13+
# Common test paths
14+
test/
15+
tests/
16+
*_test.go
17+
18+
# Semgrep rules folder
19+
.semgrep
20+
21+
# Semgrep-action log folder
22+
.semgrep_logs/
23+
24+
# lib
25+
lib/

‎.vscode/tasks.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"id": "deployment-module",
66
"description": "Hardhat Ignition Module",
77
"type": "promptString",
8-
"default": "ignition/modules/Counter.ts"
8+
"default": "ignition/modules/main.ts"
99
},
1010
{
1111
"id": "extra-deployment",
@@ -100,4 +100,4 @@
100100
"problemMatcher": []
101101
}
102102
],
103-
}
103+
}

‎contracts/Counter.sol

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// SPDX-License-Identifier: MIT
2-
pragma solidity 0.8.26;
2+
pragma solidity ^0.8.24;
33

44
contract Counter {
55
event CounterIncremented(uint256 indexed newValue);
@@ -11,7 +11,7 @@ contract Counter {
1111
}
1212

1313
function increment() public {
14-
number++;
14+
++number;
1515
emit CounterIncremented(number);
1616
}
1717
}

‎foundry.toml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,10 @@
2222
libs = ['node_modules', 'lib']
2323
test = 'test'
2424
cache_path = 'cache_forge'
25-
solc = "0.8.26"
25+
solc = "0.8.24"
2626
optimizer = true
2727
optimizer_runs = 10_000
2828
gas_reports = ["*"]
2929
fuzz = { runs = 1_000 }
3030
auto_detect_solc = false
31-
extra_output_files = [ "metadata" ]
32-
fs_permissions = [{ access = "read", path = "./deployment-anvil.txt"}, { access = "read", path = "./deployment.txt"} ]
31+
extra_output_files = [ "metadata" ]

‎hardhat.config.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import type { HardhatUserConfig } from "hardhat/config";
55

66
const config: HardhatUserConfig = {
77
solidity: {
8-
version: "0.8.26",
8+
version: "0.8.24",
99
settings: {
1010
optimizer: {
1111
enabled: true,

‎ignition/modules/Counter.ts renamed to ‎ignition/modules/main.ts

File renamed without changes.

‎test/Counter.t.sol

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
// SPDX-License-Identifier: MIT
2-
pragma solidity 0.8.26;
2+
pragma solidity ^0.8.24;
33

4-
import { Test, console } from "forge-std/Test.sol";
5-
import { Counter } from "../contracts/Counter.sol";
4+
import {Test, console} from "forge-std/Test.sol";
5+
import {Counter} from "../contracts/Counter.sol";
66

77
contract CounterTest is Test {
88
Counter public counter;

0 commit comments

Comments
 (0)