docs: Slither medium-zero milestone in PROGRESS #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Slither Analysis | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - fix/** | |
| - feature/** | |
| - ci/** | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| # ── Job 1: Scan clean code (basic, applications, defi, evm) ───────────────── | |
| # Uploads findings to GitHub Code Scanning — never blocks | |
| # (many "clean" teaching contracts intentionally use advanced patterns | |
| # that Slither flags, e.g. delegatecall, custom ERC20, DeFi math) | |
| slither-clean: | |
| name: "Slither — clean contracts" | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Foundry toolchain | |
| uses: foundry-rs/foundry-toolchain@v1 | |
| with: | |
| version: stable | |
| - name: Install Forge dependencies | |
| run: forge install | |
| # fail-on: none so findings never fail the step; do NOT use continue-on-error here — if Slither | |
| # crashes, we must skip SARIF upload or GitHub's "Code scanning results / Slither" check breaks. | |
| - name: Run Slither on clean contracts | |
| uses: crytic/slither-action@v0.4.1 | |
| id: slither-clean | |
| with: | |
| # slither --filter-paths expects a regex, not a comma-separated list | |
| slither-args: --filter-paths "(src/hacks|lib|test|script)(/|$)" | |
| sarif: slither-clean.sarif | |
| fail-on: none | |
| - name: Upload SARIF to GitHub Code Scanning | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: success() && hashFiles('slither-clean.sarif') != '' | |
| with: | |
| sarif_file: ${{ steps.slither-clean.outputs.sarif }} | |
| category: slither-clean | |
| # ── Job 2: Scan hacks/ (expected vulnerabilities) ─────────────────────────── | |
| # Informational only — results are kept as workflow artifacts (not Code Scanning) | |
| slither-hacks: | |
| name: "Slither — hacks (informational)" | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Foundry toolchain | |
| uses: foundry-rs/foundry-toolchain@v1 | |
| with: | |
| version: stable | |
| - name: Install Forge dependencies | |
| run: forge install | |
| - name: Run Slither on hacks/ (informational only) | |
| uses: crytic/slither-action@v0.4.1 | |
| id: slither-hacks | |
| continue-on-error: true | |
| with: | |
| # Scan only src/hacks by filtering out all other src/ directories | |
| slither-args: --filter-paths "src/basic,src/applications,src/defi,src/evm" | |
| sarif: slither-hacks.sarif | |
| fail-on: none | |
| - name: Upload hacks SARIF to GitHub Code Scanning | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() && hashFiles('slither-hacks.sarif') != '' | |
| with: | |
| sarif_file: ${{ steps.slither-hacks.outputs.sarif }} | |
| category: slither-hacks | |
| - name: Upload hacks SARIF as artifact | |
| uses: actions/upload-artifact@v4 | |
| if: always() && hashFiles('slither-hacks.sarif') != '' | |
| with: | |
| name: slither-hacks-sarif | |
| path: slither-hacks.sarif | |
| if-no-files-found: ignore |