fix(ci): repair Slither SARIF upload for Code Scanning checks

- Stop continue-on-error on slither-clean (avoid upload without valid SARIF)
- Upload via upload-sarif@v4, path from slither action outputs, fetch-depth 0, checkout v6
- Bump crytic/slither-action to v0.4.1; guard hacks artifact on file existence
- CI.md: accurate jobs, Code Scanning troubleshooting; PROGRESS update

Made-with: Cursor

Author: KaelSensei

.github/workflows/slither.yml

@@ -25,7 +25,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Install Foundry toolchain
         uses: foundry-rs/foundry-toolchain@v1
@@ -35,21 +37,22 @@ jobs:
       - name: Install Forge dependencies
         run: forge install
 
+      # fail-on: none so findings never fail the step; do NOT use continue-on-error here — if Slither
+      # crashes, we must skip SARIF upload or GitHub's "Code scanning results / Slither" check breaks.
       - name: Run Slither on clean contracts
-        uses: crytic/slither-action@v0.4.0
+        uses: crytic/slither-action@v0.4.1
         id: slither-clean
-        continue-on-error: true  # informational — teaching repo uses intentional patterns
         with:
           # slither --filter-paths expects a regex, not a comma-separated list
           slither-args: --filter-paths "(src/hacks|lib|test|script)(/|$)"
           sarif: slither-clean.sarif
           fail-on: none
 
       - name: Upload SARIF to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
-        if: always()
+        uses: github/codeql-action/upload-sarif@v4
+        if: success() && hashFiles('slither-clean.sarif') != ''
         with:
-          sarif_file: slither-clean.sarif
+          sarif_file: ${{ steps.slither-clean.outputs.sarif }}
           category: slither-clean
 
   # ── Job 2: Scan hacks/ (expected vulnerabilities) ───────────────────────────
@@ -62,7 +65,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Install Foundry toolchain
         uses: foundry-rs/foundry-toolchain@v1
@@ -73,7 +78,7 @@ jobs:
         run: forge install
 
       - name: Run Slither on hacks/ (informational only)
-        uses: crytic/slither-action@v0.4.0
+        uses: crytic/slither-action@v0.4.1
         id: slither-hacks
         continue-on-error: true
         with:
@@ -84,7 +89,8 @@ jobs:
 
       - name: Upload hacks SARIF as artifact
         uses: actions/upload-artifact@v4
-        if: always()
+        if: always() && hashFiles('slither-hacks.sarif') != ''
         with:
           name: slither-hacks-sarif
           path: slither-hacks.sarif
+          if-no-files-found: ignore

CI.md

@@ -11,7 +11,7 @@ Three GitHub Actions workflows run on every push and pull request:
 | Workflow | File | Purpose | Blocks PRs? |
 |----------|------|---------|-------------|
 | **Forge Tests** | `forge-tests.yml` | Run all 922 Foundry tests | ✅ Yes |
-| **Slither Analysis** | `slither.yml` | Static analysis for vulnerabilities | ✅ Yes (clean code only) |
+| **Slither Analysis** | `slither.yml` | Static analysis → SARIF / Code Scanning | ✅ Yes — if Slither or `forge install` fails |
 | **Coverage** | `coverage.yml` | Test coverage report → Codecov | ❌ No (informational) |
 
 ---
@@ -47,32 +47,33 @@ This repository has a `hacks/` folder containing **intentionally vulnerable cont
 
 Two jobs solve this cleanly:
 
-### Job 1 — `slither-clean` (blocks PRs)
+### Job 1 — `slither-clean` (SARIF → Code Scanning)
 
-Scans all production-quality contracts:
-- `src/basic/`
-- `src/applications/`
-- `src/defi/`
-- `src/evm/`
+Scans all production-quality contracts (excludes `src/hacks/`, `lib/`, `test/`, `script/` via `--filter-paths`):
 
-Configured with `fail-on: high` — any high-severity finding **blocks the PR**.
+- `src/basic/`, `src/applications/`, `src/defi/`, `src/evm/`
 
-Results are uploaded as SARIF and visible in **GitHub → Security → Code Scanning**:
-- Inline annotations on the affected lines
-- Persistent alert history
-- Severity filtering (high / medium / low / informational)
+Uses **`fail-on: none`** so Slither findings do not fail the step; reviewers use **GitHub Advanced Security** comments and the Security tab. The **job** still fails if compilation/analysis breaks (e.g. bad Solidity, `forge install` failure).
 
-### Job 2 — `slither-hacks` (never blocks)
+SARIF upload follows [crytic/slither-action](https://github.com/crytic/slither-action): use the action’s **`outputs.sarif`** path with `github/codeql-action/upload-sarif`, and **do not** combine `continue-on-error` on the Slither step with an unconditional upload — that can yield a failed **Code scanning results / Slither** check (e.g. missing or invalid upload).
 
-Scans only `src/hacks/` with `continue-on-error: true` and `fail-on: none`.
+Results appear under **GitHub → Security → Code Scanning** (category `slither-clean`).
 
-Purpose: document that vulnerabilities **are** intentionally present. If someone accidentally fixes a vulnerability in `hacks/`, the finding disappears from the report — a useful signal that the educational example has been compromised.
+### Job 2 — `slither-hacks` (artifact only, non-blocking)
 
-Results are uploaded to a separate SARIF category (`slither-hacks`) so they don't pollute the clean code findings.
+Scans roughly `src/hacks/` by filtering out the other `src/*` trees. Uses `continue-on-error: true` and `fail-on: none` so intentional vulnerable demos do not break CI.
+
+The SARIF file is attached as a **workflow artifact** (`slither-hacks-sarif`) for inspection — it is **not** uploaded to Code Scanning (keeps hacks findings out of the main alert stream).
+
+### Troubleshooting: “Code scanning results / Slither” / configuration issues
+
+1. Open the **Slither — clean contracts** job log: confirm Slither finished and `slither-clean.sarif` exists.
+2. Under **Settings → Code security and analysis → Code scanning**, ensure you do not have a **stale** third-party configuration pointing at a deleted workflow; use the [tool status](https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-for-your-repository/about-the-tool-status-page) page if available.
+3. For **fork PRs**, `security-events: write` may be restricted; uploads only run reliably for PRs from the same repository unless you adopt a [fork-safe pattern](https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/resource-not-accessible).
 
 ### Viewing results
 
-→ **GitHub Security → Code Scanning alerts**
+→ **GitHub Security → Code Scanning alerts**  
 `https://github.com/KaelSensei/solidity-dojo/security/code-scanning`
 
 ---

PROGRESS.md

@@ -9,6 +9,7 @@ A hands-on Solidity training ground based on solidity-by-example.org.
 - [x] **Naming / NatSpec cleanup (2026-04)**: After Slither-oriented renames, fixed shadowing bugs (`value = value`, `num = num`), aligned bodies with new parameter names, removed drift-prone `/// @param` lines under `src/` (excluding `src/hacks/`), added `scripts/strip_natspec_params.py`, and updated tests (`ERC20Permit`, `GasGolf`, `Immutable`). Full suite green via `forge test` in Docker.
 - [x] **Slither / Code Scanning (zero address)**: Added `require(... != address(0), "Zero address")` on low-level call entry points flagged in PR review (`Call`, `SendingEther`, `TryCatch`, `Payable.withdrawTo`, `Immutable` constructor, `Delegatecall` proxy + demo), with matching revert tests.
 - [x] **Codecov**: Upgraded `codecov/codecov-action` to v5, added root `codecov.yml` (informational checks, PR comment layout), documented installing the [Codecov GitHub App](https://github.com/marketplace/codecov) in `CI.md` for reliable uploads and PR comments.
+- [x] **Code Scanning / Slither workflow**: Fixed SARIF upload (use `steps.slither-clean.outputs.sarif`, `upload-sarif@v4`, `fetch-depth: 0`, remove `continue-on-error` on clean scan so failed runs do not upload empty SARIF; `crytic/slither-action@v0.4.1`). Corrected `CI.md` (hacks job = artifact only; accurate fail-on / troubleshooting).
 
 ### ✅ Phase 1: Project Setup
 - [x] Copy training documentation to repo