fix(security): harden StarForge cache paths #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Contract Test Pipeline | ||
|
Check failure on line 1 in .github/workflows/contract-test.yml
|
||
| on: | ||
| push: | ||
| paths: | ||
| - '**.wasm' | ||
| - 'src/**' | ||
| - 'tests/**' | ||
| - 'Cargo.toml' | ||
| - 'Cargo.lock' | ||
| pull_request: | ||
| paths: | ||
| - '**.wasm' | ||
| - 'src/**' | ||
| - 'tests/**' | ||
| - 'Cargo.toml' | ||
| - 'Cargo.lock' | ||
| workflow_dispatch: | ||
| inputs: | ||
| network: | ||
| description: Target network for integration tests | ||
| required: false | ||
| default: testnet | ||
| type: choice | ||
| options: [testnet, mainnet] | ||
| wasm_path: | ||
| description: Path to compiled WASM file (optional) | ||
| required: false | ||
| type: string | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| unit-tests: | ||
| name: Unit Tests | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@stable | ||
| - name: Install system dependencies | ||
| run: sudo apt-get update && sudo apt-get install -y libudev-dev | ||
| - name: Run unit tests | ||
| run: cargo test --locked -- --test-threads=1 | ||
| lint-contract: | ||
| name: Contract Lint | ||
| runs-on: ubuntu-latest | ||
| needs: unit-tests | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| components: clippy | ||
| - name: Install system dependencies | ||
| run: sudo apt-get update && sudo apt-get install -y libudev-dev | ||
| - name: Install starforge | ||
| run: cargo build --locked --release && cp target/release/starforge /usr/local/bin/starforge | ||
| - name: Lint contract (if WASM available) | ||
| if: ${{ inputs.wasm_path != '' }} | ||
| run: starforge lint --wasm "${{ inputs.wasm_path }}" | ||
| continue-on-error: true | ||
| gas-analysis: | ||
| name: Gas Analysis | ||
| runs-on: ubuntu-latest | ||
| needs: unit-tests | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@stable | ||
| - name: Install system dependencies | ||
| run: sudo apt-get update && sudo apt-get install -y libudev-dev | ||
| - name: Build | ||
| run: cargo build --locked --release | ||
| - name: Install starforge | ||
| run: cp target/release/starforge /usr/local/bin/starforge | ||
| - name: Run gas analysis (if WASM available) | ||
| if: ${{ inputs.wasm_path != '' }} | ||
| run: starforge gas analyze --wasm "${{ inputs.wasm_path }}" --network "${{ inputs.network || 'testnet' }}" | ||
| continue-on-error: true | ||
| security-audit: | ||
| name: Security Audit | ||
| runs-on: ubuntu-latest | ||
| needs: unit-tests | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dtolnay/rust-toolchain@stable | ||
| - name: Install system dependencies | ||
| run: sudo apt-get update && sudo apt-get install -y libudev-dev | ||
| - name: Build | ||
| run: cargo build --locked --release | ||
| - name: Install starforge | ||
| run: cp target/release/starforge /usr/local/bin/starforge | ||
| - name: Run security audit (if WASM available) | ||
| if: ${{ inputs.wasm_path != '' }} | ||
| run: starforge audit --wasm "${{ inputs.wasm_path }}" --output json > audit-results.json | ||
| continue-on-error: true | ||
| - name: Upload audit results | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: audit-results | ||
| path: audit-results.json | ||
| if-no-files-found: ignore | ||
| notify: | ||
| name: Notify Results | ||
| runs-on: ubuntu-latest | ||
| needs: [unit-tests, lint-contract, gas-analysis, security-audit] | ||
| if: always() | ||
| steps: | ||
| - name: Notify on failure | ||
| if: ${{ contains(needs.*.result, 'failure') && secrets.SLACK_WEBHOOK_URL != '' }} | ||
| uses: slackapi/slack-github-action@v1 | ||
| with: | ||
| payload: | | ||
| { | ||
| "text": "❌ Contract test pipeline failed", | ||
| "attachments": [{ | ||
| "color": "danger", | ||
| "fields": [ | ||
| { "title": "Repository", "value": "${{ github.repository }}", "short": true }, | ||
| { "title": "Branch", "value": "${{ github.ref_name }}", "short": true }, | ||
| { "title": "Commit", "value": "${{ github.sha }}", "short": false }, | ||
| { "title": "Details", "value": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", "short": false } | ||
| ] | ||
| }] | ||
| } | ||
| env: | ||
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | ||
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | ||
| - name: Notify on success | ||
| if: ${{ !contains(needs.*.result, 'failure') && secrets.SLACK_WEBHOOK_URL != '' }} | ||
| uses: slackapi/slack-github-action@v1 | ||
| with: | ||
| payload: | | ||
| { | ||
| "text": "✅ Contract test pipeline passed", | ||
| "attachments": [{ | ||
| "color": "good", | ||
| "fields": [ | ||
| { "title": "Repository", "value": "${{ github.repository }}", "short": true }, | ||
| { "title": "Branch", "value": "${{ github.ref_name }}", "short": true } | ||
| ] | ||
| }] | ||
| } | ||
| env: | ||
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | ||
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | ||
