evm-cctp-contracts/.github/workflows/ci.yml at 2f17d006d8330ebcc8d0422c2d777b7a203caa06 · circlefin/evm-cctp-contracts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: Continuous Integration
on:
  pull_request:
  push:
    branches: [master]
jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: block
          policy: global-allowed-endpoints-policy

      - name: Check out repository code
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          submodules: 'true'

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.10'

      - name: Install Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

      - name: Install Solhint
        run: npm i

      - name: Run Linter
        run: npm run lint

      - name: Build Forge Image
        run: make build

      - name: Run Unit Tests
        run: make test

      - name: Run Integration Tests
        run: make anvil-test

      - name: Run v2 Integration Tests
        run: make anvil-test-v2

  analyze-message-transmitter:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: block
          policy: global-allowed-endpoints-policy

      - name: Check out repository code
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          submodules: 'true'

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.10'

      - name: Run Static Analysis on Message Transmitter
        run: make analyze-message-transmitter

  analyze-message-transmitter-v2:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: block
          policy: global-allowed-endpoints-policy

      - name: Check out repository code
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          submodules: 'true'

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.10'

      - name: Run Static Analysis on Message Transmitter V2
        run: make analyze-message-transmitter-v2

  analyze-token-messenger-minter:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: block
          policy: global-allowed-endpoints-policy

      - name: Check out repository code
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          submodules: 'true'

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.10'

      - name: Run Static Analysis on Token Messenger Minter
        run: make analyze-token-messenger-minter

  scan:
    needs: lint-and-test
    if: github.event_name == 'pull_request'
    uses: circlefin/circle-public-github-workflows/.github/workflows/pr-scan.yaml@v1

  release-sbom:
    needs: lint-and-test
    if: github.event_name == 'push'
    uses: circlefin/circle-public-github-workflows/.github/workflows/attach-release-assets.yaml@v1