fix: remove secrets, PII, response bodies from prod logs; preserve stack traces. #1043

	name: 'CI [contracts]'

	on:
	push:
	branches: [main]
	pull_request:

	env:
	FOUNDRY_PROFILE: ci

	jobs:
	check-contracts:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5
	with:
	submodules: recursive

	- name: Install Foundry
	uses: foundry-rs/foundry-toolchain@v1

	- name: Forge version
	run: \|
	forge --version

	- name: Format
	run: \|
	forge fmt --check
	id: fmt

	- name: Build
	run: \|
	forge build --sizes
	id: build

	- name: Test
	run: \|
	forge test -vvv
	id: test
	# ── Slither Static Analysis ──
	- name: Run Slither
	uses: crytic/slither-action@v0.4.2
	with:
	slither-config: slither.config.json
	slither-args: --filter-paths "contracts/lib"
	sarif: slither-results.sarif
	solc-version: '0.8.13'
	continue-on-error: true # Advisory mode

	- name: Upload Slither results
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: slither-results
	path: slither-results.sarif

	- name: Upload SARIF to GitHub Security tab
	if: always() && vars.ENABLE_GHAS == 'true'
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: slither-results.sarif
	category: slither

	dispatch-telemetry:
	needs: [check-contracts]
	if: >-
	always() && (
	github.event_name == 'push' \|\|
	github.event.pull_request.head.repo.full_name == github.repository
	)
	runs-on: ubuntu-latest
	permissions:
	contents: write
	steps:
	- name: Dispatch telemetry event
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	gh api "repos/${{ github.repository }}/dispatches" \
	--method POST \
	-f event_type=workflow-telemetry \
	-f "client_payload[run_id]=${{ github.run_id }}"

Provide feedback