fix(dapp): resolve CI failures in AI insights dashboard #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Smart Contract Audit | ||
| on: | ||
| push: | ||
| branches: ["main"] | ||
| paths: | ||
| - "packages/contracts/**" | ||
| - "scripts/contract-audit.sh" | ||
| - ".github/workflows/contract-audit.yml" | ||
| pull_request: | ||
| paths: | ||
| - "packages/contracts/**" | ||
| - "scripts/contract-audit.sh" | ||
| - ".github/workflows/contract-audit.yml" | ||
| workflow_dispatch: | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| x402-audit: | ||
| name: x402 Heuristic Contract Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Make audit script executable | ||
| run: chmod +x scripts/contract-audit.sh | ||
| - name: Run pre-deploy contract audit | ||
| env: | ||
| X402_PAYMENT_PROOF: ${{ secrets.X402_PAYMENT_PROOF }} | ||
| CONTRACT_AUDIT_ADDRESSES: ${{ vars.CONTRACT_AUDIT_ADDRESSES }} | ||
| CONTRACT_AUDIT_API_URL: ${{ vars.CONTRACT_AUDIT_API_URL }} | ||
| run: ./scripts/contract-audit.sh | ||
| - name: Build contracts and calculate WASM hashes | ||
| run: | | ||
| cd packages/contracts | ||
| rustup target add wasm32-unknown-unknown | ||
| # Build only workspace-member contracts (excludes non-member dirs like rent_escrow) | ||
| # Use cargo metadata to enumerate workspace package names, then filter to those | ||
| # whose manifest path lives under contracts/. | ||
| cargo metadata --no-deps --format-version 1 \ | ||
| | python3 -c " | ||
| import sys, json | ||
| meta = json.load(sys.stdin) | ||
| for pkg in meta['packages']: | ||
| if '/contracts/' in pkg['manifest_path'].replace('\\\\','/') and \ | ||
| '/test_fixtures/' not in pkg['manifest_path'].replace('\\\\','/') and \ | ||
| '/tests/' not in pkg['manifest_path'].replace('\\\\','/'): | ||
| print(pkg['name']) | ||
| " | while read pkg_name; do | ||
| echo "Building $pkg_name..." | ||
| cargo build --release --target wasm32-unknown-unknown -p "$pkg_name" | ||
| done | ||
| mkdir -p ../../wasm-hashes | ||
| echo "# Reproducible WASM Hashes" > ../../wasm-hashes/wasm-hashes.txt | ||
| echo "Generated on: $(date -u)" >> ../../wasm-hashes/wasm-hashes.txt | ||
| echo "" >> ../../wasm-hashes/wasm-hashes.txt | ||
| for wasm in target/wasm32-unknown-unknown/release/*.wasm; do | ||
| if [ -f "$wasm" ]; then | ||
| hash=$(sha256sum "$wasm" | awk '{print $1}') | ||
| name=$(basename "$wasm") | ||
| echo "$hash $name" >> ../../wasm-hashes/wasm-hashes.txt | ||
| fi | ||
| done | ||
| cat ../../wasm-hashes/wasm-hashes.txt | ||
| - name: Upload WASM Hashes Artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: contract-wasm-hashes | ||
| path: wasm-hashes/wasm-hashes.txt | ||
| - name: Upload audit reports | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: contract-audit-reports | ||
| path: audit-report-*.json | ||
| if-no-files-found: ignore | ||
