Skip to content

Commit 42f6ff0

Browse files
Luisfc68Luisfc68
authored
Merge pull request #269 from rsksmart/master
Sync GH policy changes
2 parents 04f8919 + a22f69a commit 42f6ff0

File tree

11 files changed

+350
-13
lines changed

11 files changed

+350
-13
lines changed

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: 2
2+
updates:
3+
# Maintain dependencies for GitHub Actions
4+
- package-ecosystem: github-actions
5+
directory: /
6+
schedule:
7+
interval: daily
8+
9+
# Maintain dependencies for npm and yarn
10+
- package-ecosystem: npm
11+
directory: /
12+
schedule:
13+
interval: daily

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ on:
1212
# Allows you to run this workflow manually from the Actions tab
1313
workflow_dispatch:
1414

15+
permissions:
16+
contents: read
17+
1518
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
1619
jobs:
1720
# This workflow contains a single job called "build"
@@ -22,16 +25,16 @@ jobs:
2225
# Steps represent a sequence of tasks that will be executed as part of the job
2326
steps:
2427
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
25-
- uses: actions/checkout@v3
28+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
2629

2730
- name: Use Node.js 19.6.0
28-
uses: actions/setup-node@v3
31+
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
2932
with:
3033
node-version: '19.6.0'
3134

3235
- name: Install truffle
3336
run: npm install -g truffle
34-
37+
3538
- name: Install dependencies
3639
run: npm ci
3740
# - name: Lint source and tests
@@ -45,4 +48,4 @@ jobs:
4548
# with:
4649
# github-token: ${{ secrets.GITHUB_TOKEN }}
4750
# - name: Reproduce build
48-
# run: npm publish --dry-run
51+
# run: npm publish --dry-run

‎.github/workflows/dependency-review.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: 'Checkout Repository'
20+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
21+
- name: 'Dependency Review'
22+
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

‎.github/workflows/scorecard.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
branch_protection_rule:
4+
schedule:
5+
- cron: '0 0 * * 1'
6+
push:
7+
branches: [ "master" ]
8+
9+
permissions: read-all
10+
11+
jobs:
12+
analysis:
13+
name: Scorecard analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
id-token: write
18+
19+
steps:
20+
- name: "Checkout code"
21+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
22+
with:
23+
persist-credentials: false
24+
25+
- name: "Run analysis"
26+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: "Upload artifact"
33+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
34+
with:
35+
name: SARIF file
36+
path: results.sarif
37+
retention-days: 5
38+
39+
- name: "Upload to code-scanning"
40+
uses: github/codeql-action/upload-sarif@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9
41+
with:
42+
sarif_file: results.sarif

‎.github/workflows/slither.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,34 @@
11
name: Slither Analysis
22
on: [push]
3+
4+
permissions:
5+
contents: read
6+
37
jobs:
48
analyze:
59
runs-on: ubuntu-latest
610
permissions:
711
security-events: write
812
steps:
9-
- uses: actions/checkout@v3
13+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
1014

1115
- name: Use Node.js 19.6.0
12-
uses: actions/setup-node@v3
16+
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
1317
with:
1418
node-version: '19.6.0'
1519

1620
- name: Install dependencies
1721
run: npm ci
1822

1923
- name: Run Slither
20-
uses: crytic/slither-action@v0.3.0
24+
uses: crytic/slither-action@6ef3a33e56de4e8f59488cf60858b5c1bf4967c0 # v0.3.0
2125
id: slither
2226
with:
2327
sarif: results.sarif
2428
fail-on: none
2529
target: .
2630

2731
- name: Upload SARIF file
28-
uses: github/codeql-action/upload-sarif@v2
32+
uses: github/codeql-action/upload-sarif@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9
2933
with:
3034
sarif_file: ${{ steps.slither.outputs.sarif }}

‎.pre-commit-config.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
repos:
2+
- repo: https://github.com/gitleaks/gitleaks
3+
rev: v8.16.3
4+
hooks:
5+
- id: gitleaks
6+
- repo: https://github.com/jumanjihouse/pre-commit-hooks
7+
rev: 3.0.0
8+
hooks:
9+
- id: shellcheck
10+
- repo: https://github.com/pre-commit/pre-commit-hooks
11+
rev: v4.4.0
12+
hooks:
13+
- id: "trailing-whitespace"
14+
- id: "end-of-file-fixer"
15+
exclude: '\.tf\.json$'
16+
- id: "check-yaml"
17+
args:
18+
- "--unsafe"
19+
- id: "check-executables-have-shebangs"
20+
- id: "check-case-conflict"
21+
# Project specific
22+
- repo: local
23+
hooks:
24+
- id: code-style
25+
name: Project Style Check
26+
entry: npm run lint
27+
language: system
28+
types: [solidity]
29+
- repo: local
30+
hooks:
31+
- id: unit-tests
32+
name: Project Unit Tests
33+
entry: npm run test
34+
language: system
35+
types: [solidity, javascript]

‎CONTRIBUTING.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Contributing
2+
## How to contribute to RSK
3+
4+
These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
5+
6+
### Code Reviews
7+
8+
Continued code reviews and audits are required for security. As such, we encourage interested security researchers to:
9+
10+
* Review our code, even if no contributions are planned.
11+
* Publish their findings whichever way they choose, even if no particular bug or vulnerability was found. We can all learn from new sets of eyes and benefit from increased scrutiny.
12+
13+
### Code contributions
14+
15+
A code contribution process starts with someone identifying a need for writing code. If you're thinking about making your first contribution, we suggest you take a moment to get in touch and see how your idea fits in the development plan:
16+
17+
* Is it a bug in our [issue tracker](https://github.com/rsksmart/liquidity-bridge-contract/issues)?
18+
* Is it a novel idea that should be proposed and discussed first?
19+
20+
#### Review process
21+
22+
Once you know what to do, it is important that you provide a full description of the proposed changes. You can also send a draft pull request if you already have code to show.
23+
24+
We make use of GitHub Checks to ensure all changes meet a certain criteria:
25+
26+
1. The `master` branch is protected and only changeable through pull requests
27+
2. All unit tests must pass
28+
3. A project maintainer must approve the pull request
29+
4. An authorized merger must merge the pull request
30+
31+
Since this is a security-sensitive project, we encourage everyone to be proactive and participate in the review process. To help collaboration we propose adhering to these conventions:
32+
33+
* **Request changes** only for correctness and security issues.
34+
* **Comment** when leaving feedback without explicit approval or rejection. This is useful for design and implementation discussions.
35+
* **Approve** when changes look good from a correctness, security, design and implementation standpoint.
36+
37+
All unit and integration tests pass without loss of coverage (e.g can't remove tests without writing equivalent or better ones).
38+
39+
All code paths on new code must be unit tested, including sensible edge cases and expected errors. Exceptions to this rule must be justified (i.e. highly similar paths already tested) in written form in the PR description.
40+
41+
In order to ease review, it is expected that the code diff is maintained to a minimum. This includes things like not changing unrelated files, not changing names or reordering code when there isn't an evident benefit.
42+
43+
When automatic code quality and security checks are ready in the pipeline for external PRs, then the PR must pass all PR validations including code coverage (Sonar), code smells (Sonar), Security advisories (Sonar, LGTM).
44+
45+
## Style guidelines
46+
47+
### Pull request etiquette
48+
49+
* Separate your changes into multiple commits
50+
* If your pull request gets too big, try to split it
51+
* Each commit should at least compile, and ideally pass all unit tests
52+
* Avoid merge commits, and always rebase your changes on top of `master`

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 RootstockLabs
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

readme.MD renamed to README.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# Liquidity Bridge Contract
2+
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/rsksmart/liquidity-bridge-contract/badge)](https://scorecard.dev/viewer/?uri=github.com/rsksmart/liquidity-bridge-contract)
23

34
The Liquidity Bridge Contract (LBC) manages the interaction between users and liquidity providers (LP) in order to achieve fast peg-ins and peg-outs.
45

@@ -31,7 +32,7 @@ PegIn Quotes consist of:
3132
address lbcAddress; // the address of the LBC
3233
address liquidityProviderRskAddress; // the RSK address of the LP
3334
bytes btcRefundAddress; // a user BTC refund address
34-
address rskRefundAddress; // a user RSK refund address
35+
address rskRefundAddress; // a user RSK refund address
3536
bytes liquidityProviderBtcAddress; // the BTC address of the LP
3637
uint callFee; // the fee charged by the LP
3738
uint penaltyFee; // the penalty that the LP pays if it fails to deliver the service
@@ -55,7 +56,7 @@ PegOut Quotes consist of:
5556
address lbcAddress; // the address of the LBC
5657
address lpRskAddress; // the RSK address of the LP
5758
bytes btcRefundAddress; // a user BTC refund address
58-
address rskRefundAddress; // a user RSK refund address
59+
address rskRefundAddress; // a user RSK refund address
5960
bytes lpBtcAddress; // the BTC address of the LP
6061
uint callFee; // the fee charged by the LP
6162
uint penaltyFee; // the penalty that the LP pays if it fails to deliver the service
@@ -82,7 +83,7 @@ PegOut Quotes consist of:
8283
) returns bool success
8384

8485
This method performs a call on behalf of a user.
85-
#### Parameters
86+
#### Parameters
8687
* quote: The quote that identifies the service
8788
#### Return value
8889
Boolean indicating whether the call was successful
@@ -104,7 +105,7 @@ This method requests the Bridge contract on RSK a refund for the service.
104105
* btcRawTransaction The peg-in transaction
105106
* partialMerkleTree The merkle tree path that proves transaction inclusion
106107
* height The block that contains the peg-in transaction
107-
#### Return value
108+
#### Return value
108109
This method returns the amount transferred to the contract or an [error code](https://github.com/rsksmart/RSKIPs/blob/fast-bridge-alternative/IPs/RSKIP176.md#error-codes).
109110

110111
### **isOperational**

0 commit comments

Comments
 (0)