diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index d149151c..ded98c44 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -22,7 +22,6 @@ jobs: - name: Install dependencies run: yarn - - name: Build run: yarn build diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b9c4fd7f..3b374053 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -5,6 +5,7 @@ on: pull_request: branches: [main, develop] workflow_dispatch: + jobs: lint: name: Lint @@ -31,14 +32,16 @@ jobs: env: NODE_OPTIONS: --max-old-space-size=4096 steps: - - uses: actions/checkout@v2 + - name: Check out code + uses: actions/checkout@v2 - - uses: actions/setup-node@v2 + - name: Setup Node.js environment + uses: actions/setup-node@v2 with: node-version: 18 cache: "yarn" - - name: Install deps + - name: Install dependencies run: yarn - name: Run hardhat compile and tests coverage @@ -66,6 +69,48 @@ jobs: recreate: true path: code-coverage-results.md + slither-analysis: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + + steps: + - name: 📥 Check out code + uses: actions/checkout@v4 + + - name: 🛠️ Set up Node.js environment + uses: actions/setup-node@v4 + with: + node-version: 18 + cache: "yarn" + + - name: 📦 Install dependencies + run: | + yarn install + + - name: 🏗️ Build project + run: | + yarn build + + - name: 🐍 Set up Python environment + run: | + python3 -m venv .venv + source .venv/bin/activate + pip install slither-analyzer + + - name: Set up Solidity Compiler Version + run: | + source .venv/bin/activate + solc-select install 0.8.25 + solc-select use 0.8.25 + + - name: 🔍 Run Solidity Static Analysis + run: | + source .venv/bin/activate + chmod +x analyze.sh + bash analyze.sh + deploy: name: Deploy runs-on: ubuntu-22.04 @@ -89,10 +134,10 @@ jobs: run: yarn hardhat deploy export-deployments: + name: Export Deployments runs-on: ubuntu-latest permissions: contents: write - steps: - name: Check out code uses: actions/checkout@v2 diff --git a/analyze.sh b/analyze.sh new file mode 100644 index 00000000..baab00e6 --- /dev/null +++ b/analyze.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +# Function to extract Solidity version from a contract file +get_solidity_version() { + grep -Eo "pragma solidity \^?[0-9]+\.[0-9]+\.[0-9]+" "$1" | awk '{print $3}' | head -n 1 | tr -d '^' +} + +# Check if Slither and solc-select are installed +if ! command -v slither &> /dev/null; then + echo "❌ Error: Slither is not installed. Install it with: pip install slither-analyzer" + exit 1 +fi + +if ! command -v solc-select &> /dev/null; then + echo "❌ Error: solc-select is not installed. Install it from: https://github.com/crytic/solc-select" + exit 1 +fi + +# Set the contract directory (modify this path if needed) +CONTRACT_DIR="./contracts" + +# Check if contract directory exists +if [ ! -d "$CONTRACT_DIR" ]; then + echo "❌ Error: Contract directory '$CONTRACT_DIR' not found!" + exit 1 +fi + +echo "🔍 Searching for Solidity files in '$CONTRACT_DIR'..." + +# Create a list to track installed versions +installed_versions=() + +# Find and process each Solidity file +find "$CONTRACT_DIR" -type f -name "*.sol" | while read -r contract; do + sol_version=$(get_solidity_version "$contract") + + if [ -z "$sol_version" ]; then + echo "⚠️ Warning: Could not detect Solidity version in $contract" + continue + fi + + echo "🔹 Detected Solidity version: $sol_version for contract: $contract" + + # Remove `^` from version if present + sol_version_cleaned=$(echo "$sol_version" | tr -d '^') + + # Check if version is already installed + if [[ ! " ${installed_versions[@]} " =~ " $sol_version_cleaned " ]]; then + echo "📥 Installing Solidity compiler version $sol_version_cleaned..." + solc-select install "$sol_version_cleaned" + installed_versions+=("$sol_version_cleaned") + fi + + echo "🔄 Switching to Solidity $sol_version_cleaned..." + solc-select use "$sol_version_cleaned" + + # Run Slither analysis + echo "🔍 Running Slither on $contract..." + slither "$contract" --solc-remaps "@openzeppelin=node_modules/@openzeppelin @venusprotocol=node_modules/@venusprotocol" + + echo "✅ Analysis complete for $contract" +done + +echo "🎉 Static analysis completed for all Solidity files!" + + +