1+ # .github/workflows/sc-sec-080-gas-audit.yml
2+ #
3+ # SC-SEC-080 — Smart Contract Gas Audit CI
4+ # Runs on every push to main and on PRs that touch the contracts/ directory.
5+
6+ name : SC-SEC-080 Gas Audit
7+
8+ on :
9+ push :
10+ branches : [main]
11+ paths :
12+ - " contracts/**"
13+ - " .github/workflows/sc-sec-080-gas-audit.yml"
14+ pull_request :
15+ paths :
16+ - " contracts/**"
17+
18+ env :
19+ CARGO_TERM_COLOR : always
20+ RUST_BACKTRACE : 1
21+
22+ jobs :
23+ # --------------------------------------------------------------------------
24+ # Job 1: Unit tests (including reentrancy + migration tests)
25+ # --------------------------------------------------------------------------
26+ unit-tests :
27+ name : Unit Tests (escrow, reputation, job_registry)
28+ runs-on : ubuntu-latest
29+ steps :
30+ - uses : actions/checkout@v4
31+
32+ - name : Install Rust stable + wasm32 target
33+ uses : dtolnay/rust-toolchain@stable
34+ with :
35+ targets : wasm32-unknown-unknown
36+ components : clippy
37+
38+ - name : Cache Cargo registry
39+ uses : actions/cache@v4
40+ with :
41+ path : |
42+ ~/.cargo/registry
43+ ~/.cargo/git
44+ target/
45+ key : ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
46+
47+ - name : Run escrow unit tests (with testutils)
48+ run : |
49+ cargo test \
50+ --features testutils \
51+ -p escrow \
52+ -- --nocapture
53+
54+ name : Reentrancy tests must all pass
55+ run : |
56+ cargo test \
57+ --features testutils \
58+ -p escrow \
59+ test_reentrancy \
60+ -- --nocapture
61+
62+ name : Migration tests must all pass
63+ run : |
64+ cargo test \
65+ --features testutils \
66+ -p escrow \
67+ test_migration \
68+ -- --nocapture
69+
70+ # --------------------------------------------------------------------------
71+ # Job 2: Gas benchmark tests
72+ # --------------------------------------------------------------------------
73+ gas-benchmarks :
74+ name : Gas Benchmarks (≥15% reduction verified)
75+ runs-on : ubuntu-latest
76+ steps :
77+ - uses : actions/checkout@v4
78+
79+ - name : Install Rust stable
80+ uses : dtolnay/rust-toolchain@stable
81+ with :
82+ targets : wasm32-unknown-unknown
83+
84+ - name : Cache Cargo registry
85+ uses : actions/cache@v4
86+ with :
87+ path : |
88+ ~/.cargo/registry
89+ ~/.cargo/git
90+ target/
91+ key : ${{ runner.os }}-cargo-bench-${{ hashFiles('**/Cargo.lock') }}
92+
93+ - name : Run gas benchmark tests
94+ run : |
95+ cargo test \
96+ --features testutils \
97+ --test gas_benchmarks \
98+ -p escrow \
99+ -- --nocapture
100+
101+ # --------------------------------------------------------------------------
102+ # Job 3: WASM size verification (must be <40 KB)
103+ # --------------------------------------------------------------------------
104+ wasm-size-check :
105+ name : WASM Size Check (<40 KB)
106+ runs-on : ubuntu-latest
107+ steps :
108+ - uses : actions/checkout@v4
109+
110+ - name : Install Rust stable + wasm32 target
111+ uses : dtolnay/rust-toolchain@stable
112+ with :
113+ targets : wasm32-unknown-unknown
114+
115+ - name : Cache Cargo registry
116+ uses : actions/cache@v4
117+ with :
118+ path : |
119+ ~/.cargo/registry
120+ ~/.cargo/git
121+ target/
122+ key : ${{ runner.os }}-cargo-wasm-${{ hashFiles('**/Cargo.lock') }}
123+
124+ - name : Build contracts with release-wasm profile
125+ run : |
126+ cargo build \
127+ --profile release-wasm \
128+ --target wasm32-unknown-unknown \
129+ -p escrow
130+
131+ name : Verify WASM sizes are under 40 KB
132+ run : |
133+ chmod +x scripts/verify_wasm_size.sh
134+ ./scripts/verify_wasm_size.sh
135+
136+ name : Upload WASM artifacts
137+ uses : actions/upload-artifact@v4
138+ with :
139+ name : wasm-contracts
140+ path : target/wasm32-unknown-unknown/release-wasm/*.wasm
141+ retention-days : 14
142+
143+ # --------------------------------------------------------------------------
144+ # Job 4: Clippy lint (catches unsafe patterns and dead code)
145+ # --------------------------------------------------------------------------
146+ clippy :
147+ name : Clippy Lint
148+ runs-on : ubuntu-latest
149+ steps :
150+ - uses : actions/checkout@v4
151+
152+ - name : Install Rust stable + clippy
153+ uses : dtolnay/rust-toolchain@stable
154+ with :
155+ components : clippy
156+
157+ - name : Run clippy on contracts
158+ run : |
159+ cargo clippy \
160+ -p escrow \
161+ --features testutils \
162+ -- -D warnings
0 commit comments