fix: schema stability, path normalization, CLI help tests, vulndb ref… #609
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| branches: ["main"] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| ci: | |
| name: Continuous Integration | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install stable Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Install WASM target | |
| run: rustup target add wasm32-unknown-unknown | |
| - name: Cache cargo registry & build artifacts | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - name: Install Z3 (Linux) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libz3-dev | |
| - name: Install Z3 (macOS) | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew install z3 llvm | |
| echo "Z3_SYS_Z3_HEADER=$(brew --prefix z3)/include/z3.h" >> $GITHUB_ENV | |
| echo "LIBRARY_PATH=$(brew --prefix z3)/lib:$LIBRARY_PATH" >> $GITHUB_ENV | |
| echo "CPATH=$(brew --prefix z3)/include:$CPATH" >> $GITHUB_ENV | |
| echo "LLVM_CONFIG_PATH=$(brew --prefix llvm)/bin/llvm-config" >> $GITHUB_ENV | |
| - name: Install Z3 (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $z3Version = "4.13.3" | |
| $url = "https://github.com/Z3Prover/z3/releases/download/z3-$z3Version/z3-$z3Version-x64-win.zip" | |
| Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\z3.zip" | |
| Expand-Archive "$env:TEMP\z3.zip" -DestinationPath "C:\z3" | |
| $z3Dir = (Get-ChildItem "C:\z3" -Directory | Select-Object -First 1).FullName | |
| echo "Z3_SYS_Z3_HEADER=$z3Dir\include\z3.h" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| echo "LIB=$z3Dir\bin;$env:LIB" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| echo "CPATH=$z3Dir\include;$env:CPATH" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| - name: Install system dependencies (Linux only) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Install dependencies and Lint (make lint smoke test) | |
| run: | | |
| npm ci | |
| make lint | |
| - name: Check formatting | |
| run: cargo fmt --all --check | |
| - name: Run Clippy (workspace) | |
| run: cargo clippy --workspace --all-targets --all-features -- -D warnings | |
| - name: Run Clippy (runtime guard wasm target) | |
| run: cargo clippy -p runtime-guard-wrapper --target wasm32-unknown-unknown -- -D warnings | |
| - name: Build All (Debug) | |
| run: | | |
| cargo build -p sanctifier-core --all-features | |
| cd tooling/sanctifier-cli && cargo build | |
| - name: Run All Tests | |
| run: | | |
| cargo test -p sanctifier-core --all-features | |
| cargo test -p sanctifier-cli | |
| - name: Run action unit tests | |
| run: | | |
| python -m unittest discover -s tests/action -p "test_*.py" | |
| python -m unittest discover -s tests/vulnerability_db -p "test_*.py" | |
| - name: Code coverage (Linux only) | |
| if: runner.os == 'Linux' | |
| run: | | |
| command -v cargo-tarpaulin >/dev/null || cargo install cargo-tarpaulin --locked --quiet | |
| cargo tarpaulin --workspace --out Xml --output-dir coverage/ | |
| - name: Upload coverage to Codecov (Linux only) | |
| if: runner.os == 'Linux' | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: coverage/cobertura.xml | |
| fail_ci_if_error: false | |
| slug: HyperSafeD/Sanctifier | |
| - name: Build Release CLI | |
| run: cd tooling/sanctifier-cli && cargo build --release | |
| frontend-test: | |
| name: Frontend Unit Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Build WASM stub | |
| run: | | |
| mkdir -p tooling/sanctifier-wasm/pkg | |
| echo '{"name":"@sanctifier/wasm","version":"0.0.0","main":"index.js"}' > tooling/sanctifier-wasm/pkg/package.json | |
| echo 'module.exports = {};' > tooling/sanctifier-wasm/pkg/index.js | |
| - name: Install frontend dependencies | |
| run: cd frontend && npm install | |
| - name: Run unit tests | |
| run: cd frontend && npm test | |
| - name: Generate coverage report | |
| run: cd frontend && npm run test:coverage | |
| continue-on-error: true | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: frontend-coverage | |
| path: frontend/coverage/ | |
| retention-days: 7 | |
| docs-specs-integration: | |
| name: Docs/specs integration coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Validate docs/specs coverage | |
| run: npm run docs:specs:check | |
| contracts-sep41-fixtures: | |
| name: Contracts SEP-41 Fixture Coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Install stable Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Build Sanctifier CLI | |
| run: cargo build -p sanctifier-cli | |
| - name: Run SEP-41 fixture contract tests | |
| run: cargo test -p my-contract | |
| - name: Validate S012 fixture output via CLI | |
| run: | | |
| cargo run --quiet --bin sanctifier -- analyze contracts/fixtures/finding-codes/s012_token_interface.rs --format json > /tmp/s012-report.json | |
| grep -q '"S012"' /tmp/s012-report.json | |
| frontend-e2e: | |
| name: Frontend E2E Tests (Playwright) | |
| if: false # disabled: cdn.playwright.dev download too slow on GH runners (~16 min for 170 MB) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Build WASM stub | |
| run: | | |
| mkdir -p tooling/sanctifier-wasm/pkg | |
| echo '{"name":"@sanctifier/wasm","version":"0.0.0","main":"index.js"}' > tooling/sanctifier-wasm/pkg/package.json | |
| echo 'module.exports = {};' > tooling/sanctifier-wasm/pkg/index.js | |
| - name: Install frontend dependencies | |
| run: cd frontend && npm install | |
| - name: Install Chromium runtime dependencies | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y --no-install-recommends \ | |
| libnspr4 libnss3 libatk1.0-0 libatk-bridge2.0-0 \ | |
| libcups2 libdrm2 libxkbcommon0 libxcomposite1 \ | |
| libxdamage1 libxfixes3 libxrandr2 libgbm1 \ | |
| libpango-1.0-0 libcairo2 \ | |
| libasound2t64 2>/dev/null || \ | |
| sudo apt-get install -y --no-install-recommends \ | |
| libnspr4 libnss3 libatk1.0-0 libatk-bridge2.0-0 \ | |
| libcups2 libdrm2 libxkbcommon0 libxcomposite1 \ | |
| libxdamage1 libxfixes3 libxrandr2 libgbm1 \ | |
| libpango-1.0-0 libcairo2 libasound2 | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@v5 | |
| id: playwright-cache | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-chromium-1.59.1 | |
| - name: Install Playwright chromium browser | |
| if: steps.playwright-cache.outputs.cache-hit != 'true' | |
| run: cd frontend && npx playwright install chromium | |
| - name: Run e2e tests | |
| run: cd frontend && npm run test:e2e | |
| - name: Upload Playwright artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: playwright-artifacts | |
| path: | | |
| frontend/playwright-report/ | |
| frontend/test-results/ | |
| retention-days: 7 | |
| frontend-schema-e2e: | |
| name: Frontend Schema Rendering E2E | |
| if: false # disabled: cdn.playwright.dev download too slow on GH runners (~16 min for 170 MB) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Build WASM stub | |
| run: | | |
| mkdir -p tooling/sanctifier-wasm/pkg | |
| echo '{"name":"@sanctifier/wasm","version":"0.0.0","main":"index.js"}' > tooling/sanctifier-wasm/pkg/package.json | |
| echo 'module.exports = {};' > tooling/sanctifier-wasm/pkg/index.js | |
| - name: Install frontend dependencies | |
| run: cd frontend && npm install | |
| - name: Install Chromium runtime dependencies | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y --no-install-recommends \ | |
| libnspr4 libnss3 libatk1.0-0 libatk-bridge2.0-0 \ | |
| libcups2 libdrm2 libxkbcommon0 libxcomposite1 \ | |
| libxdamage1 libxfixes3 libxrandr2 libgbm1 \ | |
| libpango-1.0-0 libcairo2 \ | |
| libasound2t64 2>/dev/null || \ | |
| sudo apt-get install -y --no-install-recommends \ | |
| libnspr4 libnss3 libatk1.0-0 libatk-bridge2.0-0 \ | |
| libcups2 libdrm2 libxkbcommon0 libxcomposite1 \ | |
| libxdamage1 libxfixes3 libxrandr2 libgbm1 \ | |
| libpango-1.0-0 libcairo2 libasound2 | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@v5 | |
| id: playwright-cache | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-chromium-1.59.1 | |
| - name: Install Playwright chromium browser | |
| if: steps.playwright-cache.outputs.cache-hit != 'true' | |
| run: cd frontend && npx playwright install chromium | |
| - name: Run schema rendering e2e suite | |
| run: cd frontend && npm run test:e2e:schema | |
| contract-docs: | |
| name: Contract ABI / Interface Docs | |
| runs-on: ubuntu-latest | |
| continue-on-error: true # non-blocking: cargo doc can fail on transient crates.io network errors | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Install stable Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry & build artifacts | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-contract-docs-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-contract-docs- | |
| - name: Generate contract docs and interface summary | |
| run: make contract-docs | |
| - name: Verify interface summary is up-to-date | |
| run: | | |
| # Run extraction-only check (rustdoc already generated above) | |
| SKIP_RUSTDOC=1 bash scripts/gen-contract-docs.sh --check | |
| - name: Run ABI surface stability tests (amm-pool) | |
| run: cargo test -p amm-pool --test integration_tests abi_ -- --nocapture | |
| - name: Upload rustdoc artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: contract-rustdoc | |
| path: target/doc/ | |
| retention-days: 14 | |
| - name: Upload interface JSON artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: contract-interfaces-json | |
| path: docs/generated/contract-interfaces.json | |
| retention-days: 14 | |
| commitlint: | |
| name: Lint Commit Messages | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Install commitlint | |
| run: | | |
| cd frontend | |
| npm install --save-dev @commitlint/cli @commitlint/config-conventional | |
| - name: Validate PR commits | |
| run: | | |
| cd frontend | |
| npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose | |
| wasm: | |
| name: Build WASM Package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Install stable Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: Cache cargo registry & build artifacts | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| tooling/sanctifier-wasm/target/ | |
| key: ${{ runner.os }}-wasm-${{ hashFiles('tooling/sanctifier-wasm/Cargo.lock', 'tooling/sanctifier-core/Cargo.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-wasm- | |
| - name: Install wasm-pack | |
| run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
| - name: Build WASM package | |
| run: | | |
| cd tooling/sanctifier-wasm | |
| wasm-pack build --target web --out-dir pkg --out-name sanctifier_wasm | |
| # Inject the npm package name expected by the frontend | |
| node -e " | |
| const fs = require('fs'); | |
| const pkg = JSON.parse(fs.readFileSync('pkg/package.json', 'utf8')); | |
| pkg.name = '@sanctifier/wasm'; | |
| fs.writeFileSync('pkg/package.json', JSON.stringify(pkg, null, 2)); | |
| " | |
| - name: Verify CSP Compliance | |
| run: | | |
| cd tooling/sanctifier-wasm | |
| node scripts/verify-csp-compliance.js | |
| - name: Upload WASM artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: sanctifier-wasm-pkg | |
| path: tooling/sanctifier-wasm/pkg/ | |
| retention-days: 7 |