ci: add slither static analysis #211
Conversation
fbac
requested review from
andresaiello,
brewmaster012,
lumtis,
CharlieMc0,
fadeev and
skosito
as code owners
WalkthroughThe recent update introduces a new GitHub Actions workflow for smart contract analysis using Slither, and modifies an existing workflow name to more accurately reflect its purpose. The new Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Files selected for processing (3)
- .github/workflows/coverage.yaml (1 hunks)
- .github/workflows/slither.yaml (1 hunks)
- slither.config.json (1 hunks)
Files skipped from review due to trivial changes (2)
- .github/workflows/coverage.yaml
- slither.config.json
Additional comments not posted (5)
.github/workflows/slither.yaml (5)
1-15: LGTM! Workflow name and triggers are appropriate.The workflow is correctly named "Slither" and is triggered on push to the main branch and specific pull request events.
16-22: LGTM! Job configuration is appropriate.The job runs on
ubuntu-latestand has the necessary permissions to read contents and write security events.
23-31: LGTM! Steps for checking out the repository and setting up Node.js are appropriate.The steps use
actions/checkout@v3to check out the repository andactions/setup-node@v2to set up Node.js version 18.
32-37: LGTM! Steps for installing dependencies and compiling contracts are appropriate.The steps install dependencies using
yarn installand compile contracts usingyarn compile.
38-50: LGTM! Steps for running Slither and uploading SARIF files are appropriate.The steps run Slither using
crytic/slither-action@mainand upload SARIF files usinggithub/codeql-action/upload-sarif@v3. Thecontinue-on-error: trueensures that the workflow continues even if Slither finds issues, which is useful for reporting.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #211 +/- ##
=======================================
Coverage 59.25% 59.25%
=======================================
Files 31 31
Lines 1048 1048
Branches 217 217
=======================================
Hits 621 621
Misses 427 427 ☔ View full report in Codecov by Sentry. |
slither .in the root of the repository, it will use the provided slither.config.json.Summary by CodeRabbit
New Features
slither.config.jsonfor configuring project-specific analysis settings.Chores