1
+ name : Branch
2
+
3
+ on :
4
+ pull_request :
5
+ branches :
6
+ - main
7
+ push :
8
+ branches :
9
+ - main
10
+ tags :
11
+ - " v*"
12
+
13
+ concurrency :
14
+ group : ${{ github.workflow }}-${{ github.ref }}
15
+ cancel-in-progress : true
16
+
17
+ permissions :
18
+ actions : write
19
+ checks : write
20
+ contents : write
21
+ deployments : write
22
+ id-token : write
23
+ issues : write
24
+ discussions : write
25
+ packages : write
26
+ pages : write
27
+ pull-requests : write
28
+ repository-projects : write
29
+ security-events : write
30
+ statuses : write
31
+
32
+ jobs :
33
+ codescanning :
34
+ name : Code Scanning
35
+ # runs-on: ubuntu-latest
36
+ runs-on : namespace-profile-btp-scs
37
+ container :
38
+ image : returntocorp/semgrep
39
+ steps :
40
+ - name : Checkout
41
+ uses : actions/checkout@v4
42
+ with :
43
+ submodules : recursive
44
+
45
+ - name : Install canvas dependencies
46
+ run : |
47
+ apk update
48
+ apk add --no-cache cairo-dev jpeg-dev pango-dev giflib-dev build-base g++ pkgconfig
49
+
50
+
51
+ id : slither
52
+ with :
53
+ sarif : slither.sarif
54
+ slither-args : --filter-paths "lib/" --filter-paths "node_modules/"
55
+ solc-version : 0.8.24
56
+ fail-on : none
57
+
58
+ - name : Upload findings to GitHub Advanced Security Dashboard
59
+ uses : github/codeql-action/upload-sarif@v3
60
+ with :
61
+ sarif_file : ${{ steps.slither.outputs.sarif }}
62
+ if : always()
63
+
64
+ test :
65
+ services :
66
+ foundry :
67
+ image : ghcr.io/settlemint/btp-anvil-test-node:latest
68
+ ports :
69
+ - ' 8545:8545'
70
+ name : Test
71
+ # runs-on: ubuntu-latest
72
+ runs-on : namespace-profile-btp-scs
73
+ steps :
74
+ - name : Checkout
75
+ uses : actions/checkout@v4
76
+ with :
77
+ submodules : recursive
78
+
79
+ - name : Install Foundry
80
+ uses : foundry-rs/foundry-toolchain@v1
81
+ with :
82
+ version : nightly
83
+
84
+ - uses : actions/setup-node@v4
85
+ with :
86
+ node-version : 20
87
+
88
+ - name : Install Node dependencies
89
+ run : npm install
90
+
91
+ - name : Run Forge build
92
+ run : |
93
+ forge --version
94
+ forge build --sizes
95
+
96
+ - name : Run Hardhat build
97
+ run : |
98
+ npx hardhat compile
99
+
100
+ - name : Run Forge tests
101
+ run : |
102
+ forge test -vvv
103
+
104
+ - name : Run Hardhat test
105
+ run : |
106
+ npx hardhat test
107
+
108
+ - name : Setup LCOV
109
+ if : github.ref_name != 'main'
110
+ uses : hrishikesh-kadam/setup-lcov@v1
111
+
112
+ - name : Run Forge Coverage
113
+ if : github.ref_name != 'main'
114
+ run : |
115
+ forge coverage --report lcov --report summary
116
+ id : coverage
117
+
118
+ - name : Deploy to the local node
119
+ run : |
120
+ npx hardhat ignition deploy --network localhost ignition/modules/main.ts
121
+
122
+ - name : Install YQ
123
+ uses : alexellis/arkade-get@master
124
+ with :
125
+ print-summary : false
126
+ yq : latest
127
+
128
+ - name : Build the subgraph
129
+ run : |
130
+ if [ ! -d "subgraph" ] || [ -z "$(ls -A subgraph)" ]; then
131
+ echo "Subgraph directory is missing or empty"
132
+ exit 0
133
+ fi
134
+ npx graph-compiler --config subgraph/subgraph.config.json --include node_modules/@openzeppelin/subgraphs/src/datasources subgraph/datasources --export-schema --export-subgraph
135
+ yq -i e '.specVersion = "1.2.0"' generated/scs.subgraph.yaml
136
+ yq -i e '.features = ["nonFatalErrors", "fullTextSearch", "ipfsOnEthereumContracts"]' generated/scs.subgraph.yaml
137
+ yq -i e '.dataSources[].mapping.apiVersion = "0.0.7"' generated/scs.subgraph.yaml
138
+ yq -i e '.dataSources[].network = "localhost"' generated/scs.subgraph.yaml
139
+ yq -i e '.templates[].mapping.apiVersion = "0.0.7"' generated/scs.subgraph.yaml
140
+ yq -i e '.templates[].network = "localhost"' generated/scs.subgraph.yaml
141
+ npx graph codegen generated/scs.subgraph.yaml
142
+ npx graph build generated/scs.subgraph.yaml
143
+
144
+ - name : Report code coverage
145
+ if : github.ref_name != 'main'
146
+
147
+ with :
148
+ coverage-files : lcov.info
149
+ minimum-coverage : 90
150
+ github-token : ${{ secrets.GITHUB_TOKEN }}
151
+ update-comment : true
152
+
153
+ docker :
154
+ needs :
155
+ - test
156
+ name : Docker
157
+ # runs-on: ubuntu-latest
158
+ runs-on : namespace-profile-btp-scs
159
+ steps :
160
+ - name : Checkout
161
+ uses : actions/checkout@v4
162
+ with :
163
+ submodules : recursive
164
+
165
+ - name : Set up QEMU
166
+ uses : docker/setup-qemu-action@v3
167
+
168
+ - name : Set up Docker Buildx
169
+ uses : docker/setup-buildx-action@v3
170
+
171
+ - name : Install Cosign
172
+ uses : sigstore/cosign-installer@v3
173
+
174
+ - name : Login to GitHub Container Registry
175
+ uses : docker/login-action@v3
176
+ with :
177
+ registry : ghcr.io
178
+ username : ${{ github.repository_owner }}
179
+ password : ${{ secrets.GITHUB_TOKEN }}
180
+
181
+ - name : Docker meta
182
+ id : docker_meta
183
+ uses : docker/metadata-action@v5
184
+ with :
185
+ images : |
186
+ ghcr.io/${{ github.repository }}
187
+ tags : |
188
+ type=schedule
189
+ type=ref,event=branch
190
+ type=ref,event=pr
191
+ type=semver,pattern={{version}}
192
+ type=semver,pattern={{major}}.{{minor}}
193
+ type=semver,pattern={{major}}
194
+ type=sha
195
+
196
+ - name : Build and push
197
+ uses : docker/build-push-action@v6
198
+ id : build-and-push
199
+ with :
200
+ platforms : linux/amd64,linux/arm64
201
+ provenance : true
202
+ sbom : true
203
+ push : true
204
+ load : false
205
+ tags : ${{ steps.docker_meta.outputs.tags }}
206
+ labels : ${{ steps.docker_meta.outputs.labels }}
207
+ no-cache : true
208
+
209
+
210
+ - name : Sign the images with GitHub OIDC Token
211
+ env :
212
+ DIGEST : ${{ steps.build-and-push.outputs.digest }}
213
+ TAGS : ${{ steps.docker_meta.outputs.tags }}
214
+ run : |
215
+ images=""
216
+ for tag in ${TAGS}; do
217
+ images+="${tag}@${DIGEST} "
218
+ done
219
+ cosign sign --yes ${images}
0 commit comments