Merge pull request #1162 from Mirabel64/fix/issue-1079-audit-gate #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Contracts | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "contracts/**" | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "contracts/**" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: contracts-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-contracts: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| defaults: | |
| run: | |
| working-directory: contracts | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: contracts | |
| - name: Build contracts | |
| run: cargo build --target wasm32-unknown-unknown --release | |
| - name: Check snapshot layout (no flat snapshots outside test/ subdir) | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| # Snapshots must live under {contract}/test_snapshots/test/ | |
| # Flat JSON files directly in test_snapshots/ indicate a misconfigured Env path | |
| flat=$(find contracts -maxdepth 2 -name "test_snapshots" -type d \ | |
| | xargs -I{} find {} -maxdepth 1 -name "*.json" 2>/dev/null || true) | |
| if [ -n "$flat" ]; then | |
| echo "ERROR: snapshot files found directly in test_snapshots/ (missing test/ subdir):" | |
| echo "$flat" | |
| exit 1 | |
| fi | |
| echo "Snapshot layout OK" | |
| - name: Run contract tests | |
| run: cargo test | |
| - name: Run contract fuzz tests | |
| run: cargo test -p subscription_renewal -p escrow -p payment-channel -p virtual-card fuzz_ | |
| env: | |
| PROPTEST_CASES: "8" | |
| - name: Verify backend contract interface alignment | |
| working-directory: .. | |
| run: | | |
| npm ci --legacy-peer-deps --ignore-scripts --workspace=@syncro/backend --workspace=@syncro/shared 2>/dev/null || npm install --legacy-peer-deps --ignore-scripts --workspace=@syncro/backend --workspace=@syncro/shared | |
| npm test -w @syncro/backend -- tests/integration/contract-interface-drift.test.ts | |
| - name: Check contract sizes | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| wasm_files=(target/wasm32-unknown-unknown/release/*.wasm) | |
| if [ ${#wasm_files[@]} -eq 0 ]; then | |
| echo "No WASM artifacts found in target/wasm32-unknown-unknown/release" | |
| exit 1 | |
| fi | |
| for wasm in "${wasm_files[@]}"; do | |
| size=$(wc -c < "$wasm") | |
| echo "$wasm: ${size} bytes" | |
| if [ "$size" -gt 65536 ]; then | |
| echo "WARNING: Contract exceeds 64KB limit" | |
| fi | |
| done |