fix: resolve js-yaml CVE-2026-59870 via pnpm overrides #476
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Run tests (regenerate snapshots if needed) | |
| run: SOROBAN_TEST_SNAPSHOT_FILE_UPDATE=true cargo test --workspace | |
| - name: Run clippy | |
| run: cargo clippy --workspace -- -D warnings | |
| fuzz: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust nightly | |
| uses: dtolnay/rust-toolchain@nightly | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-fuzz-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Install cargo-fuzz | |
| run: cargo install cargo-fuzz | |
| - name: Run fuzz tests | |
| run: cargo +nightly fuzz run compute_score_pure -- -runs=10000 | |
| working-directory: contracts/credit-oracle | |
| ts-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Install SDK dependencies | |
| run: pnpm install --frozen-lockfile | |
| working-directory: packages/sdk | |
| - name: Run TypeScript SDK tests | |
| run: pnpm test -- --coverage | |
| working-directory: packages/sdk | |
| docs: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-docs-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Generate Rust API docs | |
| run: cargo doc --workspace --no-deps | |
| env: | |
| RUSTDOCFLAGS: "-D warnings" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Install SDK dependencies | |
| run: pnpm install --frozen-lockfile | |
| working-directory: packages/sdk | |
| - name: Generate TypeScript API docs | |
| run: pnpm run docs | |
| working-directory: packages/sdk | |
| license-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install cargo-deny | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check licenses | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Check Node.js licenses | |
| run: pnpm run license-check | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check Rust advisories | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check advisories | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Check Node.js dependencies for vulnerabilities | |
| run: pnpm audit --audit-level=high | |
| check-wasm-sizes: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-wasm-${{ hashFiles('**/Cargo.lock') }} | |
| - name: Build contracts (release) | |
| run: cargo build --target wasm32-unknown-unknown --release --workspace | |
| - name: Check WASM binary sizes | |
| run: | | |
| # Stellar's default WASM deployment limit is 512 KB (524,288 bytes). | |
| # This check ensures all contract binaries stay under that threshold. | |
| MAX_SIZE=$((512 * 1024)) | |
| FAILED=0 | |
| echo "Checking WASM binary sizes (max: $MAX_SIZE bytes / 512 KB)..." | |
| echo "" | |
| for wasm in target/wasm32-unknown-unknown/release/*.wasm; do | |
| [ -f "$wasm" ] || continue | |
| SIZE=$(stat -c%s "$wasm") | |
| NAME=$(basename "$wasm") | |
| if [ "$SIZE" -gt "$MAX_SIZE" ]; then | |
| printf "FAIL: %-30s %d bytes (%.1f KB)\n" "$NAME" "$SIZE" "$(echo "scale=1; $SIZE / 1024" | bc)" | |
| FAILED=1 | |
| else | |
| printf "PASS: %-30s %d bytes (%.1f KB)\n" "$NAME" "$SIZE" "$(echo "scale=1; $SIZE / 1024" | bc)" | |
| fi | |
| done | |
| echo "" | |
| if [ "$FAILED" -eq 1 ]; then | |
| echo "ERROR: One or more contracts exceed the 512 KB WASM deployment limit." | |
| echo "See: https://developers.stellar.org/docs/soroban/deployment" | |
| exit 1 | |
| fi | |
| echo "All contracts are within the size limit." |