chore(deps): bump github/codeql-action from 4.37.4 to 4.37.7 #296
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Contracts | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| contracts: ${{ steps.filter.outputs.contracts }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| contracts: | |
| - 'contracts/**' | |
| test: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.contracts == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| # wasm32-unknown-unknown is rejected by soroban-sdk's build script on | |
| # Rust 1.82+ (reference-types/multi-value are on by default there and | |
| # unsupported by the Soroban environment) - wasm32v1-none is the | |
| # supported target. | |
| targets: wasm32v1-none | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: contracts | |
| - name: cargo test | |
| working-directory: contracts | |
| run: cargo test | |
| - name: cargo build (release, wasm32v1-none) | |
| working-directory: contracts | |
| run: cargo build --release --target wasm32v1-none | |
| verify-provenance: | |
| needs: test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32v1-none | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: contracts | |
| - uses: cargo-bins/cargo-binstall@main | |
| - name: Install stellar-cli | |
| run: cargo binstall -y stellar-cli@25.2.0 | |
| - name: cargo build (release, wasm32v1-none) | |
| working-directory: contracts | |
| run: cargo build --release --target wasm32v1-none | |
| - name: Verify deployed provenance | |
| working-directory: contracts | |
| run: | | |
| set -euo pipefail | |
| if [ ! -f deployed.testnet.json ]; then | |
| echo "No deployed.testnet.json found. Skipping provenance verification." | |
| exit 0 | |
| fi | |
| # The checked-in manifest documents the shape before the contracts are | |
| # actually deployed; deploy_testnet.sh fills in the ids and hashes. | |
| # Until then there is nothing to verify, so skip rather than diff | |
| # empty hashes against a real build. | |
| if jq -e '[.contracts[] | select((.contractId | startswith("<")) or (.wasmHash == ""))] | length > 0' \ | |
| deployed.testnet.json > /dev/null; then | |
| echo "deployed.testnet.json still holds deploy_testnet.sh placeholders. Skipping provenance verification." | |
| exit 0 | |
| fi | |
| REGISTRY_WASM="target/wasm32v1-none/release/orbital_abi_registry.wasm" | |
| DEMO_WASM="target/wasm32v1-none/release/orbital_demo_emitter.wasm" | |
| REGISTRY_ID=$(jq -r '.contracts.registry.contractId' deployed.testnet.json) | |
| EXPECTED_HASH=$(jq -r '.contracts.registry.wasmHash' deployed.testnet.json) | |
| DEMO_ID=$(jq -r '.contracts.demoEmitter.contractId' deployed.testnet.json) | |
| EXPECTED_DEMO_HASH=$(jq -r '.contracts.demoEmitter.wasmHash' deployed.testnet.json) | |
| ACTUAL_HASH=$(sha256sum "$REGISTRY_WASM" | awk '{print $1}') | |
| ACTUAL_DEMO_HASH=$(sha256sum "$DEMO_WASM" | awk '{print $1}') | |
| echo "registry: $EXPECTED_HASH" > expected_hashes.txt | |
| echo "demoEmitter: $EXPECTED_DEMO_HASH" >> expected_hashes.txt | |
| echo "registry: $ACTUAL_HASH" > actual_hashes.txt | |
| echo "demoEmitter: $ACTUAL_DEMO_HASH" >> actual_hashes.txt | |
| echo "==> Comparing local build against deployed.testnet.json..." | |
| if ! diff -u expected_hashes.txt actual_hashes.txt; then | |
| echo "::error::WASM hashes do not match deployed.testnet.json! Did you modify contracts without updating the deployment?" | |
| exit 1 | |
| fi | |
| echo "==> Fetching on-chain WASMs to verify they match..." | |
| stellar contract fetch --id "$REGISTRY_ID" --network testnet --out-file onchain_registry.wasm | |
| stellar contract fetch --id "$DEMO_ID" --network testnet --out-file onchain_demo.wasm | |
| ONCHAIN_HASH=$(sha256sum onchain_registry.wasm | awk '{print $1}') | |
| ONCHAIN_DEMO_HASH=$(sha256sum onchain_demo.wasm | awk '{print $1}') | |
| echo "registry: $ONCHAIN_HASH" > onchain_hashes.txt | |
| echo "demoEmitter: $ONCHAIN_DEMO_HASH" >> onchain_hashes.txt | |
| echo "==> Comparing local build against on-chain network..." | |
| if ! diff -u actual_hashes.txt onchain_hashes.txt; then | |
| echo "::error::On-chain WASM hashes do not match local build! The network state has drifted or was maliciously altered." | |
| exit 1 | |
| fi | |
| echo "Provenance verification passed! (All hashes match)" |