Configure slither and add to CI #1109
Conversation
- Disable external and test contracts - Disable some noisy detectors
- Initialize local variables. - Don't import hardhat console. - Make enum if statements exhaustive.
| @@ -20,7 +20,7 @@ pre-commit-hooks = {git = "https://github.com/Lucas-C/pre-commit-hooks"} | |||
| black = "*" | |||
| hdwallet = "^1.3.2" | |||
| ipython = "^7.28.0" | |||
| slither-analyzer = "^0.8.3" | |||
There was a problem hiding this comment.
Can be undone when
is closed.
We run all the pre-commit hooks on the CI but also have a separate slither workflow. Having a slither pre-commit hook would run it twice on the CI. I think it is rather slow for a pre-commit hook.
- Add slither to `run-ci-steps` script. - Remove `prepend-timestamps` script. GitHub Actions has this built in now.
|
There's something wrong with the code scanning job
|
|
Running the "Slither /slither" job again completed the "Code scanning results / Slither" check. 🤷 |
|
Is it possible to run slither locally? If this is the case can we add a section to the README.md? |
Just saw the Slither.md page. |
|
When I run slither on my machine I get this error (in red). Is it needed to do something special so that the CI does not complain? |
@philippecamacho These should be excluded because of the slither config file. I think it complains because due to the name collision it cannot analyze both contracts. However in this case they aren't our contracts anyway so it was easier to just ignore them. No idea why that's not working for you though. Is it the only error you get? |
It is the only "red" printed error I have yes. Then I have orange and plenty of green messages. |
This is expected to fail on the current revision of this repo because of some non-functional but bytecode affecting changes to the merkle tree contract in #1109 that have not been deployed. To verify one can checkout 0d13dec and run the `etherscan-verify` of this commit but I already ran it and all contracts are now verified. To test the script the easiest way is to do a throwaway deployment on Goerli and run the `etherscan-verify` script. Close #1123
This is expected to fail on the current revision of this repo because of some non-functional but bytecode affecting changes to the merkle tree contract in #1109 that have not been deployed. To verify one can checkout 0d13dec and run the `etherscan-verify` of this commit but I already ran it and all contracts are now verified. To test the script the easiest way is to do a throwaway deployment on Goerli and run the `etherscan-verify` script. Close #1123
Close #1108