diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7a5f6eb27..59c164541 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -284,4 +284,34 @@ jobs: - name: "Add coverage summary" run: | echo "## Coverage result" >> $GITHUB_STEP_SUMMARY - echo "✅ Uploaded to Codecov" >> $GITHUB_STEP_SUMMARY \ No newline at end of file + echo "✅ Uploaded to Codecov" >> $GITHUB_STEP_SUMMARY + + slither-analyze: + needs: ["lint", "build"] + runs-on: "ubuntu-latest" + permissions: + actions: "read" + contents: "read" + security-events: "write" + steps: + - name: "Check out the repo" + uses: "actions/checkout@v3" + with: + submodules: "recursive" + + - name: "Run Slither analysis" + uses: "crytic/slither-action@v0.3.0" + id: "slither" + with: + fail-on: "none" + sarif: "results.sarif" + + - name: "Upload SARIF file to GitHub code scanning" + uses: "github/codeql-action/upload-sarif@v2" + with: + sarif_file: ${{ steps.slither.outputs.sarif }} + + - name: "Add Slither summary" + run: | + echo "## Slither result" >> $GITHUB_STEP_SUMMARY + echo "✅ Uploaded to GitHub code scanning" >> $GITHUB_STEP_SUMMARY diff --git a/slither.config.json b/slither.config.json index 725063073..0776b9633 100644 --- a/slither.config.json +++ b/slither.config.json @@ -2,7 +2,7 @@ "detectors_to_exclude": "naming-convention,reentrancy-events,solc-version,timestamp", "filter_paths": "(lib|test)", "solc_remaps": [ - "@openzeppelin/contracts=lib/openzeppelin-contracts/contracts/", + "@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/", "@prb/math/=lib/prb-math/", "@prb/test/=lib/prb-test/src/", "forge-std/=lib/forge-std/src/",