chore: harden CI workflow, drop dead remappings - #314
Merged
Merged
Conversation
- test.yml: add contents:read permissions, SHA-pin actions/checkout (v4.2.2) and foundry-toolchain (v1.4.0), set persist-credentials:false on all checkouts, pin the floating foundry nightly to a fixed nightly - add github-actions-only dependabot.yml (weekly, grouped, 7-day cooldown) - remove four dead remappings (ds-test, erc4626-tests, forge-gas-snapshot, solmate) with verified zero direct and transitive compile usage; forge build still succeeds
The newer nightly changed forge fmt rules, producing a large lint diff against unchanged production code. Pin to nightly-c99854 (the version already used across EVC and euler-price-oracle) so forge fmt --check passes with no reformatting; forge build still succeeds.
Seranged
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supply-chain hardening for the CI workflow (this repo had no prior hardening PR). CI runs on every push/PR, so this change validates itself.
test.yml
permissions: contents: read(was: default token scope on all 5 jobs).actions/checkout@v3→ SHA-pinned v4.2.2 withpersist-credentials: false(5 jobs; credentials were persisted alongsidesubmodules: recursive).foundry-toolchain@v1→ SHA-pinned v1.4.0 (both SHAs verified against their tags).version: nightly→ pinnednightly-a998dbf027db7ff4284465ca0b525affd55cc915(all 5 jobs; was a fresh unpinned binary per run).dependabot.yml (new)
gitsubmoduledeliberately excluded — submodule bumps change deployed bytecode and are reviewed intentionally.remappings.txt
ds-test/,erc4626-tests/,forge-gas-snapshot/,solmate/. Verified zero direct imports and zero transitive compile-time usage (permit2 is etched from prebuilt bytecode in tests, so its solmate-importing source never compiles).forge buildsucceeds after removal.Test plan
forge fmt --checkunaffectedNote: commit is unsigned (automated session; GPG pinentry unavailable) — amend with
-Sif required.