From 33db145724967dafcec7bd00a8ed40da60406b70 Mon Sep 17 00:00:00 2001 From: kasperpawlowski Date: Tue, 1 Sep 2026 13:40:34 +0200 Subject: [PATCH 1/5] chore: harden CI workflow token and pin actions - add top-level permissions: contents: read (least-privilege token) - SHA-pin actions/checkout to v4.2.2 with persist-credentials: false - SHA-pin foundry-toolchain to v1.4.0 Both SHAs verified against their release tags. --- .github/workflows/test.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 9282e829..869484d5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -2,6 +2,9 @@ name: test on: workflow_dispatch +permissions: + contents: read + env: FOUNDRY_PROFILE: ci @@ -13,12 +16,13 @@ jobs: name: Foundry project runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: + persist-credentials: false submodules: recursive - name: Install Foundry - uses: foundry-rs/foundry-toolchain@v1 + uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0 with: version: nightly From d0548b621a7c26366012ab4148e142aafb68688a Mon Sep 17 00:00:00 2001 From: kasperpawlowski Date: Tue, 1 Sep 2026 13:55:04 +0200 Subject: [PATCH 2/5] ci: run build and non-fork tests on push and pull_request The workflow previously ran only on workflow_dispatch, so nothing was checked automatically on PRs (unlike EVK/EVC/EPO). Enable push + pull_request triggers running forge build and the non-fork test suite. Fork tests (7 files needing live RPC/secrets) are excluded from automatic runs via --no-match-path to keep CI deterministic and safe on fork PRs; workflow_dispatch still runs the full suite so they can be exercised on demand with RPC env vars provided. --- .github/workflows/test.yml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 869484d5..785cb628 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,6 +1,12 @@ name: test -on: workflow_dispatch +on: + push: + branches: + - development + - master + pull_request: + workflow_dispatch: permissions: contents: read @@ -32,7 +38,18 @@ jobs: forge build --sizes id: build + # Fork tests require live RPC access (and secrets), so they are excluded + # from automatic push/PR runs to keep CI deterministic and secret-free. + # A manual `workflow_dispatch` run executes the full suite, so fork tests + # can be exercised on demand once RPC env vars are provided. - name: Run Forge tests + env: + FORK_TESTS: >- + test/{HookTarget/HookTargetMarketStatus.t.sol,HookTarget/HookTargetStakeDelegator.t.sol,Liquidator/SBLiquidator.t.sol,OFT/OFTFeeCollectorFork.t.sol,OFT/OFTFeeCollectorGulperFork.t.sol,Swaps/MigrationHelperFork.t.sol,Swaps/Swaps1Inch.sol} run: | - forge test -vvv + if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then + forge test -vvv + else + forge test -vvv --no-match-path "$FORK_TESTS" + fi id: test From 0e10ef28db0982eb648aeb89652c00275eebf950 Mon Sep 17 00:00:00 2001 From: kasperpawlowski Date: Tue, 1 Sep 2026 14:01:46 +0200 Subject: [PATCH 3/5] ci: drop FOUNDRY_PROFILE=ci (no such profile defined) The workflow set FOUNDRY_PROFILE=ci but foundry.toml defines no [profile.ci]. Recent foundry treats a missing selected profile as a fatal error (older versions only warned and fell back), so the build failed immediately once the workflow started running on PRs. Use the default profile, which carries the correct solc/evm_version/fs_permissions. --- .github/workflows/test.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 785cb628..8c63faea 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,9 +11,6 @@ on: permissions: contents: read -env: - FOUNDRY_PROFILE: ci - jobs: check: strategy: From f65223a5c8ca159387d42be07326d0f50d1d4d15 Mon Sep 17 00:00:00 2001 From: kasperpawlowski Date: Tue, 1 Sep 2026 14:08:43 +0200 Subject: [PATCH 4/5] fix: correct case in DataStreamsVerifier import MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit HookTargetMarketStatus.sol imported ../Chainlink/DatastreamsVerifier.sol (lowercase 's') but the file is DataStreamsVerifier.sol. This compiles on case-insensitive filesystems (macOS) but fails on Linux — surfaced now that CI builds on ubuntu-latest. --- src/HookTarget/HookTargetMarketStatus.sol | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/HookTarget/HookTargetMarketStatus.sol b/src/HookTarget/HookTargetMarketStatus.sol index cb46d841..11726223 100644 --- a/src/HookTarget/HookTargetMarketStatus.sol +++ b/src/HookTarget/HookTargetMarketStatus.sol @@ -2,7 +2,7 @@ pragma solidity ^0.8.0; -import {DataStreamsVerifier} from "../Chainlink/DatastreamsVerifier.sol"; +import {DataStreamsVerifier} from "../Chainlink/DataStreamsVerifier.sol"; import {IHookTarget} from "evk/interfaces/IHookTarget.sol"; /// @title HookTargetMarketStatus From 701c57dc45aa1e65111fcf5b1821e2af558575e0 Mon Sep 17 00:00:00 2001 From: kasperpawlowski Date: Tue, 1 Sep 2026 14:24:01 +0200 Subject: [PATCH 5/5] ci: use plain forge build (drop --sizes) forge build --sizes exits non-zero because ERC4626EVCCollateralSecuritizeFactory (25,588 bytes) exceeds the EIP-170 runtime limit (24,576) under the repo's default optimizer settings. That's a pre-existing deployability concern, not a CI regression; enforcing it here would make CI red from day one. Use plain forge build as a compile check (matching euler-vault-kit). Size enforcement can be re-added once the oversized contract is addressed. --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8c63faea..d2ca2b00 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -32,7 +32,7 @@ jobs: - name: Run Forge build run: | forge --version - forge build --sizes + forge build id: build # Fork tests require live RPC access (and secrets), so they are excluded