Harden CI workflows and actions#115
Conversation
mw-w
commented
May 21, 2026
- SHA-pin all external actions (checkout v6.0.2, setup-node v6.4.0, foundry-toolchain v1.8.0, slither-action v0.4.2)
- Remove custom PAT (ZKEVM_BRIDGE_CONTRACTS_GITHUB_TOKEN), use native github.token scoped to the coverage publish step
- Add permissions: {} at workflow level with least-privilege job-level permissions
- Add persist-credentials: false to all checkout steps
- Collapse four on-push workflows (e2e, lint, static-analysis, test) into a single ci.yml with parallel jobs
- Extract setup-node and setup-foundry composite actions to centralize SHA pins
- Remove borales/actions-yarn (yarn is pre-installed on runners) and node-cache action (replaced by setup-node built-in caching)
- Harden yarn install with --frozen-lockfile --ignore-scripts --non-interactive
- Rewrite coverage action in TypeScript (node16 → node20), using context.repo instead of hardcoded owner/repo, with ESLint + Rollup build toolchain on pnpm
- Add Dependabot configuration for github-actions and npm ecosystems
- Resolves all zizmor findings
- SHA-pin all external actions (checkout v6.0.2, setup-node v6.4.0, foundry-toolchain v1.8.0, slither-action v0.4.2)
- Remove custom PAT (ZKEVM_BRIDGE_CONTRACTS_GITHUB_TOKEN), use native github.token scoped to the coverage publish step
- Add permissions: {} at workflow level with least-privilege job-level permissions
- Add persist-credentials: false to all checkout steps
- Collapse four on-push workflows (e2e, lint, static-analysis, test) into a single ci.yml with parallel jobs
- Extract setup-node and setup-foundry composite actions to centralize SHA pins
- Remove borales/actions-yarn (yarn is pre-installed on runners) and node-cache action (replaced by setup-node built-in caching)
- Harden yarn install with --frozen-lockfile --ignore-scripts --non-interactive
- Rewrite coverage action in TypeScript (node16 → node20), using context.repo instead of hardcoded owner/repo, with ESLint + Rollup build toolchain on pnpm
- Add Dependabot configuration for github-actions and npm ecosystems
- Resolves all zizmor findings
📃CI ReportCompiling 198 files with Solc 0.8.19 Warning (9302): Return value of low-level calls not used. Warning (5667): Unused function parameter. Remove or comment out the variable name to silence this warning. Warning (5667): Unused function parameter. Remove or comment out the variable name to silence this warning. Warning (5667): Unused function parameter. Remove or comment out the variable name to silence this warning. Warning (5667): Unused function parameter. Remove or comment out the variable name to silence this warning. Warning (5667): Unused function parameter. Remove or comment out the variable name to silence this warning. Warning (2018): Function state mutability can be restricted to view Warning (2018): Function state mutability can be restricted to view Warning (2018): Function state mutability can be restricted to view Warning (2018): Function state mutability can be restricted to view Warning (2018): Function state mutability can be restricted to view Warning (2018): Function state mutability can be restricted to view Warning (2018): Function state mutability can be restricted to view Analysing contracts... [PASS] test_grantRoles() (gas: 115752) [PASS] testUpdateFlowRateBucketAfterEmpty() (gas: 81196) [PASS] testUnWithdrawalQueueActivated() (gas: 7925) [PASS] testInitWithdrawalQueue() (gas: 36361) [PASS] test_grantRoles() (gas: 116081) [PASS] testAlreadyProcessed() (gas: 109910) [PASS] testEmptyFindPendingWithdrawals() (gas: 26476) [PASS] test_RevertsIf_WithdrawToCalledWithAChildTokenThatHasWrongBridge() (gas: 41136) [PASS] test_ChildTokenMap() (gas: 401572) [PASS] test_RevertsIf_WithdrawWIMXCalledWithInsufficientAllowance() (gas: 61325) [PASS] test_RevertsIf_WithdrawWIMXToCalledWithInsufficientAllowance() (gas: 61742) [PASS] testActivateWithdrawalQueue() (gas: 30078) [PASS] testFuzz_RateLimit(address,uint256,uint256) (runs: 256, μ: 118944, ~: 118944) [PASS] test_withdrawIMXToWithDifferentAccount_CallsAxelarGateway() (gas: 91020) [PASS] testFuzz_Execute(bytes32,bytes) (runs: 256, μ: 53112, ~: 52676) [PASS] test_WithdrawWIMX_CallsAxelarGateway() (gas: 130421) [PASS] test_WithdrawWIMXToWithDifferentAccount_CallsAxelarGateway() (gas: 130730) [PASS] testFuzz_Execute(bytes32,bytes) (runs: 256, μ: 53068, ~: 52632) [PASS] test_Initialize() (gas: 52462) [PASS] test_RevertsIf_WithdrawCalledWithAChildTokenThatHasWrongBridge() (gas: 40679) [PASS] test_RevertsIf_WithdrawETHCalledWithZeroFee() (gas: 18397) [PASS] test_RevertsIf_WithdrawETHToCalledWithZeroFee() (gas: 18859) [PASS] test_RevertIf_WithdrawIMXCalledWithZeroFee() (gas: 16262) [PASS] test_RevertIf_withdrawIMXToZeroAmountIsProvided() (gas: 23557) [PASS] testFuzz_sendMessage_PaysGasToGasService(uint256) (runs: 256, μ: 63853, ~: 63853) [PASS] test_RevertIf_WithdrawWithNoGas() (gas: 22956) [PASS] test_WithdrawETH_CallsAxelarGateway() (gas: 114075) [PASS] testFuzz_Burn(address,uint256,uint256) (runs: 256, μ: 77295, ~: 77295) [PASS] test_WithdrawETHToWithDifferentAccount_CallsAxelarGateway() (gas: 114550) [PASS] test_WithdrawIMX_CallsAxelarGateway() (gas: 90568) [PASS] test_RevertIf_WithdrawToCalledWithNoGas() (gas: 25486) [PASS] test_RevertsIf_MessageWithEmptyData() (gas: 45591) [PASS] test_RevertsIf_OnMessageReceiveWithInvalidSignature() (gas: 21321) [PASS] testFuzz_Approve(address,address,uint256) (runs: 256, μ: 39418, ~: 39807) [PASS] test_BurnSuccess() (gas: 65365) [PASS] test_InitialState() (gas: 17612) [PASS] testFuzz_sendMessage_PaysGasToGasService(uint256) (runs: 256, μ: 77852, ~: 77852) [PASS] testFuzz_mapToken_UpdatesEthBalance(uint256) (runs: 256, μ: 86923, ~: 86923) [PASS] test_depositETHCallsAxelarServices() (gas: 119662) [PASS] testActivateWithdrawalQueue() (gas: 37812) [PASS] testFuzz_DepositERC20(address,address,address,uint256) (runs: 256, μ: 464454, ~: 464454) [PASS] testFuzz_DepositERC20(address,address,uint256,uint256,uint256) (runs: 256, μ: 3275471, ~: 3275490) [PASS] test_nonFlowRatedTokenWithdrawalsAreQueued() (gas: 2889836) Ran 43 test suites in 49.26s (53.89s CPU time): 555 tests passed, 0 failed, 0 skipped (555 total tests) ╭------------------------------------------------------------------------------+-------------------+-------------------+------------------+------------------╮ For a full HTML report run: |