Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/workflows/foundry-test.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
#
# SPDX-License-Identifier: Apache-2.0

name: KMS Auth-ETH Foundry Tests

on:
push:
paths:
- 'kms/auth-eth/**'
- '.github/workflows/foundry-test.yml'
pull_request:
paths:
- 'kms/auth-eth/**'
- '.github/workflows/foundry-test.yml'
workflow_dispatch:

env:
FOUNDRY_PROFILE: ci

jobs:
check:
name: Foundry project
runs-on: ubuntu-latest
defaults:
run:
working-directory: kms/auth-eth
steps:
- uses: actions/checkout@v4
with:
submodules: recursive

- name: Install Foundry
uses: foundry-rs/foundry-toolchain@v1

- name: Show Forge version
run: |
forge --version

- name: Run Forge fmt
run: |
forge fmt --check
id: fmt

- name: Run Forge build
run: |
forge build --sizes
id: build

- name: Run Forge tests
run: |
forge test --ffi -vvv
id: test
Comment on lines +23 to +53

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 9 days ago

To fix the problem, you should add a permissions block to the workflow. This block can be added either at the root level (applying to all jobs unless individually overridden) or specifically to the check job shown. The minimal starting point for most build/test pipelines is contents: read — this prevents the workflow from making any modifications to repository content, but still allows it to check out code and read repository metadata. Add the following at the top level of the workflow (after the name: key is typical), e.g. after line 5. No imports or definitions are needed; just a one-line-permission YAML key insert.

Suggested changeset 1
.github/workflows/foundry-test.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/foundry-test.yml b/.github/workflows/foundry-test.yml
--- a/.github/workflows/foundry-test.yml
+++ b/.github/workflows/foundry-test.yml
@@ -3,6 +3,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: KMS Auth-ETH Foundry Tests
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -3,6 +3,8 @@
# SPDX-License-Identifier: Apache-2.0

name: KMS Auth-ETH Foundry Tests
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
13 changes: 13 additions & 0 deletions .gitmodules
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
#
# SPDX-License-Identifier: Apache-2.0

[submodule "kms/auth-eth/lib/forge-std"]
path = kms/auth-eth/lib/forge-std
url = https://github.com/foundry-rs/forge-std
[submodule "kms/auth-eth/lib/openzeppelin-contracts-upgradeable"]
path = kms/auth-eth/lib/openzeppelin-contracts-upgradeable
url = https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable
[submodule "kms/auth-eth/lib/openzeppelin-foundry-upgrades"]
path = kms/auth-eth/lib/openzeppelin-foundry-upgrades
url = https://github.com/OpenZeppelin/openzeppelin-foundry-upgrades
21 changes: 21 additions & 0 deletions kms/auth-eth/.env.example
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
#
# SPDX-License-Identifier: Apache-2.0

# Example environment configuration for local testing

# Server configuration
PORT=8000
HOST=127.0.0.1

# Ethereum configuration
ETH_RPC_URL=http://127.0.0.1:8545
KMS_CONTRACT_ADDR=0x0000000000000000000000000000000000000000

# For testing with local Anvil node (Foundry):
# ETH_RPC_URL=http://127.0.0.1:8545
# KMS_CONTRACT_ADDR=<deployed_contract_address>

# For testing with testnet:
# ETH_RPC_URL=https://rpc.sepolia.org
# KMS_CONTRACT_ADDR=<your_deployed_contract_address>
9 changes: 8 additions & 1 deletion kms/auth-eth/.gitignore
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
/artifacts
/cache
/dist
/out
/out

# Test logs
anvil-test.log
anvil.log
deploy.log
server-test.log
.env.test
Loading