Skip to content

Commit 4568fff

Browse files
Marc MongeMarc Monge
Marc Monge
authored and
Marc Monge
committed
Initial Commit
Vulneable code to test Github Actions with CodeQL and Slither Actions
0 parents  commit 4568fff

File tree

12 files changed

+875
-0
lines changed

12 files changed

+875
-0
lines changed

‎.github/workflows/security-analysis.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Security Analysis
2+
3+
on:
4+
push:
5+
branches: [ "main", "develop" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
schedule:
9+
- cron: '0 6 * * 1' # Weekly on Monday at 6 AM UTC
10+
11+
jobs:
12+
slither-solidity:
13+
name: Slither Analysis (Solidity)
14+
runs-on: ubuntu-latest
15+
if: contains(github.event.head_commit.message, 'sol') || github.event_name == 'schedule' || github.event_name == 'pull_request'
16+
permissions:
17+
contents: read
18+
security-events: write
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
24+
- name: Run Slither
25+
uses: crytic/slither-action@v0.4.1
26+
id: slither
27+
with:
28+
target: '.'
29+
sarif: slither-results.sarif
30+
fail-on: none
31+
slither-args: '--exclude naming-convention,solc-version'
32+
33+
- name: Upload SARIF file
34+
uses: github/codeql-action/upload-sarif@v3
35+
with:
36+
sarif_file: slither-results.sarif
37+
category: slither
38+
39+
codeql-rust:
40+
name: CodeQL Analysis (Rust)
41+
runs-on: ubuntu-latest
42+
timeout-minutes: 360
43+
permissions:
44+
actions: read
45+
contents: read
46+
security-events: write
47+
packages: read
48+
49+
strategy:
50+
fail-fast: false
51+
matrix:
52+
language: [ 'rust' ]
53+
54+
steps:
55+
- name: Checkout repository
56+
uses: actions/checkout@v4
57+
58+
- name: Initialize CodeQL
59+
uses: github/codeql-action/init@v3
60+
with:
61+
languages: ${{ matrix.language }}
62+
queries: security-extended,security-and-quality
63+
64+
- name: Setup Rust
65+
uses: actions-rs/toolchain@v1
66+
with:
67+
profile: minimal
68+
toolchain: stable
69+
override: true
70+
71+
- name: Autobuild
72+
uses: github/codeql-action/autobuild@v3
73+
74+
- name: Perform CodeQL Analysis
75+
uses: github/codeql-action/analyze@v3
76+
with:
77+
category: "/language:${{matrix.language}}"
78+
79+
combined-security-report:
80+
name: Security Report Summary
81+
runs-on: ubuntu-latest
82+
needs: [slither-solidity, codeql-rust]
83+
if: always()
84+
permissions:
85+
contents: read
86+
security-events: read
87+
88+
steps:
89+
- name: Report Status
90+
run: |
91+
echo "## Security Analysis Summary" >> $GITHUB_STEP_SUMMARY
92+
echo "- Slither (Solidity): ${{ needs.slither-solidity.result }}" >> $GITHUB_STEP_SUMMARY
93+
echo "- CodeQL (Rust): ${{ needs.codeql-rust.result }}" >> $GITHUB_STEP_SUMMARY

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
**/.DS_Store
2+

‎Cargo.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[package]
2+
name = "security-test-sample"
3+
version = "0.1.0"
4+
edition = "2021"
5+
6+
[dependencies]
7+
serde = { version = "1.0", features = ["derive"] }
8+
tokio = { version = "1.0", features = ["full"] }
9+
reqwest = { version = "0.11", features = ["json"] }

‎Makefile‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
# Security Test Sample - Mixed Rust/Solidity Project Makefile
2+
# Supports both Cargo (Rust) and Forge (Solidity) workflows
3+
4+
.PHONY: help install build test clean security lint fmt check all
5+
.DEFAULT_GOAL := help
6+
7+
# Colors for output
8+
GREEN := \033[0;32m
9+
YELLOW := \033[0;33m
10+
RED := \033[0;31m
11+
NC := \033[0m # No Color
12+
13+
# Project info
14+
PROJECT_NAME := security-test-sample
15+
RUST_TARGET_DIR := target
16+
SOLIDITY_OUT_DIR := out
17+
18+
help: ## Show this help message
19+
@echo "$(GREEN)$(PROJECT_NAME) - Mixed Rust/Solidity Project$(NC)"
20+
@echo "Available targets:"
21+
@awk 'BEGIN {FS = ":.*##"} /^[a-zA-Z_-]+:.*##/ { printf " $(GREEN)%-20s$(NC) %s\n", $$1, $$2 }' $(MAKEFILE_LIST)
22+
23+
# =============================================================================
24+
# INSTALLATION TARGETS
25+
# =============================================================================
26+
27+
install: install-rust install-solidity ## Install all dependencies
28+
29+
install-rust: ## Install Rust dependencies
30+
@echo "$(YELLOW)Installing Rust dependencies...$(NC)"
31+
cargo fetch
32+
33+
install-solidity: ## Install Solidity dependencies and forge-std
34+
@echo "$(YELLOW)Installing Solidity dependencies...$(NC)"
35+
@if [ ! -d "lib/forge-std" ]; then \
36+
forge install foundry-rs/forge-std --no-commit; \
37+
fi
38+
npm install
39+
40+
# =============================================================================
41+
# BUILD TARGETS
42+
# =============================================================================
43+
44+
build: build-rust build-solidity ## Build both Rust and Solidity projects
45+
46+
build-rust: ## Build Rust project
47+
@echo "$(YELLOW)Building Rust project...$(NC)"
48+
cargo build
49+
50+
build-rust-release: ## Build Rust project in release mode
51+
@echo "$(YELLOW)Building Rust project (release)...$(NC)"
52+
cargo build --release
53+
54+
build-solidity: ## Build Solidity contracts with Forge
55+
@echo "$(YELLOW)Building Solidity contracts...$(NC)"
56+
forge build
57+
58+
# =============================================================================
59+
# TEST TARGETS
60+
# =============================================================================
61+
62+
test: test-rust test-solidity ## Run all tests
63+
64+
test-rust: ## Run Rust tests
65+
@echo "$(YELLOW)Running Rust tests...$(NC)"
66+
cargo test
67+
68+
test-rust-verbose: ## Run Rust tests with verbose output
69+
@echo "$(YELLOW)Running Rust tests (verbose)...$(NC)"
70+
cargo test -- --nocapture
71+
72+
test-solidity: ## Run Solidity tests with Forge
73+
@echo "$(YELLOW)Running Solidity tests...$(NC)"
74+
forge test
75+
76+
test-solidity-verbose: ## Run Solidity tests with verbose output
77+
@echo "$(YELLOW)Running Solidity tests (verbose)...$(NC)"
78+
forge test -vvv
79+
80+
test-solidity-gas: ## Run Solidity tests with gas reporting
81+
@echo "$(YELLOW)Running Solidity tests with gas report...$(NC)"
82+
forge test --gas-report
83+
84+
# =============================================================================
85+
# SECURITY ANALYSIS TARGETS
86+
# =============================================================================
87+
88+
security: security-rust security-solidity ## Run security analysis on both projects
89+
90+
security-rust: ## Run security analysis on Rust code
91+
@echo "$(YELLOW)Running Rust security analysis...$(NC)"
92+
@if command -v cargo-audit >/dev/null 2>&1; then \
93+
cargo audit; \
94+
else \
95+
echo "$(RED)cargo-audit not installed. Run: cargo install cargo-audit$(NC)"; \
96+
fi
97+
98+
security-solidity: ## Run Slither analysis on Solidity contracts
99+
@echo "$(YELLOW)Running Slither analysis...$(NC)"
100+
@if command -v slither >/dev/null 2>&1; then \
101+
slither src/; \
102+
else \
103+
echo "$(RED)Slither not installed. Visit: https://github.com/crytic/slither$(NC)"; \
104+
fi
105+
106+
security-mythril: ## Run Mythril analysis on Solidity contracts (optional)
107+
@echo "$(YELLOW)Running Mythril analysis...$(NC)"
108+
@if command -v myth >/dev/null 2>&1; then \
109+
myth analyze src/VulnerableToken.sol; \
110+
else \
111+
echo "$(RED)Mythril not installed. Run: pip3 install mythril$(NC)"; \
112+
fi
113+
114+
# =============================================================================
115+
# CODE QUALITY TARGETS
116+
# =============================================================================
117+
118+
lint: lint-rust lint-solidity ## Run linting on both projects
119+
120+
lint-rust: ## Run Rust linting
121+
@echo "$(YELLOW)Linting Rust code...$(NC)"
122+
cargo clippy -- -D warnings
123+
124+
lint-solidity: ## Run Solidity linting
125+
@echo "$(YELLOW)Linting Solidity code...$(NC)"
126+
forge fmt --check
127+
128+
fmt: fmt-rust fmt-solidity ## Format code for both projects
129+
130+
fmt-rust: ## Format Rust code
131+
@echo "$(YELLOW)Formatting Rust code...$(NC)"
132+
cargo fmt
133+
134+
fmt-solidity: ## Format Solidity code
135+
@echo "$(YELLOW)Formatting Solidity code...$(NC)"
136+
forge fmt
137+
138+
check: check-rust check-solidity ## Check code quality for both projects
139+
140+
check-rust: ## Check Rust code without building
141+
@echo "$(YELLOW)Checking Rust code...$(NC)"
142+
cargo check
143+
144+
check-solidity: ## Check Solidity compilation
145+
@echo "$(YELLOW)Checking Solidity compilation...$(NC)"
146+
forge build --sizes
147+
148+
# =============================================================================
149+
# UTILITY TARGETS
150+
# =============================================================================
151+
152+
clean: clean-rust clean-solidity ## Clean build artifacts for both projects
153+
154+
clean-rust: ## Clean Rust build artifacts
155+
@echo "$(YELLOW)Cleaning Rust artifacts...$(NC)"
156+
cargo clean
157+
158+
clean-solidity: ## Clean Solidity build artifacts
159+
@echo "$(YELLOW)Cleaning Solidity artifacts...$(NC)"
160+
forge clean
161+
rm -rf out/ cache/ artifacts/
162+
163+
clean-all: clean ## Alias for clean
164+
@echo "$(GREEN)All build artifacts cleaned$(NC)"
165+
166+
run-rust: ## Run the Rust application
167+
@echo "$(YELLOW)Running Rust application...$(NC)"
168+
cargo run
169+
170+
deploy-local: ## Deploy contracts to local network (requires anvil)
171+
@echo "$(YELLOW)Deploying to local network...$(NC)"
172+
forge script script/Deploy.s.sol --fork-url http://localhost:8545 --broadcast
173+
174+
coverage-solidity: ## Generate test coverage for Solidity
175+
@echo "$(YELLOW)Generating Solidity test coverage...$(NC)"
176+
forge coverage
177+
178+
# =============================================================================
179+
# DEVELOPMENT TARGETS
180+
# =============================================================================
181+
182+
dev: ## Start development environment
183+
@echo "$(YELLOW)Starting development environment...$(NC)"
184+
@echo "Run 'make watch-rust' in one terminal and 'make watch-solidity' in another"
185+
186+
watch-rust: ## Watch Rust files for changes and rebuild
187+
@echo "$(YELLOW)Watching Rust files...$(NC)"
188+
@if command -v cargo-watch >/dev/null 2>&1; then \
189+
cargo watch -x check -x test; \
190+
else \
191+
echo "$(RED)cargo-watch not installed. Run: cargo install cargo-watch$(NC)"; \
192+
fi
193+
194+
watch-solidity: ## Watch Solidity files for changes and rebuild
195+
@echo "$(YELLOW)Watching Solidity files...$(NC)"
196+
forge build --watch
197+
198+
# =============================================================================
199+
# CI/RELEASE TARGETS
200+
# =============================================================================
201+
202+
ci: install build test lint security ## Run full CI pipeline
203+
204+
ci-rust: install-rust build-rust test-rust lint-rust security-rust ## Run Rust CI pipeline
205+
206+
ci-solidity: install-solidity build-solidity test-solidity lint-solidity security-solidity ## Run Solidity CI pipeline
207+
208+
release-rust: ## Build release version of Rust project
209+
@echo "$(YELLOW)Building Rust release...$(NC)"
210+
cargo build --release
211+
212+
# =============================================================================
213+
# INFO TARGETS
214+
# =============================================================================
215+
216+
info: ## Show project information
217+
@echo "$(GREEN)Project Information:$(NC)"
218+
@echo "Name: $(PROJECT_NAME)"
219+
@echo "Rust version: $(shell rustc --version 2>/dev/null || echo 'Not installed')"
220+
@echo "Cargo version: $(shell cargo --version 2>/dev/null || echo 'Not installed')"
221+
@echo "Forge version: $(shell forge --version 2>/dev/null || echo 'Not installed')"
222+
@echo "Node version: $(shell node --version 2>/dev/null || echo 'Not installed')"
223+
@echo "NPM version: $(shell npm --version 2>/dev/null || echo 'Not installed')"
224+
225+
all: clean install build test lint security ## Run complete build pipeline

0 commit comments

Comments
 (0)