Canonical Safe v1.4.1 at genesis #600
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| types: [opened, synchronize, reopened, review_requested, ready_for_review] | |
| # Least-privilege GITHUB_TOKEN. Workflow only checks out and runs forge; it | |
| # does not push commits, open PRs, comment, or modify any other repo state. | |
| permissions: | |
| contents: read | |
| env: | |
| FOUNDRY_PROFILE: ci | |
| jobs: | |
| check: | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: [ubuntu-latest] | |
| name: Foundry project | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Install Foundry | |
| uses: foundry-rs/foundry-toolchain@v1 | |
| - name: Show Forge version | |
| run: | | |
| forge --version | |
| # `forge fmt --check` is intentionally NOT run here. Style enforcement | |
| # belongs in a dedicated cleanup PR; gating every PR on fmt was producing | |
| # large pre-existing diffs unrelated to PR contents. Re-enable once the | |
| # codebase has been formatted in a single sweep. | |
| - name: Run Forge build | |
| # `--sizes` removed: contracts genesis-injected at magic addresses | |
| # (e.g. ConsensusRegistry at 0x07e1...e1) legitimately exceed EIP-170 | |
| # because they don't go through CREATE; the runtime size gate would | |
| # block them despite being deployable. Compile errors are still caught. | |
| run: | | |
| forge build | |
| id: build | |
| - name: Run Forge tests | |
| run: | | |
| forge test -vvv | |
| id: test | |
| # precompile-config.yaml is mainnet block-0 state and cannot be patched | |
| # after genesis. Its consumer is the telcoin-network node repo (which | |
| # embeds it via its tn-contracts submodule); nothing in THIS repo reads | |
| # the committed file — tests replay the generator in memory — so this is | |
| # the only gate proving the committed yaml matches what the generator | |
| # produces. | |
| - name: Check genesis precompile-config.yaml drift | |
| run: | | |
| forge script script/GenerateGenesisPrecompileConfig.s.sol | |
| git diff --exit-code -- deployments/genesis/precompile-config.yaml | |
| id: genesis-drift |