fix(protocol): harden ProposerAuction against round-5 adversarial findings #20917
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Protocol | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| paths: | |
| - "packages/protocol/**" | |
| - "!packages/protocol/contract_layout_*" | |
| - "!packages/protocol/audit/**" | |
| - "!packages/protocol/docs/**" | |
| - "!packages/protocol/simulation/**" | |
| - "!packages/protocol/deployments/**" | |
| - "!packages/protocol/script/layer2/hekla/**" | |
| - "!packages/protocol/script/layer2/mainnet/**" | |
| - "!packages/protocol/script/layer1/hekla/**" | |
| - "!packages/protocol/script/layer1/mainnet/**" | |
| - "!packages/protocol/script/layer1/preconf/**" | |
| - "!packages/protocol/script/layer1/provers/**" | |
| - "!packages/protocol/script/layer1/team/**" | |
| branches-ignore: | |
| - release-please--branches--** | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-protocol: | |
| if: ${{ github.event.pull_request.draft == false && !startsWith(github.head_ref, 'release-please') && !startsWith(github.head_ref, 'dependabot') }} | |
| runs-on: [arc-runner-set] | |
| permissions: | |
| # Give the necessary permissions for stefanzweifel/git-auto-commit-action. | |
| contents: write | |
| steps: | |
| - name: Cancel previous runs | |
| uses: styfle/cancel-workflow-action@0.13.1 | |
| with: | |
| access_token: ${{ github.token }} | |
| - name: Fetch owner/repo of pull request | |
| uses: alessbell/pull-request-comment-branch@v2.1.0 | |
| id: comment-branch | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| # account for forked repos case | |
| ref: ${{ steps.comment-branch.outputs.head_ref }} | |
| repository: ${{ steps.comment-branch.outputs.head_owner }}/${{ steps.comment-branch.outputs.head_repo }} | |
| # Fetch more history for better git operations | |
| fetch-depth: 0 | |
| token: ${{ github.event.pull_request.head.repo.fork == false && secrets.TAIKO_KITTY_TOKEN || github.token }} | |
| - name: Read Foundry version | |
| id: foundry-version | |
| run: echo "version=$(grep foundry packages/protocol/.tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT | |
| - name: Install Foundry | |
| uses: foundry-rs/foundry-toolchain@v1.5.0 | |
| with: | |
| version: ${{ steps.foundry-version.outputs.version }} | |
| - name: Install pnpm dependencies | |
| uses: ./.github/actions/install-pnpm-dependencies | |
| - name: Prepare generated artifacts directories for CI | |
| working-directory: ./packages/protocol | |
| run: | | |
| # Ensure directories exist and are writable in CI | |
| mkdir -p gas-reports layout snapshots | |
| # Reset skip-worktree flags that might exist from local dev | |
| git ls-files gas-reports/ | xargs -r git update-index --no-skip-worktree || true | |
| git ls-files snapshots/ | xargs -r git update-index --no-skip-worktree || true | |
| git ls-files 'contracts/**/*_Layout.sol' | xargs -r git update-index --no-skip-worktree || true | |
| # Configure merge strategy for auto-generated files | |
| git config merge.ours.driver true | |
| - name: Clean up and fmt | |
| if: github.event.pull_request.head.repo.fork == false | |
| working-directory: ./packages/protocol | |
| run: pnpm clean && pnpm fmt:sol | |
| - name: Test Shared contracts | |
| working-directory: ./packages/protocol | |
| run: pnpm test:shared && pnpm layout:shared | |
| - name: Test L2 contracts | |
| working-directory: ./packages/protocol | |
| run: pnpm test:l2 && pnpm layout:l2 | |
| - name: Test L1 contracts | |
| working-directory: ./packages/protocol | |
| run: pnpm snapshot:l1 && pnpm layout:l1 | |
| # - name: Generate coverage report | |
| # if: ${{ secrets.CODECOV_TOKEN != '' }} | |
| # working-directory: ./packages/protocol | |
| # run: | | |
| # forge coverage --report lcov | |
| # mkdir -p coverage | |
| # mv lcov.info coverage/lcov.info | |
| # - name: Upload coverage to Codecov | |
| # if: ${{ secrets.CODECOV_TOKEN != '' }} | |
| # uses: codecov/codecov-action@v5 | |
| # with: | |
| # files: ./packages/protocol/coverage/lcov.info | |
| # flags: protocol | |
| # env: | |
| # CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| - name: Check for changes | |
| id: git_status | |
| run: | | |
| git add -N . # Simulate staging to detect untracked files | |
| if [ -n "$(git status --porcelain)" ]; then | |
| echo "changes=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "changes=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Commit generated protocol artifacts | |
| if: steps.git_status.outputs.changes == 'true' && github.event.pull_request.head.repo.fork == false | |
| uses: stefanzweifel/git-auto-commit-action@v7 | |
| with: | |
| commit_message: "Update protocol generated artifacts" | |
| branch: ${{ github.head_ref }} | |
| push_options: "--force-with-lease" | |
| - name: L1-Deploy contracts | |
| working-directory: ./packages/protocol | |
| timeout-minutes: 4 | |
| run: | | |
| anvil & | |
| until cast chain-id --rpc-url "http://localhost:8545" 2> /dev/null; do | |
| sleep 1 | |
| done | |
| pnpm test:deploy:l1 | |
| genesis-docker: | |
| if: ${{ github.event.pull_request.draft == false && !startsWith(github.head_ref, 'release-please') && !startsWith(github.head_ref, 'dependabot') }} | |
| runs-on: [taiko-runner] | |
| permissions: | |
| # Give the necessary permissions for stefanzweifel/git-auto-commit-action. | |
| contents: write | |
| steps: | |
| - name: Cancel previous runs | |
| uses: styfle/cancel-workflow-action@0.13.1 | |
| with: | |
| access_token: ${{ github.token }} | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Read Foundry version | |
| id: foundry-version | |
| run: echo "version=$(grep foundry packages/protocol/.tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT | |
| - name: Install Foundry | |
| uses: foundry-rs/foundry-toolchain@v1.5.0 | |
| with: | |
| version: ${{ steps.foundry-version.outputs.version }} | |
| - name: Install pnpm dependencies | |
| uses: ./.github/actions/install-pnpm-dependencies | |
| - name: Compile | |
| working-directory: ./packages/protocol | |
| run: pnpm clean && pnpm compile | |
| - name: L2-Generate Genesis (using docker) | |
| working-directory: ./packages/protocol | |
| run: pnpm genesis:test |