feat: add zap migrate hook #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Audit Agent | |
| on: | |
| pull_request: | |
| jobs: | |
| quick-scan: | |
| runs-on: ubuntu-latest | |
| env: | |
| AUDIT_AGENT_TOKEN: ${{ secrets.AUDIT_AGENT_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 2 | |
| - name: Extract commit message and files | |
| id: extract | |
| run: | | |
| # Get the commit message from the PR head | |
| COMMIT_MSG=$(git log -1 --format=%B ${{ github.event.pull_request.head.sha }}) | |
| echo "Commit message: $COMMIT_MSG" | |
| # Check if commit message matches pattern "scan: [...]" | |
| if echo "$COMMIT_MSG" | grep -q '^scan: \[.*\]'; then | |
| echo "should_scan=true" >> $GITHUB_OUTPUT | |
| # Extract the file list (everything after "scan: ") | |
| FILES=$(echo "$COMMIT_MSG" | sed 's/^scan: //') | |
| # Check if files are already quoted, if not add quotes | |
| if ! echo "$FILES" | grep -q '"'; then | |
| # No quotes found, add them around each file | |
| # Convert [file1,file2,file3] to ["file1","file2","file3"] | |
| FILES=$(echo "$FILES" | sed 's/\[/["/; s/\]/"]/' | sed 's/,/","/g' | sed 's/ //g') | |
| fi | |
| echo "files=$FILES" >> $GITHUB_OUTPUT | |
| echo "Found scan request with files: $FILES" | |
| else | |
| echo "should_scan=false" >> $GITHUB_OUTPUT | |
| echo "No scan request found in commit message" | |
| fi | |
| - name: Quick Scan | |
| if: steps.extract.outputs.should_scan == 'true' | |
| run: | | |
| set -e | |
| API_URL="https://api.auditagent.nethermind.io" | |
| HTTP_CODE=$(curl -s -w "%{http_code}" -o launch_response.json -X POST -H "Content-Type: application/json" -H "X-Api-Key: $AUDIT_AGENT_TOKEN" -d '{ | |
| "githubUrl": "${{ github.event.repository.html_url }}", | |
| "baseBranchName": "${{ github.event.pull_request.base.ref }}", | |
| "branchName": "${{ github.event.pull_request.head.ref }}", | |
| "issueNumber": ${{ github.event.number }}, | |
| "baseCommitHash": "${{ github.event.pull_request.base.sha }}", | |
| "commitHash": "${{ github.event.pull_request.head.sha }}", | |
| "contractFiles": ${{ steps.extract.outputs.files }}, | |
| "language": "solidity" | |
| }' "$API_URL/api/v1/scanner/quick-scan/diff-scan") | |
| if [ "$HTTP_CODE" != "202" ]; then | |
| echo "Launch failed. Expected 202, got $HTTP_CODE." | |
| cat launch_response.json | |
| exit 1 | |
| fi | |
| SCAN_ID=$(cat launch_response.json | tr -d '\000-\037' | jq -r '.data.scan_id // empty') | |
| if [ -z "$SCAN_ID" ]; then | |
| echo "No relevant changes found. No scan needed." | |
| exit 0 | |
| fi | |
| echo "Scan started: $SCAN_ID" | |
| while true; do | |
| RESULT_JSON=$(curl -s -f -H "X-Api-Key: $AUDIT_AGENT_TOKEN" "$API_URL/api/v1/scans/ci-result/$SCAN_ID") | |
| STATUS=$(echo "$RESULT_JSON" | tr -d '\000-\037' | jq -r '.data.scan.status // empty') | |
| if [ "$STATUS" = "completed" ]; then | |
| echo "Scan completed successfully." | |
| exit 0 | |
| fi | |
| if [ "$STATUS" = "failed" ]; then | |
| echo "Scan failed." | |
| exit 1 | |
| fi | |
| echo "Scan status: $STATUS (waiting...)" | |
| sleep 60 | |
| done | |
| merge-context: | |
| if: ${{ github.event.action == 'closed' && github.event.pull_request.merged == true }} | |
| runs-on: ubuntu-latest | |
| env: | |
| AUDIT_AGENT_TOKEN: ${{ secrets.AUDIT_AGENT_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fetch latest target branch and get new commit hash | |
| id: merged_commit | |
| run: | | |
| git fetch origin main:origin/main | |
| NEW_COMMIT_HASH=$(git rev-parse origin/main) | |
| echo "hash=$NEW_COMMIT_HASH" >> $GITHUB_OUTPUT | |
| - name: Merge Context | |
| run: | | |
| RESPONSE=$(curl -s -w "%{http_code}" -o response.json -X POST -H "Content-Type: application/json" -H "X-Api-Key: $AUDIT_AGENT_TOKEN" -d '{ | |
| "githubUrl": "${{ github.event.repository.html_url }}", | |
| "baseBranchName": "${{ github.event.pull_request.base.ref }}", | |
| "baseCommitHash": "${{ steps.merged_commit.outputs.hash }}", | |
| "branchName": "${{ github.event.pull_request.head.ref }}", | |
| "issueNumber": ${{ github.event.number }}, | |
| "commitHash": "${{ github.event.pull_request.head.sha }}" | |
| }' https://api.auditagent.nethermind.io/api/v1/scanner/quick-scan/merge) | |
| STATUS_CODE="${RESPONSE: -3}" | |
| if [ "$STATUS_CODE" != "202" ]; then | |
| echo "API call failed. Expected 202, got $STATUS_CODE." | |
| cat response.json | |
| exit 1 | |
| fi |