Feat/slither (#14)

* 👷 Add Slither analysis workflow

* ♻️ Update Slither workflow to include Foundry installation***

* Add permissions and update Slither configuration

* Update Slither workflow to ensure tool availability

* Update Slither workflow

* Add Slither workflow to run static analysis

* 💚 add yarn.lock

* ✨ Update Slither workflow to include Node.js setup and SARIF report generation

* Remove SARIF file upload step in slither.yml

* Update Slither configuration in workflow

* 🚧 Update Slither workflow to include Foundry installation and contract building

* Remove target directory for analysis in slither.yml workflow

* 🚑 Update Slither workflow to include SARIF file upload

* Add token to SARIF file upload

* Add comment.js and update slither.yml workflow

* Update node version in slither.yml

* Update Slither workflow to fail on medium severity issues

* Add target directory for Slither analysis

* Update slither.yml with filter paths for mock contracts

* Update slither-args in slither.yml

* Fix slither-args path in GitHub workflow

* Update slither configuration to exclude node_modules directory

* Update slither-args in slither.yml workflow

* Update Slither version to 0.10.0

* Update slither.yml to fail on no severity issues

* Add check for pull request event in comment.js

.github/scripts/comment.js

@@ -0,0 +1,28 @@
+module.exports = async ({ github, context, header, body }) => {
+    const comment = [header, body].join("\n");
+
+    // Check if the workflow is triggered by a pull request event
+    if (!context.payload.pull_request) {
+        console.log('This workflow is not triggered by a pull request. Skipping comment creation/update.');
+        return;
+    }
+
+    const { data: comments } = await github.rest.issues.listComments({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      issue_number: context.payload.pull_request.number,
+    });
+
+    const botComment = comments.find(
+      comment => comment.user.type === 'Bot' && comment.body.startsWith(header)
+    );
+
+    const commentFn = botComment ? 'updateComment' : 'createComment';
+
+    await github.rest.issues[commentFn]({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      body: comment,
+      ...(botComment ? { comment_id: botComment.id } : { issue_number: context.payload.pull_request.number }),
+    });
+};

.github/workflows/slither.yml

@@ -0,0 +1,31 @@
+name: Slither Analysis
+
+on: push
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run Slither
+        uses: crytic/[email protected]
+        id: slither
+        with:
+          slither-version: '0.10.0'  
+          node-version: '18'
+          fail-on: 'none'
+          slither-args: '--filter-paths "contracts/mock|node_modules" --checklist --markdown-root ${{ github.server_url }}/${{ github.repository }}/blob/${{ github.sha }}/contracts/'
+
+      - name: Create/update checklist as PR comment
+        uses: actions/github-script@v7
+        env:
+          REPORT: ${{ steps.slither.outputs.stdout }}
+        with:
+          script: |
+            const script = require('.github/scripts/comment')
+            const header = '# Slither report'
+            const body = process.env.REPORT
+            await script({ github, context, header, body })
+