analyse.yml

name: Code Analysis

on:
  push:
    branches: [master, develop]
  pull_request:
    branches: [master, develop]

jobs:
  slither:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          persist-credentials: false

      - name: Setup node.js version
        uses: actions/setup-node@v3
        with:
          node-version: 16

      - name: Get yarn cache directory path
        id: yarn-cache-dir-path
        run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT

      - name: Cache yarn cache
        id: cache-yarn-cache
        uses: actions/cache@v3
        with:
          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
          key: yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: yarn-${{ hashFiles('**/yarn.lock') }}

      - name: Cache node_modules
        id: cache-node-modules
        uses: actions/cache@v3
        with:
          path: '**/node_modules'
          key: node_modules-${{ hashFiles('**/yarn.lock') }}
          restore-keys: node_modules-${{ hashFiles('**/yarn.lock') }}

      - name: Install modules
        run: yarn
        if: |
          steps.cache-yarn-cache.outputs.cache-hit != 'true' ||
          steps.cache-node-modules.outputs.cache-hit != 'true'

      - uses: actions/setup-python@v4
        with:
          python-version: '3.10.6'

      - name: Install poetry requirements
        run: >
          curl -sSL https://install.python-poetry.org | python - &&
          poetry install --no-root
      
      - name: Remove foundry.toml
        run: rm -f foundry.toml

      - name: Run slither
        run: >
          poetry run slither . --sarif results.sarif --no-fail-pedantic

      - name: Check results.sarif presence
        id: results
        if: always()
        shell: bash
        run: >
          test -f results.sarif &&
          echo 'value=present' >> $GITHUB_OUTPUT ||
          echo 'value=not' >> $GITHUB_OUTPUT

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        if: ${{ always() && steps.results.outputs.value == 'present' }}
        with:
          sarif_file: results.sarif