Harden release profile, add dependency audit and coverage gates - #1223
Open
amberly-d wants to merge 3 commits into
Open
Harden release profile, add dependency audit and coverage gates#1223amberly-d wants to merge 3 commits into
amberly-d wants to merge 3 commits into
Conversation
|
@amberly-d is attempting to deploy a commit to the naijabuz's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@amberly-d Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
yusuftomilola
approved these changes
Jul 27, 2026
yusuftomilola
left a comment
yusuftomilola
left a comment
Collaborator
There was a problem hiding this comment.
Solid quality gates! Hardened release profile improves performance, dependency audit enhances security, and coverage gates ensure robust test coverage. Strong focus on reliability.
yusuftomilola
requested changes
Jul 27, 2026
yusuftomilola
left a comment
yusuftomilola
left a comment
Collaborator
There was a problem hiding this comment.
Hi @amberly-d, 👋
This PR has merge conflicts that need to be resolved before it can be merged. The following file has conflicts:
contracts/.gitignore
Please resolve this conflict in your branch and push the updates. Once resolved, the PR can be merged successfully.
Thank you!
yusuftomilola
approved these changes
Jul 27, 2026
yusuftomilola
left a comment
yusuftomilola
left a comment
Collaborator
There was a problem hiding this comment.
Solid quality gates! Hardened release profile improves performance, dependency audit enhances security, and coverage gates ensure robust test coverage. Strong focus on reliability.
…et tests SC-37: release profile - Add lto, codegen-units = 1, strip = "symbols", debug = 0 and panic = "abort". - Keep overflow-checks = true. It costs size and gas, but these contracts move asset value and share counts, and a silent wrap is worse than a trapped transaction. Turning the traps into typed errors is SC-43. - Add a release-with-logs profile inheriting release with debug assertions on, for testnet debugging. - Measured WASM shrinks 43.4% overall, from 440,636 to 249,183 bytes: assetsup -36.6%, contrib -39.8%, multisig_wallet -41.8%, asset_maintenance -64.4%, multisig_transfer -45.9%. Per-contract figures are recorded in contracts/BUILD.md. All tests pass unchanged under panic=abort. SC-38: dependency audit - Add a security job running cargo audit and cargo deny, with the advisory database and tooling cached, plus a weekly schedule so advisories published after a merge are still caught. - Add deny.toml covering advisories, a permissive licence allowlist, duplicate-version detection and a crates.io-only source policy. It passes as committed. - Mark all five crates publish = false. They deploy as WASM and are never published, and it lets cargo-deny stop reporting them as unlicensed without inventing a licence the repository does not state. - Two advisories are ignored with reasoning and a review date, both unmaintained compile-time proc macros reached through soroban-sdk. Yanked crates warn rather than deny: soroban-sdk 22 pins yanked spin and keccak inside its own tree, unresolvable from this workspace, and a permanently red job is one everyone learns to ignore. SC-35 should clear both. SC-39: coverage - Add a coverage job running cargo-llvm-cov and uploading the lcov report. - Add scripts/check-coverage.sh enforcing a workspace floor and, more importantly, a per-crate floor. A workspace average hides a crate with no tests behind well-tested siblings, which is how multisig_transfer reached 755 lines at zero coverage unnoticed. - Floors are set just under the measured level so the build stays green and can be ratcheted up: assetsup 70, contrib 35, multisig-wallet 90, asset-maintenance 70, workspace 65. - Any crate at zero coverage fails unless explicitly listed with its tracking issue. multisig_transfer is the only entry, pending SC-32; removing it is how the gate tightens. Verified the gate fails when the exemption is removed. SC-40: multisig-wallet coverage - 4 tests to 60, covering every public entrypoint. - Threshold and signer-count invariants at their boundaries: zero threshold, threshold above owner count, threshold equal to owner count, fewer than two owners, and removal that would drop owners below the threshold. - Proposal lifecycle including rejection of re-execution and of execution below the threshold. - Duplicate approvals, approval by a non-owner, and that a removed signer can no longer confirm. - Negative auth tests without mock_all_auths, so a missing require_auth fails rather than passing silently. One behavioural finding, pinned as a test rather than changed here: confirm_transaction sets status = Expired and writes it before returning Err(TransactionExpired), but Soroban rolls back storage writes on a failed invocation, so the write never lands and the transaction stays Pending. Nothing can currently move a transaction into Expired, so a consumer filtering on that status will never match. Giving it a real transition needs a separate entrypoint, which is beyond a test-coverage change. Closes DistinctCodes#1201 Closes DistinctCodes#1202 Closes DistinctCodes#1203 Closes DistinctCodes#1204
The Dependency Audit job failed on its first CI run, for two reasons — one a genuine finding, which is the job doing its job. The finding: RUSTSEC-2026-0009, a medium-severity denial of service via stack exhaustion in time 0.3.44, reachable through the soroban dependency tree. It has a fix, so it is fixed rather than ignored: cargo update -p time moves it to 0.3.54, a lockfile-only change. cargo audit is now clean of vulnerabilities. The inconsistency: the job ran cargo audit with --deny warnings, which promotes *yanked* crates to errors. That contradicts the policy deny.toml already documents — soroban-sdk pins yanked spin and keccak inside its own tree, which no cargo update can resolve, so denying there would mean a permanently red job that everyone learns to ignore. The two tools now agree: cargo audit gates on actual vulnerabilities, and cargo deny handles yanked and unmaintained advisories with a recorded reason and review date for each. Verified locally: cargo audit and cargo deny both exit 0, and all 435 tests pass.
…sting-library/react
amberly-d
force-pushed
the
feat/sc-37-40-release-profile-audit-coverage-tests
branch
from
July 27, 2026 17:29
40cb127 to
cc270a5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1201
Closes #1202
Closes #1203
Closes #1204