GitHub Actions workflow

--- description: "Setup CI/CD pipeline with automated security checks for Solana programs" --- You are setting up a CI/CD pipeline for Solana program development. Modern Solana development requires automated security checks on every commit. ## Related Skills - [deployment.md](../skills/deployment.md) - CI/CD patterns and workflows - [testing.md](../skills/testing.md) - Test automation - [security.md](../skills/security.md) - Security automation ## Overview This command creates a GitHub Actions workflow that automatically: - Builds programs with verifiable builds - Runs comprehensive tests (unit, integration, fuzz) - Performs security audits (cargo audit, clippy) - Validates code formatting - Generates security reports ## Step 1: Create GitHub Actions Workflow ``bash # Create .github/workflows directory mkdir -p .github/workflows # Create workflow file cat > .github/workflows/solana-security.yml << 'EOF' name: Solana Security Pipeline on: push: branches: [ main, develop ] pull_request: branches: [ main ] env: SOLANA_VERSION: '2.1.0' ANCHOR_VERSION: '0.31.1' RUST_VERSION: '1.82.0' jobs: security-audit: name: Security Audit runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v1 with: toolchain: ${{ env.RUST_VERSION }} components: clippy, rustfmt - name: Cache Cargo dependencies uses: actions/cache@v4 with: path: | ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ target/ key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} - name: Install Solana run: | sh -c "$(curl -sSfL https://release.solana.com/v${{ env.SOLANA_VERSION }}/install)" echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH - name: Install Anchor run: | cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked - name: Format Check run: cargo fmt --all -- --check - name: Clippy Security Lints run: | cargo clippy --all-targets --all-features -- \ -W clippy::all \ -W clippy::pedantic \ -W clippy::unwrap_used \ -W clippy::expect_used \ -W clippy::arithmetic_side_effects \ -D warnings - name: Cargo Audit run: | cargo install cargo-audit cargo audit - name: Build Programs run: anchor build - name: Run Tests run: | # Unit tests cargo test # Integration tests anchor test --skip-deploy - name: Security Report if: always() run: | echo "## Security Audit Report" >> $GITHUB_STEP_SUMMARY echo "- ✅ Format check passed" >> $GITHUB_STEP_SUMMARY echo "- ✅ Clippy security lints passed" >> $GITHUB_STEP_SUMMARY echo "- ✅ Cargo audit passed" >> $GITHUB_STEP_SUMMARY echo "- ✅ All tests passed" >> $GITHUB_STEP_SUMMARY verifiable-build: name: Verifiable Build runs-on: ubuntu-latest if: github.event_name == 'push' && github.ref == 'refs/heads/main' steps: - uses: actions/checkout@v4 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v1 with: toolchain: ${{ env.RUST_VERSION }} - name: Install Anchor run: | cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked - name: Verifiable Build run: anchor build --verifiable - name: Upload Build Artifacts uses: actions/upload-artifact@v4 with: name: verifiable-build path: | target/deploy/*.so target/idl/*.json fuzz-testing: name: Fuzz Testing runs-on: ubuntu-latest if: github.event_name == 'push' steps: - uses: actions/checkout@v4 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v1 with: toolchain: ${{ env.RUST_VERSION }} - name: Install Trident run: cargo install trident-cli - name: Run Fuzz Tests run: | cd trident-tests trident fuzz run --timeout 300 timeout-minutes: 10 continue-on-error: true - name: Upload Fuzz Results if: always() uses: actions/upload-artifact@v4 with: name: fuzz-results path: trident-tests/hfuzz_workspace/ EOF echo "✅ GitHub Actions workflow created: .github/workflows/solana-security.yml" ` ## Step 2: Create Pre-commit Hooks ``bash # Create pre-commit hook cat > .git/hooks/pre-commit << 'EOF' #!/bin/bash set -e echo "🔍 Running pre-commit security checks..." # Format