Skip to content

ci: Add Hardhat tooling integration test#516

Open
elle-j wants to merge 5 commits intomainfrom
lj/ci-hardhat
Open

ci: Add Hardhat tooling integration test#516
elle-j wants to merge 5 commits intomainfrom
lj/ci-hardhat

Conversation

@elle-j
Copy link
Copy Markdown
Contributor

@elle-j elle-j commented May 4, 2026

Description

Adds a CI workflow that builds a small Hardhat project with hardhat-polkadot, exercising the standard JSON interface between resolc and hardhat-polkadot end-to-end.

Resolved Issues

Closes #514

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 4, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​parity/​hardhat-polkadot@​0.3.0801001009770
Addednpm/​@​nomicfoundation/​hardhat-toolbox@​5.0.0981007683100
Addednpm/​hardhat@​2.28.692100929680
Addednpm/​@​openzeppelin/​contracts@​5.6.110010010090100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 4, 2026

Warning

[Security]

Socket has found a problem with the dependencies from this PR. Check the details below to solve the issue. If the affected dependency is unreachable, we still recommend you to use a patched version.

Remember: according to Parity's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
High CVE: Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

CVE: GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via proto Key in mergeConfig (HIGH)

Affected versions: >= 1.0.0 < 1.13.5; < 0.30.3

Patched version: 1.13.5

From: tooling-projects/hardhat/erc20/package-lock.jsonnpm/@parity/hardhat-polkadot@0.3.0npm/@nomicfoundation/hardhat-toolbox@5.0.0npm/axios@1.9.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: Axios is vulnerable to DoS attack through lack of data size check

CVE: GHSA-4hjh-wcwx-xvwj Axios is vulnerable to DoS attack through lack of data size check (HIGH)

Affected versions: >= 1.0.0 < 1.12.0; >= 0.28.0 < 0.30.2

Patched version: 1.12.0

From: tooling-projects/hardhat/erc20/package-lock.jsonnpm/@parity/hardhat-polkadot@0.3.0npm/@nomicfoundation/hardhat-toolbox@5.0.0npm/axios@1.9.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The contract is from polkavm-hardhat-examples.

@elle-j elle-j marked this pull request as ready for review May 4, 2026 11:46
@elle-j elle-j requested review from kvpanch and xermicus May 4, 2026 11:46
Copy link
Copy Markdown
Member

@xermicus xermicus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Looks good in isolation but I left some QoL improvements.

Comment on lines +31 to +49
- name: Set Up Rust Toolchain
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
# without this it will override our rust flags
rustflags: ""

- name: Download LLVM
uses: ./.github/actions/get-llvm
with:
target: x86_64-unknown-linux-gnu

- name: Set LLVM Environment Variables
run: echo "LLVM_SYS_221_PREFIX=$(pwd)/llvm-x86_64-unknown-linux-gnu" >> $GITHUB_ENV

- name: Build resolc
run: |
make install-bin
# This env is used by `hardhat.config.js`.
echo "RESOLC_PATH=$(pwd)/target/release/resolc" >> $GITHUB_ENV
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is kinda costly but I think entirely avoidable if we move this past the differential tests so that we can re-use the MUSL build.

Comment on lines +67 to +83
set -x
shopt -s nullglob
build_info_files=(artifacts/build-info/*.json)
test "${#build_info_files[@]}" -eq 1

BUILD_INFO="${build_info_files[0]}"
CONTRACT='.output.contracts["contracts/MyToken.sol"].MyToken'
SOURCE='.output.sources["contracts/MyToken.sol"]'

jq -er "$CONTRACT.evm.bytecode.object" "$BUILD_INFO" | grep -q '^50564d'
jq -er "$CONTRACT.evm.deployedBytecode.object" "$BUILD_INFO" | grep -q '^50564d'
jq -e "$CONTRACT.evm.methodIdentifiers | length > 0" "$BUILD_INFO" > /dev/null
jq -e "$CONTRACT.abi | length > 0" "$BUILD_INFO" > /dev/null
jq -e "$CONTRACT.storageLayout.storage | length > 0" "$BUILD_INFO" > /dev/null
jq -e "$CONTRACT.metadata | length > 0" "$BUILD_INFO" > /dev/null
jq -e "$SOURCE.ast | length > 0" "$BUILD_INFO" > /dev/null
jq -e '.output.sources | length > 1' "$BUILD_INFO" > /dev/null
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please extract this into a dedicated .sh into tooling-projects/hardhat/eerc20 so that we can run this locally more easily?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI: Implement hardhat integration test

2 participants