Merge branch 'dev'

Author: jaybuidl

.github/workflows/contracts-testing.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.5.0
+      uses: step-security/harden-runner@v2.10.1
       with:
         disable-sudo: true
         egress-policy: block
@@ -40,14 +40,14 @@ jobs:
           54.185.253.63:443
 
     - name: Setup Node.js environment
-      uses: actions/setup-node@2a017f350dbf6c4b6bb4508cc83809719115162e
+      uses: actions/setup-node@v4
       with:
-        node-version: 16.x   
+        node-version: 18.x   
 
-    - uses: actions/checkout@7739b9ba2efcda9dde65ad1e3c2dbe65b41dfba7
+    - uses: actions/checkout@v4
 
     - name: Cache node modules
-      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
+      uses: actions/cache@v4
       env:
         cache-name: cache-node-modules
       with:
@@ -74,11 +74,11 @@ jobs:
 
     - name: Test with coverage
       run: |         
-        yarn hardhat coverage --solcoverjs ./.solcover.js --temp artifacts --testfiles \"./test/**/*.ts\" --show-stack-traces
+        yarn hardhat coverage --solcoverjs ./.solcover.js --temp artifacts --testfiles './test/**/*.ts' --show-stack-traces
       working-directory: contracts
 
     - name: Upload a build artifact
-      uses: actions/upload-artifact@65d862660abb392b8c4a3d1195a2108db131dd05
+      uses: actions/upload-artifact@v4
       with:    
         name: code-coverage-report    
         path: contracts/coverage

.github/workflows/dependabot-automerge.yml

@@ -3,6 +3,9 @@ on:
   merge_group:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   dependabot:
     runs-on: ubuntu-latest

.github/workflows/deploy-subgraph.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
         with:
-          node-version: 16
+          node-version: 20
 
       - name: Install Yarn if running locally
         if: ${{ env.ACT }}
@@ -84,5 +84,16 @@ jobs:
         working-directory: subgraph
 
       - name: Deploy the subgraph
-        run: yarn deploy:${{ inputs.subgraph }}:${{ vars.NETWORK }}
+        run: |
+          # working around a graph bug which doesn't exit 1 on error: https://github.com/graphprotocol/graph-tooling/issues/1570
+          error=$(yarn deploy:${{ inputs.subgraph }}:${{ vars.NETWORK }})
+          echo "$error"
+          if [[ $error == *"Error"* ]]
+          then
+            echo "exiting..."
+            exit 1 
+          else
+            echo "deployed successfully"
+            exit 0
+          fi
         working-directory: subgraph

.github/workflows/pr-labels.yml

@@ -0,0 +1,39 @@
+name: Add PR labels
+
+on:
+  pull_request:
+    types: [opened, edited]
+    branches-ignore:
+      - 'dependabot/**'
+      - 'renovate/**'
+
+permissions: # added using https://github.com/step-security/secure-workflows
+  contents: read
+  issues: read
+  pull-requests: write
+
+jobs:
+  copy-labels:
+    runs-on: ubuntu-latest
+    name: Copy labels from linked issues
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.5.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            yarnpkg.com:443
+            github.com:443
+            nightly.yarnpkg.com:443
+            nodejs.org:443
+            objects.githubusercontent.com:443
+            registry.yarnpkg.com:443
+            registry.npmjs.org:443
+            54.185.253.63:443
+
+      - name: copy-labels
+        uses: michalvankodev/copy-issue-labels@f54e957e58fc976eba5ffa36e1a1030572dbb78d # v1.3.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+        

.github/workflows/sonarcloud.yml

@@ -7,17 +7,28 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   sonarcloud:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for SonarSource/sonarcloud-github-action to determine which PR to decorate
     name: SonarCloud
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarcloud-github-action@master
+        uses: SonarSource/sonarcloud-github-action@9f9bba2c7aaf7a55eac26abbac906c3021d211b2 # master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.gitignore

@@ -83,10 +83,6 @@ web_modules/
 .env.test
 .env.production
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
 # Next.js build output
 .next
 out

.nvmrc

@@ -1 +1 @@
-16
+20

.vscode/settings.json

@@ -12,5 +12,8 @@
   "sonarlint.connectedMode.project": {
     "connectionId": "kleros",
     "projectKey": "kleros_kleros-v2"
+  },
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
   }
 }