setup-ci-cd

You are setting up a CI/CD pipeline for Solana program development. Modern Solana development requires automated security checks on every commit.

Related Skills

• deployment.md - CI/CD patterns and workflows
• testing.md - Test automation
• security.md - Security automation

Overview

This command creates a GitHub Actions workflow that automatically:

• Builds programs with verifiable builds
• Runs comprehensive tests (unit, integration, fuzz)
• Performs security audits (cargo audit, clippy)
• Validates code formatting
• Generates security reports

Step 1: Create GitHub Actions Workflow

# Create .github/workflows directory
mkdir -p .github/workflows

# Create workflow file
cat > .github/workflows/solana-security.yml << 'EOF'
name: Solana Security Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  SOLANA_VERSION: '2.1.0'
  ANCHOR_VERSION: '0.31.1'
  RUST_VERSION: '1.82.0'

jobs:
  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: clippy, rustfmt

      - name: Cache Cargo dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Install Solana
        run: |
          sh -c "$(curl -sSfL https://release.solana.com/v${{ env.SOLANA_VERSION }}/install)"
          echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH

      - name: Install Anchor
        run: |
          cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked

      - name: Format Check
        run: cargo fmt --all -- --check

      - name: Clippy Security Lints
        run: |
          cargo clippy --all-targets --all-features -- \
            -W clippy::all \
            -W clippy::pedantic \
            -W clippy::unwrap_used \
            -W clippy::expect_used \
            -W clippy::arithmetic_side_effects \
            -D warnings

      - name: Cargo Audit
        run: |
          cargo install cargo-audit
          cargo audit

      - name: Build Programs
        run: anchor build

      - name: Run Tests
        run: |
          # Unit tests
          cargo test
          # Integration tests
          anchor test --skip-deploy

      - name: Security Report
        if: always()
        run: |
          echo "## Security Audit Report" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Format check passed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Clippy security lints passed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Cargo audit passed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ All tests passed" >> $GITHUB_STEP_SUMMARY

  verifiable-build:
    name: Verifiable Build
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Install Anchor
        run: |
          cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked

      - name: Verifiable Build
        run: anchor build --verifiable

      - name: Upload Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: verifiable-build
          path: |
            target/deploy/*.so
            target/idl/*.json

  fuzz-testing:
    name: Fuzz Testing
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Install Trident
        run: cargo install trident-cli

      - name: Run Fuzz Tests
        run: |
          cd trident-tests
          trident fuzz run --timeout 300
        timeout-minutes: 10
        continue-on-error: true

      - name: Upload Fuzz Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-results
          path: trident-tests/hfuzz_workspace/
EOF

echo "✅ GitHub Actions workflow created: .github/workflows/solana-security.yml"