ci: add slither job (#714)

* ci: add slither job
chore: fix solc remap path in slither config

* ci: use cached build for slither job

* ci: use solc 0.8.21 in slither job

* ci: revise slither job
revert: ci: use cached build for slither job

* ci: remove superfluous "solc-version" config in slither job not required when a compilation framework is used

---------

Co-authored-by: andreivladbrg <[email protected]>

.github/workflows/ci.yml

@@ -284,4 +284,34 @@ jobs:
       - name: "Add coverage summary"
         run: |
           echo "## Coverage result" >> $GITHUB_STEP_SUMMARY
-          echo "✅ Uploaded to Codecov" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Uploaded to Codecov" >> $GITHUB_STEP_SUMMARY
+
+  slither-analyze:
+    needs: ["lint", "build"]
+    runs-on: "ubuntu-latest"
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
+    steps:
+      - name: "Check out the repo"
+        uses: "actions/checkout@v3"
+        with:
+          submodules: "recursive"
+
+      - name: "Run Slither analysis"
+        uses: "crytic/[email protected]"
+        id: "slither"
+        with:
+          fail-on: "none"
+          sarif: "results.sarif"
+
+      - name: "Upload SARIF file to GitHub code scanning"
+        uses: "github/codeql-action/upload-sarif@v2"
+        with:
+          sarif_file: ${{ steps.slither.outputs.sarif }}
+
+      - name: "Add Slither summary"
+        run: |
+          echo "## Slither result" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Uploaded to GitHub code scanning" >> $GITHUB_STEP_SUMMARY

slither.config.json

@@ -2,7 +2,7 @@
   "detectors_to_exclude": "naming-convention,reentrancy-events,solc-version,timestamp",
   "filter_paths": "(lib|test)",
   "solc_remaps": [
-    "@openzeppelin/contracts=lib/openzeppelin-contracts/contracts/",
+    "@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/",
     "@prb/math/=lib/prb-math/",
     "@prb/test/=lib/prb-test/src/",
     "forge-std/=lib/forge-std/src/",