Add `[project.optional-dependencies]` section with `simil` extra so users
can install with `pip install slither-analyzer[simil]` instead of manually
installing fasttext.
Update error message to show the new installation method.
Fixes#2621
Co-authored-by: Claude Opus 4.5 <[email protected]>
* fix: correct ERC conformance JSON key and document evm-cfg-builder dep
- Fix copy-paste error in slither-check-erc: JSON output key was
incorrectly set to "upgradeability-check" instead of "erc-conformance"
- Add note to EVM printer docs about evm-cfg-builder dependency
Fixes#2629, fixes#2733
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix: add blank line before fenced code block in blockquote
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Claude Opus 4.5 <[email protected]>
- Replace pre-commit with prek (Rust-based, faster)
- Add shellcheck and shfmt for shell script linting
- Add actionlint for GitHub Actions validation
- Add actionlint.yaml config for ubuntu-slim runner label
- Update Makefile: lint target adds actionlint/zizmor, reformat adds ruff format
- Update make dev to auto-install hooks
- Update CLAUDE.md and CONTRIBUTING.md to document prek
- Remove redundant hooks (debug-statements, check-yaml, mixed-line-ending)
- Auto-fix formatting issues caught by new hooks
Co-authored-by: Claude Opus 4.5 <[email protected]>
* ci: Harden and optimize GitHub Actions workflows
Security improvements:
- Pin all 23 actions to SHA hashes with version comments
- Add persist-credentials: false to all checkout actions
- Add explicit permissions blocks to all workflows
- Remove unnecessary daily scheduled triggers from ci.yml and test.yml
- Fix script injection in test.yml by using environment variables
Performance optimizations:
- Enable uv dependency caching across all workflows (30-60s savings per job)
- Add path filtering to ci.yml and test.yml (skip CI on docs-only changes)
- Remove redundant setup-python from doctor.yml (setup-uv handles Python)
- Optimize yamllint job to use uvx directly without full Python environment
- Fix lint.yml workflow self-reference path
Verification:
- All workflows pass zizmor security audit (0 findings)
- All workflows pass actionlint validation
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(ci): Restore setup-python for doctor.yml system-wide tests
The doctor workflow tests system-wide Python installation using
`uv pip install --system`, which requires actions/setup-python
to provide a real system Python. The setup-uv action installs
Python in uv's managed directory, not as a system Python.
Also adds Dependabot cooldown and grouping per CLAUDE.md standards.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(ci): Test slither-doctor on actual project, not root filesystem
The doctor workflow was running `slither-doctor .` after `cd /`,
which tested the tool against `/` (root filesystem) instead of a
real Solidity project. This only verified "doesn't crash" rather
than "correctly diagnoses".
Changed to use `$GITHUB_WORKSPACE` so the tool analyzes the Slither
repository, which has test contracts and exercises all 4 diagnostic
checks meaningfully.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* ci(pip-audit): Fix step name, add path filtering for PRs
- Renamed misleading "Install Slither" step to "Export dependencies"
- Added path filtering for PRs (pyproject.toml, uv.lock, workflow file)
- Weekly schedule and push to master still run unconditionally
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* ci: Remove monthly issue metrics workflow
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* ci(doctor): Reduce matrix from 12 to 4 jobs
Test only Python 3.9 (min) and 3.14 (max) since the doctor tool
has no version-specific code. Combined with path filtering, this
workflow now runs rarely and quickly.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* ci: Use ubuntu-slim for simpler workflows
Switch pip-audit, publish, and docs workflows from ubuntu-latest
to ubuntu-slim for faster startup (~10s savings per job).
These workflows have simple requirements and don't need the extra
RAM/software of ubuntu-latest.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Claude Opus 4.5 <[email protected]>
Replace live Etherscan API calls with cached local contract sources.
The contracts are immutable on-chain, so testing against cached source
still validates the analysis logic.
This fixes intermittent CI failures from Etherscan API rate limits when
multiple jobs run in parallel. The Etherscan platform integration is
already tested by crytic-compile's own CI.
Co-authored-by: Claude Opus 4.5 <[email protected]>
* Add .worktrees/ to .gitignore
Prevent git worktree directories from being tracked.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* docs: Add comprehensive CLAUDE.md for AI-assisted development
Add project-specific coding standards and Slither internals documentation
to help developers using Claude Code (or similar AI tools) work effectively
on the codebase.
CLAUDE.md includes:
- Architecture overview and development setup
- Code standards (philosophy, quality, hard limits)
- Working on code (incremental improvement, git conventions)
- Testing guidelines
- Slither internals (APIs, traversal patterns, SlithIR/SSA, detector quality)
CONTRIBUTING.md additions:
- PR description guidelines
- Commit message conventions
- Markdown documentation standards
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* docs: Condense CONTRIBUTING.md and improve readability
- Code section: Remove verbose PR model explanation, fork link, "work from master"
- Testing section: Tighten test categories to scannable list
- Tips: Condense while adding coverage commands
- crytic-compile section: Rename and simplify to numbered steps with example
- CLAUDE.md: Add analyses/ to architecture, alphabetize directories
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Claude Opus 4.5 <[email protected]>
* enable markdown linter
* add .markdownlint.yaml base config
* Update and fix Usage.md based on markdownlint
* Update and fix Data-dependency.md based on markdownlint
* fix fenced code blocks on docs/src/tutorials
* fix markdown on Upgradeability-Checks.md
* fix first-line-heading issue on tools/README.md and tools/Slither-format.md
* fix markdown on tools/Property-generation.md
* fix markdown on tools/Path-Finding-Utility.md
* fix markdown on tools/ERC-Conformance.md
* fix remaining docs/src/tools/
* fix docs/src/printers/
* fix docs/src/detectors/
* fix docs/src/api/
* allow html tag img for custom image size and fix SUMMARY.md
* set MARKDOWN_CONFIG_FILE name for superlinter
* move .markdownlint.yaml to .github/linters/.markdown-lint.yaml
* fix markdown related issue outside docs/src
* fix: remove orphaned stub sections and unnecessary escape
- Remove unnecessary backslash escape before hyphen in README.md
- Remove orphaned "AST File", "Options", and "IDE integrations" stub
sections from Usage.md that had no TOC links
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Dan Guido <[email protected]>
Co-authored-by: Claude Opus 4.5 <[email protected]>
PR #2723 fixed the typo 'unintialized' -> 'uninitialized' in the
detector code but the test snapshots weren't updated.
Co-authored-by: Claude Opus 4.5 <[email protected]>
* Update inheritance.py
* fix: fix linting and formatting issues
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Dan Guido <[email protected]>
Co-authored-by: Claude Opus 4.5 <[email protected]>
Sometimes installed binaries are a symlink to some other path
(e.g., in Homebrew packages) and we should not warn users if
that is the case. Follow symlinks to find the real underlying
paths and compare those instead.
Co-authored-by: Josselin Feist <[email protected]>
Co-authored-by: Dan Guido <[email protected]>
* Fix markdown lint on docs/
- Add .markdownlint.json config to disable overly strict rules
(line length, duplicate headings, inline HTML, etc.)
- Remove temporary docs/src/ exclusion from linter workflow
- Auto-fix formatting issues (tabs to spaces, trailing punctuation)
- Fix broken link fragments in Usage.md table of contents
Fixes#2688
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* ci: add markdownlint job
* Fix duplicate 'Triage mode' heading in Usage.md
Rename the first 'Triage mode' section to 'Suppressing findings'
since it documents comment-based result suppression, not the
--triage-mode CLI feature. Also add TOC entry for the new section.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Claude Opus 4.5 <[email protected]>
Co-authored-by: Emilio López <[email protected]>
The armv7 pip fallback fails because packages like pycryptodome,
bitarray, and regex need C compilation but gcc/python3-dev weren't
installed.
This adds build-essential and python3-dev conditionally only on armv7,
keeping amd64/arm64 images lean (they use uv with pre-built wheels).
Co-Authored-By: Claude Opus 4.5 <[email protected]>
The previous change used `COPY --from=ghcr.io/astral-sh/uv:latest` which
fails on armv7 because uv doesn't publish armv7 images.
This fix:
- Uses curl to install uv (works on amd64/arm64)
- Falls back to pip for armv7 where uv isn't available
- Adds ca-certificates and curl to apt dependencies
- Re-adds python3-pip for the fallback path
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Replace pip with uv for faster dependency installation
- Use uv.lock for reproducible builds with `uv sync --frozen`
- Expand .dockerignore to reduce build context from 937MB to ~9MB
- Remove multi-stage build (no longer needed with uv)
- Optimize layer caching by copying lockfile before source
- Consolidate LABEL instructions into single layer
- Use JSON notation for CMD (proper signal handling)
- Update syntax directive to 1.12
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Replace legacy setup.py with modern pyproject.toml using hatchling
build backend. Update README with current installation instructions.
Fixes#2854
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Dan Guido