feat(reporting): fix #504 by implementing Soroban Audit Evidence Generator - #526
Merged
Merged
Conversation
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #504
This PR addresses issue #504 to provide traceable supporting evidence for findings generated by the GasGuard analyzer. Previously, findings were simply reported but lacked the verifiable file evidence and detailed documentation references required for robust audits.
The new flow utilizes the
stellarKBto link finding rules with their full explanations and documentation links. Additionally, it reads the original source code directly using a caching mechanism to extract snippets safely padded with contextual lines. This change matters significantly as it creates a direct, provable link between the tool's finding and the underlying code, enabling accurate human review and CI tracking.Implementation details:
SorobanEvidenceGeneratorclass to process findings intoEvidenceartifacts.extractCodeSnippetwhich manages a file I/O cache to prevent redundant disk reads for the same source file.4. Changes Made
src/reporting/evidence/stellar/types.ts: Added interface definitions forEvidence,CodeSnippet, and configuration options. (Addresses Implement Soroban Audit Evidence Generator #504)src/reporting/evidence/stellar/evidence-generator.ts: Implemented core logic including memoized snippet extraction and kb enrichment. (Addresses Implement Soroban Audit Evidence Generator #504)src/reporting/evidence/stellar/index.ts: Exported the generator and types. (Addresses Implement Soroban Audit Evidence Generator #504)src/reporting/evidence/stellar/evidence-generator.spec.ts: Unit test suite to verify code extraction and file generation correctness. (Addresses Implement Soroban Audit Evidence Generator #504)src/tsconfig.json: Created to ensure the IDE type-checks test files safely withinsrc/.5. Testing
The following commands were executed to verify the functionality: