[CERT-9592] Vyper setup #60

H00N24 · 2025-09-24T15:57:15Z

🚀 Pull Request Overview

This PR adds a Vyper setup into our pipeline.

📜 Tests Checklist

Before submitting this PR, ensure that all tests pass and meet the following conditions:

Category	Status	Compilation Comment	Results Review
fail_to_start	❌ Failed with compilation error	🟢 Yes	🔴 No
violated_rules	✅ Passed, with violations found	🔴 No	🟢 Yes
verified_rules	✅ Passed without violations	🔴 No	🟢 Yes
solana_violated_rules	✅ Passed, with violations found	🔴 No	🟢 Yes

Please verify that your changes meet the above conditions for each category of tests.
If something doesn't match, investigate before submitting the PR.

github-actions · 2025-09-24T15:57:48Z

Certora Run Started (Fail to Start)

Group ID: 96131bda-ce39-4428-a83b-5d95d7645261

Config	Status	Link	Log File
conf-start-error.conf	Failed (1)	-	tests/evm/conf-start-error.conf-b08cd1f89285.log
conf-start-error.conf --method "counter()"	Failed (1)	-	tests/evm/conf-start-error.conf-e3e81b6fc478.log
conf-verified.conf	Compiled	-	tests/evm/conf-verified.conf-b4a59e9b97b2.log
conf-verified.conf --rule monotone --method "counter()"	Compiled	-	tests/evm/conf-verified.conf-724e9fc88381.log
conf-violations.conf --method "counter()"	Compiled	-	tests/evm/conf-violations.conf-69110eb7f26e.log
conf-violations.conf --rule invertible	Compiled	-	tests/evm/conf-violations.conf-8dc865c7c698.log

Certora Run Summary

Started 0 jobs
2 jobs failed

Download Logs

certora-run

Verification Results

Group ID: 55cd0251-856f-4113-807e-54c33981e3cf

Job	Result	VERIFIED	VIOLATED	Link
conf-violations.conf --rule invertible	✅	2	0	Link
conf-violations.conf	❌	2	1	Link
conf-verified.conf --method "counter()"	✅	3	0	Link
conf-verified.conf	✅	3	0	Link

Copilot

Pull Request Overview

This PR adds Vyper support to the action pipeline by introducing a new vyper-version input parameter that allows users to install specific versions of the Vyper compiler.

Adds vyper-version input parameter for specifying Vyper installation version
Implements Vyper installation logic using UV tool manager
Updates documentation to reflect the new Vyper configuration option

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
action.yml	Adds vyper-version input and installation step with version handling logic
README.md	Documents the new vyper-version parameter in EVM-specific inputs section
.github/workflows/main.yml	Demonstrates usage by setting vyper-version to "latest" in test workflow

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-24T15:59:55Z

action.yml

+        if [ '${{ inputs.vyper-version }}' == 'latest' ]; then
+          VYPER_PACKAGE="vyper"
+        else
+          VYPER_PACKAGE="vyper==${{ inputs.vyper-version }}"


The shell script is vulnerable to command injection through the vyper-version input. The input should be properly quoted and validated to prevent malicious commands from being executed.

Suggested change

if [ '${{ inputs.vyper-version }}' == 'latest' ]; then

VYPER_PACKAGE="vyper"

else

VYPER_PACKAGE="vyper==${{ inputs.vyper-version }}"

# Validate vyper-version input: allow "latest" or version strings like "0.3.10", "0.3.10-beta"

if [[ '${{ inputs.vyper-version }}' == "latest" ]]; then

VYPER_PACKAGE="vyper"

elif [[ '${{ inputs.vyper-version }}' =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]; then

VYPER_PACKAGE="vyper==${{ inputs.vyper-version }}"

else

echo "::error title=Invalid Vyper version::The vyper-version input ('${{ inputs.vyper-version }}') is invalid. Only 'latest' or version strings like '0.3.10' are allowed."

exit 1

It got some point here

It's irrelevant, as this is a direct user input. If someone wants to destroy their own CI, there is very little we can do about it.

Also, everything is passed as an escaped string, thus it does not really matter what is there, as uv would just try to install a package with that name and fail.

Copilot · 2025-09-24T15:59:55Z

action.yml

+          VYPER_PACKAGE="vyper==${{ inputs.vyper-version }}"
+        fi
+        echo "Installing Vyper version: $VYPER_PACKAGE"
+        uv tool install "$VYPER_PACKAGE"


The installation step lacks error handling. If the Vyper installation fails, users won't get clear feedback about what went wrong. Consider adding error checking and meaningful error messages.

Suggested change

uv tool install "$VYPER_PACKAGE"

if ! uv tool install "$VYPER_PACKAGE"; then

echo "::error title=Vyper Installation Failed::Failed to install Vyper package '$VYPER_PACKAGE'. Please check the version and network connectivity, and try again."

exit 1

fi

certora-run

Verification Results

Group ID: cfe4ee5b-f19e-4b8d-9f95-d3c0ced0973c

Job	Result	VERIFIED	Link
conf-verified.conf --rule monotone --method "counter()"	✅	2	Link
conf-verified.conf --rule invertible	✅	2	Link
conf-verified.conf --method "counter()"	✅	3	Link
conf-verified.conf	✅	3	Link

certora-run

Verification Results

Group ID: ee98d771-bfbb-4863-9787-ef11e0d03ef9

Job	Result	SANITY_FAILED	VIOLATED	Link
Default.conf	❌	2	1	Link

yoav-el-certora

Approving although adding a parser to the Vyper version might be beneficial

yoav-el-certora · 2025-09-25T07:02:43Z

action.yml

+  vyper-version:
+    required: false
+    description: |-
+      The version of Vyper to install. Can be latest, or a specific version like 0.3.3.


Suggested change

The version of Vyper to install. Can be latest, or a specific version like 0.3.3.

The version of Vyper to install. Can be `latest`, or a specific version like 0.3.3.

yoav-el-certora · 2025-09-25T07:04:00Z

action.yml

+        if [ '${{ inputs.vyper-version }}' == 'latest' ]; then
+          VYPER_PACKAGE="vyper"
+        else
+          VYPER_PACKAGE="vyper==${{ inputs.vyper-version }}"


It got some point here

github-actions · 2025-09-25T08:47:16Z

Certora Run Started (Fail to Start)

Group ID: 9e81c0c0-2a34-4d23-8c31-73d82166bfe1

Config	Status	Link	Log File
conf-start-error.conf	Failed (1)	-	tests/evm/conf-start-error.conf-9f436cb7492e.log
conf-start-error.conf --method "counter()"	Failed (1)	-	tests/evm/conf-start-error.conf-4678c2064187.log
conf-verified.conf	Compiled	-	tests/evm/conf-verified.conf-32372eea497b.log
conf-verified.conf --rule monotone --method "counter()"	Compiled	-	tests/evm/conf-verified.conf-20a0380e8d98.log
conf-violations.conf --method "counter()"	Compiled	-	tests/evm/conf-violations.conf-0ae0777f0d20.log
conf-violations.conf --rule invertible	Compiled	-	tests/evm/conf-violations.conf-2ae325cee721.log

Certora Run Summary

Started 0 jobs
2 jobs failed

Download Logs

Vyper setup

a3742ea

certora-run bot reviewed Sep 24, 2025

View reviewed changes

H00N24 requested review from a team and Copilot September 24, 2025 15:59

Copilot AI reviewed Sep 24, 2025

View reviewed changes

certora-run bot reviewed Sep 24, 2025

View reviewed changes

yoav-el-certora approved these changes Sep 25, 2025

View reviewed changes

H00N24 merged commit 8ab69fb into main Sep 25, 2025
6 of 8 checks passed

H00N24 deleted the CERT-9592-vyper branch September 25, 2025 08:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[CERT-9592] Vyper setup #60

[CERT-9592] Vyper setup #60

Uh oh!

H00N24 commented Sep 24, 2025

Uh oh!

github-actions bot commented Sep 24, 2025

Uh oh!

certora-run bot left a comment •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 24, 2025

Uh oh!

yoav-el-certora Sep 25, 2025

Uh oh!

H00N24 Sep 25, 2025

Uh oh!

H00N24 Sep 25, 2025

Uh oh!

Copilot AI Sep 24, 2025

Uh oh!

certora-run bot left a comment •

edited

Loading

Uh oh!

certora-run bot left a comment

Uh oh!

yoav-el-certora left a comment

Uh oh!

yoav-el-certora Sep 25, 2025

Uh oh!

yoav-el-certora Sep 25, 2025

Uh oh!

Uh oh!

github-actions bot commented Sep 25, 2025

Uh oh!

Uh oh!

-        uv tool install "$VYPER_PACKAGE"
+        if ! uv tool install "$VYPER_PACKAGE"; then
+          echo "::error title=Vyper Installation Failed::Failed to install Vyper package '$VYPER_PACKAGE'. Please check the version and network connectivity, and try again."
+          exit 1
+        fi

	The version of Vyper to install. Can be latest, or a specific version like 0.3.3.
	The version of Vyper to install. Can be `latest`, or a specific version like 0.3.3.

[CERT-9592] Vyper setup #60

[CERT-9592] Vyper setup #60

Uh oh!

Conversation

H00N24 commented Sep 24, 2025

🚀 Pull Request Overview

This PR adds a Vyper setup into our pipeline.

📜 Tests Checklist

Uh oh!

github-actions bot commented Sep 24, 2025

Certora Run Started (Fail to Start)

Certora Run Summary

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

yoav-el-certora Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

H00N24 Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

H00N24 Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

certora-run bot left a comment

Choose a reason for hiding this comment

Verification Results

Uh oh!

yoav-el-certora left a comment

Choose a reason for hiding this comment

Uh oh!

yoav-el-certora Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

yoav-el-certora Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Sep 25, 2025

Certora Run Started (Fail to Start)

Certora Run Summary

Uh oh!

Uh oh!

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading