web3gbit-cli 1.0.0

package/lib/openzeppelin-contracts/scripts/release/workflow/rerun.js

@@ -0,0 +1,7 @@
+module.exports = ({ github, context }) =>
+  github.rest.actions.createWorkflowDispatch({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    workflow_id: 'release-cycle.yml',
+    ref: process.env.REF || process.env.GITHUB_REF_NAME,
+  });

package/lib/openzeppelin-contracts/scripts/release/workflow/set-changesets-pr-title.js

@@ -0,0 +1,17 @@
+const { coerce, inc, rsort } = require('semver');
+const { join } = require('path');
+const { version } = require(join(__dirname, '../../../package.json'));
+
+module.exports = async ({ core }) => {
+  // Variables not in the context
+  const refName = process.env.GITHUB_REF_NAME;
+
+  // Compare package.json version's next patch vs. first version patch
+  // A recently opened branch will give the next patch for the previous minor
+  // So, we get the max against the patch 0 of the release branch's version
+  const branchPatch0 = coerce(refName.replace('release-v', '')).version;
+  const packageJsonNextPatch = inc(version, 'patch');
+  const [nextVersion] = rsort([branchPatch0, packageJsonNextPatch], false);
+
+  core.exportVariable('TITLE', `Release v${nextVersion}`);
+};

package/lib/openzeppelin-contracts/scripts/release/workflow/start.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Set changeset status location
+# This is needed because `changeset status --output` only works with relative routes
+CHANGESETS_STATUS_JSON="$(realpath --relative-to=. "$RUNNER_TEMP/status.json")"
+
+# Save changeset status to temp file
+npx changeset status --output="$CHANGESETS_STATUS_JSON"
+
+# Defensive assertion. SHOULD NOT BE REACHED
+if [ "$(jq '.releases | length' "$CHANGESETS_STATUS_JSON")" != 1 ]; then
+  echo "::error file=$CHANGESETS_STATUS_JSON::The status doesn't contain only 1 release"
+  exit 1;
+fi;
+
+# Create branch
+BRANCH_SUFFIX="$(jq -r '.releases[0].newVersion | gsub("\\.\\d+$"; "")' $CHANGESETS_STATUS_JSON)"
+RELEASE_BRANCH="release-v$BRANCH_SUFFIX"
+git checkout -b "$RELEASE_BRANCH"
+
+# Output branch
+echo "branch=$RELEASE_BRANCH" >> $GITHUB_OUTPUT
+
+# Enter in prerelease state
+npx changeset pre enter rc
+git add .
+git commit -m "Start release candidate"
+
+# Push branch
+if ! git push origin "$RELEASE_BRANCH"; then
+  echo "::error file=scripts/release/start.sh::Can't push $RELEASE_BRANCH. Did you forget to run this workflow from $RELEASE_BRANCH?"
+  exit 1
+fi

package/lib/openzeppelin-contracts/scripts/release/workflow/state.js

@@ -0,0 +1,112 @@
+const { readPreState } = require('@changesets/pre');
+const { default: readChangesets } = require('@changesets/read');
+const { join } = require('path');
+const { fetch } = require('undici');
+const { version, name: packageName } = require(join(__dirname, '../../../contracts/package.json'));
+
+module.exports = async ({ github, context, core }) => {
+  const state = await getState({ github, context, core });
+
+  function setOutput(key, value) {
+    core.info(`State ${key} = ${value}`);
+    core.setOutput(key, value);
+  }
+
+  // Jobs to trigger
+  setOutput('start', shouldRunStart(state));
+  setOutput('promote', shouldRunPromote(state));
+  setOutput('changesets', shouldRunChangesets(state));
+  setOutput('publish', shouldRunPublish(state));
+  setOutput('merge', shouldRunMerge(state));
+
+  // Global Variables
+  setOutput('is_prerelease', state.prerelease);
+};
+
+function shouldRunStart({ isMaster, isWorkflowDispatch, botRun }) {
+  return isMaster && isWorkflowDispatch && !botRun;
+}
+
+function shouldRunPromote({ isReleaseBranch, isWorkflowDispatch, botRun }) {
+  return isReleaseBranch && isWorkflowDispatch && !botRun;
+}
+
+function shouldRunChangesets({ isReleaseBranch, isPush, isWorkflowDispatch, botRun }) {
+  return (isReleaseBranch && isPush) || (isReleaseBranch && isWorkflowDispatch && botRun);
+}
+
+function shouldRunPublish({ isReleaseBranch, isPush, hasPendingChangesets, isPublishedOnNpm }) {
+  return isReleaseBranch && isPush && !hasPendingChangesets && !isPublishedOnNpm;
+}
+
+function shouldRunMerge({
+  isReleaseBranch,
+  isPush,
+  prerelease,
+  isCurrentFinalVersion,
+  hasPendingChangesets,
+  prBackExists,
+}) {
+  return isReleaseBranch && isPush && !prerelease && isCurrentFinalVersion && !hasPendingChangesets && !prBackExists;
+}
+
+async function getState({ github, context, core }) {
+  // Variables not in the context
+  const refName = process.env.GITHUB_REF_NAME;
+  const botRun = process.env.TRIGGERING_ACTOR === 'github-actions[bot]';
+
+  const { changesets, preState } = await readChangesetState();
+
+  // Static vars
+  const state = {
+    refName,
+    hasPendingChangesets: changesets.length > 0,
+    prerelease: preState?.mode === 'pre',
+    isMaster: refName === 'master',
+    isReleaseBranch: refName.startsWith('release-v'),
+    isWorkflowDispatch: context.eventName === 'workflow_dispatch',
+    isPush: context.eventName === 'push',
+    isCurrentFinalVersion: !version.includes('-rc.'),
+    botRun,
+  };
+
+  // Async vars
+  const { data: prs } = await github.rest.pulls.list({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    head: `${context.repo.owner}:merge/${state.refName}`,
+    base: 'master',
+    state: 'open',
+  });
+
+  state.prBackExists = prs.length !== 0;
+
+  state.isPublishedOnNpm = await isPublishedOnNpm(packageName, version);
+
+  // Log every state value in debug mode
+  if (core.isDebug()) for (const [key, value] of Object.entries(state)) core.debug(`${key}: ${value}`);
+
+  return state;
+}
+
+// From https://github.com/changesets/action/blob/v1.4.1/src/readChangesetState.ts
+async function readChangesetState(cwd = process.cwd()) {
+  const preState = await readPreState(cwd);
+  const isInPreMode = preState !== undefined && preState.mode === 'pre';
+
+  let changesets = await readChangesets(cwd);
+
+  if (isInPreMode) {
+    changesets = changesets.filter(x => !preState.changesets.includes(x.id));
+  }
+
+  return {
+    preState: isInPreMode ? preState : undefined,
+    changesets,
+  };
+}
+
+async function isPublishedOnNpm(packageName, version) {
+  const res = await fetch(`https://registry.npmjs.com/${packageName}/${version}`);
+  return res.ok;
+}

package/lib/openzeppelin-contracts/scripts/remove-ignored-artifacts.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+// This script removes the build artifacts of ignored contracts.
+
+const fs = require('fs');
+const path = require('path');
+const match = require('micromatch');
+
+function readJSON(path) {
+  return JSON.parse(fs.readFileSync(path));
+}
+
+const pkgFiles = readJSON('package.json').files;
+
+// Get only negated patterns.
+const ignorePatterns = pkgFiles
+  .filter(pat => pat.startsWith('!'))
+  // Remove the negation part. Makes micromatch usage more intuitive.
+  .map(pat => pat.slice(1));
+
+const ignorePatternsSubtrees = ignorePatterns
+  // Add **/* to ignore all files contained in the directories.
+  .concat(ignorePatterns.map(pat => path.join(pat, '**/*')))
+  .map(p => p.replace(/^\//, ''));
+
+const artifactsDir = 'contracts/build/contracts';
+const buildinfo = 'artifacts/build-info';
+const filenames = fs.readdirSync(buildinfo);
+
+let n = 0;
+
+for (const filename of filenames) {
+  const solcOutput = readJSON(path.join(buildinfo, filename)).output;
+  for (const sourcePath in solcOutput.contracts) {
+    const ignore = match.any(sourcePath, ignorePatternsSubtrees);
+    if (ignore) {
+      for (const contract in solcOutput.contracts[sourcePath]) {
+        fs.unlinkSync(path.join(artifactsDir, contract + '.json'));
+        n += 1;
+      }
+    }
+  }
+}
+
+console.error(`Removed ${n} mock artifacts`);

package/lib/openzeppelin-contracts/scripts/set-max-old-space-size.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+
+# This script sets the node `--max-old-space-size` to 8192 if it is not set already.
+# All existing `NODE_OPTIONS` are retained as is.
+
+export NODE_OPTIONS="${NODE_OPTIONS:-}"
+
+if [ "${NODE_OPTIONS##*--max-old-space-size*}" = "$NODE_OPTIONS" ]; then
+  export NODE_OPTIONS="${NODE_OPTIONS} --max-old-space-size=8192"
+fi

package/lib/openzeppelin-contracts/scripts/solc-versions.js

@@ -0,0 +1,15 @@
+const { exec } = require('child_process');
+const semver = require('semver');
+const { range } = require('./helpers');
+
+module.exports = {
+  versions: ['0.4.26', '0.5.16', '0.6.12', '0.7.6', '0.8.30']
+    .map(semver.parse)
+    .flatMap(({ major, minor, patch }) => range(patch + 1).map(p => `${major}.${minor}.${p}`)),
+  compile: (source, version) =>
+    new Promise((resolve, reject) =>
+      exec(`forge build ${source} --use ${version} --out out/solc-${version}`, error =>
+        error ? reject(error) : resolve(),
+      ),
+    ),
+};

package/lib/openzeppelin-contracts/scripts/solhint-custom/index.js

@@ -0,0 +1,118 @@
+const path = require('path');
+const minimatch = require('minimatch');
+
+const { isFallbackFunction } = require('solhint/lib/common/ast-types');
+const { hasLeadingUnderscore } = require('solhint/lib/common/identifier-naming');
+
+// Files matching these patterns will be ignored unless a rule has `static global = true`
+const ignore = ['contracts/mocks/**/*', 'test/**/*'];
+
+class Base {
+  constructor(reporter, config, source, fileName) {
+    this.reporter = reporter;
+    this.ignored = this.constructor.global || ignore.some(p => minimatch(path.normalize(fileName), p));
+    this.ruleId = this.constructor.ruleId;
+    if (this.ruleId === undefined) {
+      throw Error('missing ruleId static property');
+    }
+  }
+
+  require(condition, node, message) {
+    if (!condition && !this.ignored) {
+      this.reporter.error(node, this.ruleId, message);
+    }
+  }
+}
+
+module.exports = [
+  class extends Base {
+    static ruleId = 'private-variables';
+
+    VariableDeclaration(node) {
+      if (node.isStateVar) {
+        this.require(
+          node.isDeclaredConst || node.isImmutable || node.visibility === 'private',
+          node,
+          'State variables must be private',
+        );
+      }
+    }
+  },
+
+  class extends Base {
+    static ruleId = 'leading-underscore';
+
+    VariableDeclaration(node) {
+      if (node.isDeclaredConst) {
+        this.require(!hasLeadingUnderscore(node.name), node, 'Constant variables should not have leading underscore');
+      } else if (node.isStateVar) {
+        switch (node.visibility) {
+          case 'private':
+            this.require(hasLeadingUnderscore(node.name), node, 'Private state variables must have leading underscore');
+            break;
+          case 'internal':
+            this.require(
+              hasLeadingUnderscore(node.name),
+              node,
+              'Internal state variables must have leading underscore',
+            );
+            break;
+          case 'public':
+            this.require(
+              !hasLeadingUnderscore(node.name),
+              node,
+              'Public state variables should not have leading underscore',
+            );
+            break;
+        }
+      }
+    }
+
+    FunctionDefinition(node) {
+      switch (node.visibility) {
+        case 'external':
+          this.require(!hasLeadingUnderscore(node.name), node, 'External functions should not have leading underscore');
+          break;
+        case 'public':
+          this.require(!hasLeadingUnderscore(node.name), node, 'Public functions should not have leading underscore');
+          break;
+        case 'internal':
+          this.require(
+            hasLeadingUnderscore(node.name) !== (node.parent.kind === 'library'),
+            node,
+            node.parent.kind === 'library'
+              ? 'Library internal functions should not have leading underscore'
+              : 'Non-library internal functions must have leading underscore',
+          );
+          break;
+        case 'private':
+          this.require(hasLeadingUnderscore(node.name), node, 'Private functions must have leading underscore');
+          break;
+      }
+    }
+  },
+
+  class extends Base {
+    static ruleId = 'no-external-virtual';
+
+    FunctionDefinition(node) {
+      if (node.visibility == 'external' && node.isVirtual) {
+        this.require(isFallbackFunction(node), node, 'Functions should not be external and virtual');
+      }
+    }
+  },
+
+  class extends Base {
+    static ruleId = 'no-public-library';
+
+    FunctionDefinition(node) {
+      if (node.parent.kind === 'library') {
+        this.require(
+          node.visibility === 'internal' || node.visibility === 'private',
+          node,
+          'Library functions should be internal or private',
+        );
+      }
+    }
+  },
+];

package/lib/openzeppelin-contracts/scripts/solhint-custom/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "solhint-plugin-openzeppelin",
+  "version": "0.0.0",
+  "private": true,
+  "dependencies": {
+    "minimatch": "^3.1.2"
+  }
+}

package/lib/openzeppelin-contracts/scripts/update-docs-branch.js

@@ -0,0 +1,65 @@
+const proc = require('child_process');
+const read = cmd => proc.execSync(cmd, { encoding: 'utf8' }).trim();
+const run = cmd => {
+  proc.execSync(cmd, { stdio: 'inherit' });
+};
+const tryRead = cmd => {
+  try {
+    return read(cmd);
+  } catch {
+    return undefined;
+  }
+};
+
+const releaseBranchRegex = /^release-v(?<version>(?<major>\d+)\.(?<minor>\d+)(?:\.(?<patch>\d+))?)$/;
+
+const currentBranch = read('git rev-parse --abbrev-ref HEAD');
+const match = currentBranch.match(releaseBranchRegex);
+
+if (!match) {
+  console.error('Not currently on a release branch');
+  process.exit(1);
+}
+
+const pkgVersion = require('../package.json').version;
+
+if (pkgVersion.includes('-') && !pkgVersion.includes('.0.0-')) {
+  console.error('Refusing to update docs: non-major prerelease detected');
+  process.exit(0);
+}
+
+const current = match.groups;
+const docsBranch = `docs-v${current.major}.x`;
+
+// Fetch remotes and find the docs branch if it exists
+run('git fetch --all --no-tags');
+const matchingDocsBranches = tryRead(`git rev-parse --glob='*/${docsBranch}'`);
+
+if (!matchingDocsBranches) {
+  // Create the branch
+  run(`git checkout --orphan ${docsBranch}`);
+} else {
+  const [publishedRef, ...others] = new Set(matchingDocsBranches.split('\n'));
+  if (others.length > 0) {
+    console.error(
+      `Found conflicting ${docsBranch} branches.\n` +
+        'Either local branch is outdated or there are multiple matching remote branches.',
+    );
+    process.exit(1);
+  }
+  const publishedVersion = JSON.parse(read(`git show ${publishedRef}:package.json`)).version;
+  const publishedMinor = publishedVersion.match(/\d+\.(?<minor>\d+)\.\d+/).groups.minor;
+  if (current.minor < publishedMinor) {
+    console.error('Refusing to update docs: newer version is published');
+    process.exit(0);
+  }
+
+  run('git checkout --quiet --detach');
+  run(`git reset --soft ${publishedRef}`);
+  run(`git checkout ${docsBranch}`);
+}
+
+run('npm run prepare-docs');
+run('git add -f docs'); // --force needed because generated docs files are gitignored
+run('git commit -m "Update docs"');
+run(`git checkout ${currentBranch}`);

package/lib/openzeppelin-contracts/scripts/upgradeable/README.md

@@ -0,0 +1,21 @@
+The upgradeable variant of OpenZeppelin Contracts is automatically generated from the original Solidity code. We call this process "transpilation" and it is implemented by our [Upgradeability Transpiler](https://github.com/OpenZeppelin/openzeppelin-transpiler/).
+
+When the `master` branch or `release-v*` branches are updated, the code is transpiled and pushed to [OpenZeppelin/openzeppelin-contracts-upgradeable](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable) by the `upgradeable.yml` workflow.
+
+## `transpile.sh`
+
+Applies patches and invokes the transpiler with the command line flags we need for our requirements (for example, excluding certain files).
+
+## `transpile-onto.sh`
+
+```
+bash scripts/upgradeable/transpile-onto.sh <target> [<base>]
+```
+
+Transpiles the contents of the current git branch and commits the result as a new commit on branch `<target>`. If branch `<target>` doesn't exist, it will copy the commit history of `[<base>]` (this is used in GitHub Actions, but is usually not necessary locally).
+
+## `patch-apply.sh` & `patch-save.sh`
+
+Some of the upgradeable contract variants require ad-hoc changes that are not implemented by the transpiler. These changes are implemented by patches stored in `upgradeable.patch` in this directory. `patch-apply.sh` applies these patches.
+
+If the patches fail to apply due to changes in the repo, the conflicts have to be resolved manually. Once fixed, `patch-save.sh` will take the changes staged in Git and update `upgradeable.patch` to match.

package/lib/openzeppelin-contracts/scripts/upgradeable/alias/Initializable.sol

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.20;
+
+import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";

package/lib/openzeppelin-contracts/scripts/upgradeable/alias/UUPSUpgradeable.sol

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.22;
+
+import {UUPSUpgradeable} from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";

package/lib/openzeppelin-contracts/scripts/upgradeable/patch-apply.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIRNAME="$(dirname -- "${BASH_SOURCE[0]}")"
+PATCH="$DIRNAME/upgradeable.patch"
+
+error() {
+  echo Error: "$*" >&2
+  exit 1
+}
+
+if ! git diff-files --quiet ":!$PATCH" || ! git diff-index --quiet HEAD ":!$PATCH"; then
+  error "Repository must have no staged or unstaged changes"
+fi
+
+if ! git apply -3 "$PATCH"; then
+  error "Fix conflicts and run $DIRNAME/patch-save.sh"
+fi

package/lib/openzeppelin-contracts/scripts/upgradeable/patch-save.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIRNAME="$(dirname -- "${BASH_SOURCE[0]}")"
+PATCH="$DIRNAME/upgradeable.patch"
+
+error() {
+  echo Error: "$*" >&2
+  exit 1
+}
+
+if ! git diff-files --quiet ":!$PATCH"; then
+  error "Unstaged changes. Stage to include in patch or temporarily stash."
+fi
+
+git diff-index --cached --patch --output="$PATCH" HEAD
+git restore --staged --worktree ":!$PATCH"

package/lib/openzeppelin-contracts/scripts/upgradeable/transpile-onto.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: bash $0 <target> [<base>]" >&2
+  exit 1
+fi
+
+set -x
+
+target="$1"
+base="${2-}"
+
+bash scripts/upgradeable/transpile.sh
+
+commit="$(git rev-parse --short HEAD)"
+start_branch="$(git rev-parse --abbrev-ref HEAD)"
+
+git add contracts
+
+# detach from the current branch to avoid making changes to it
+git checkout --quiet --detach
+
+# switch to the target branch, creating it if necessary
+if git rev-parse -q --verify "$target"; then
+  # if the branch exists, make it the current HEAD without checking out its contents
+  git reset --soft "$target"
+  git checkout "$target"
+else
+  # if the branch doesn't exist, create it as an orphan and check it out
+  git checkout --orphan "$target"
+  if [ -n "$base" ] && git rev-parse -q --verify "$base"; then
+    # if base was specified and it exists, set it as the branch history
+    git reset --soft "$base"
+  fi
+fi
+
+# abort if there are no changes to commit at this point
+if git diff --quiet --cached; then
+  exit
+fi
+
+if [[ -v SUBMODULE_REMOTE ]]; then
+  lib=lib/openzeppelin-contracts
+  git submodule add -b "${base#origin/}" "$SUBMODULE_REMOTE" "$lib"
+  git -C "$lib" checkout "$commit"
+  git add "$lib"
+fi
+
+git commit -m "Transpile $commit" --no-verify
+
+# return to original branch
+git checkout "$start_branch"

package/lib/openzeppelin-contracts/scripts/upgradeable/transpile.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+set -euo pipefail -x
+
+VERSION="$(jq -r .version contracts/package.json)"
+DIRNAME="$(dirname -- "${BASH_SOURCE[0]}")"
+
+bash "$DIRNAME/patch-apply.sh"
+sed -i'' -e "s/<package-version>/$VERSION/g" "contracts/package.json"
+git add contracts/package.json
+
+npm run clean
+npm run compile
+
+build_info=($(jq -r '.input.sources | keys | if any(test("^contracts/mocks/.*\\bunreachable\\b")) then empty else input_filename end' artifacts/build-info/*))
+build_info_num=${#build_info[@]}
+
+if [ $build_info_num -ne 1 ]; then
+  echo "found $build_info_num relevant build info files but expected just 1"
+  exit 1
+fi
+
+# -D: delete original and excluded files
+# -b: use this build info file
+# -i: use included Initializable
+# -x: exclude some proxy-related contracts
+# -p: emit public initializer
+# -n: use namespaces
+# -N: exclude from namespaces transformation
+# -q: partial transpilation using @openzeppelin/contracts as peer project
+npx @openzeppelin/upgrade-safe-transpiler -D \
+  -b "$build_info" \
+  -i contracts/proxy/utils/Initializable.sol \
+  -x 'contracts-exposed/**/*' \
+  -x 'contracts/mocks/**/*Proxy*.sol' \
+  -x 'contracts/proxy/**/*Proxy*.sol' \
+  -x 'contracts/proxy/beacon/UpgradeableBeacon.sol' \
+  -p 'contracts/access/manager/AccessManager.sol' \
+  -p 'contracts/finance/VestingWallet.sol' \
+  -p 'contracts/governance/TimelockController.sol' \
+  -p 'contracts/metatx/ERC2771Forwarder.sol' \
+  -n \
+  -N 'contracts/mocks/**/*' \
+  -q '@openzeppelin/'
+
+# create alias to Initializable and UUPSUpgradeable
+cp $DIRNAME/alias/*.sol contracts/proxy/utils/.
+
+# delete compilation artifacts of vanilla code
+npm run clean