setup-ci-cd

You are setting up a CI/CD pipeline for Solana program development. Modern Solana development requires automated security checks on every commit.

## Related Skills

- [deployment.md](../skills/deployment.md) - CI/CD patterns and workflows
- [testing.md](../skills/ext/solana-dev/skill/references/testing.md) - Test automation
- [security.md](../skills/ext/solana-dev/skill/references/security.md) - Security automation

## Overview

This command creates a GitHub Actions workflow that automatically:
- Builds programs with verifiable builds
- Runs comprehensive tests (unit, integration, fuzz)
- Performs security audits (cargo audit, clippy)
- Validates code formatting
- Generates security reports

## Step 1: Create GitHub Actions Workflow

```bash
# Create .github/workflows directory
mkdir -p .github/workflows

# Create workflow file
cat > .github/workflows/solana-security.yml << 'EOF'
name: Solana Security Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  SOLANA_VERSION: '2.1.0'
  ANCHOR_VERSION: '0.31.1'
  RUST_VERSION: '1.82.0'

jobs:
  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: clippy, rustfmt

      - name: Cache Cargo dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Install Solana
        run: |
          sh -c "$(curl -sSfL https://release.solana.com/v${{ env.SOLANA_VERSION }}/install)"
          echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH

      - name: Install Anchor
        run: |
          cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked

      - name: Format Check
        run: cargo fmt --all -- --check

      - name: Clippy Security Lints
        run: |
          cargo clippy --all-targets --all-features -- \
            -W clippy::all \
            -W clippy::pedantic \
            -W clippy::unwrap_used \
            -W clippy::expect_used \
            -W clippy::arithmetic_side_effects \
            -D warnings

      - name: Cargo Audit
        run: |
          cargo install cargo-audit
          cargo audit

      - name: Build Programs
        run: anchor build

      - name: Run Tests
        run: |
          # Unit tests
          cargo test
          # Integration tests
          anchor test --skip-deploy

      - name: Security Report
        if: always()
        run: |
          echo "## Security Audit Report" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Format check passed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Clippy security lints passed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Cargo audit passed" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ All tests passed" >> $GITHUB_STEP_SUMMARY

  verifiable-build:
    name: Verifiable Build
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Install Anchor
        run: |
          cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked

      - name: Verifiable Build
        run: anchor build --verifiable

      - name: Upload Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: verifiable-build
          path: |
            target/deploy/*.so
            target/idl/*.json

  fuzz-testing:
    name: Fuzz Testing
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Install Trident
        run: cargo install trident-cli

      - name: Run Fuzz Tests
        run: |
          cd trident-tests
          trident fuzz run --timeout 300
        timeout-minutes: 10
        continue-on-error: true

      - name: Upload Fuzz Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-results
          path: trident-tests/hfuzz_workspace/
EOF

echo "✅ GitHub Actions workflow created: .github/workflows/solana-security.yml"
```

## Step 2: Create Pre-commit Hooks

```bash
# Create pre-commit hook
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/bash
set -e

echo "🔍 Running pre-commit security checks..."

# Format check
echo "📝 Checking code formatting..."
cargo fmt --all -- --check || {
    echo "❌ Format check failed. Run 'cargo fmt' to fix."
    exit 1
}

# Clippy check
echo "🔎 Running Clippy security lints..."
cargo clippy --all-targets -- \
    -W clippy::unwrap_used \
    -W clippy::expect_used \
    -W clippy::arithmetic_side_effects \
    -D warnings || {
    echo "❌ Clippy found issues. Please fix before committing."
    exit 1
}

# Quick test
if [ -f "Anchor.toml" ]; then
    echo "🧪 Running quick tests..."
    cargo test --lib || {
        echo "❌ Tests failed. Please fix before committing."
        exit 1
    }
fi

echo "✅ All pre-commit checks passed!"
EOF

# Make executable
chmod +x .git/hooks/pre-commit

echo "✅ Pre-commit hook installed"
```

## Step 3: Create Security Checklist Template

```bash
# Create pull request template
mkdir -p .github

cat > .github/PULL_REQUEST_TEMPLATE.md << 'EOF'
## Description
<!-- Describe your changes -->

## Security Checklist

### Code Quality
- [ ] Code is formatted (`car