code/yieldomega

Watch

Fork 0

fix(scripts): local scope in yieldomega_anvil_deploy_dev (#289) #419

Merged

PlasticDigits merged 1 commit from cursor/anvil-deploy-local-scope-30ac into main

2026-06-03 14:07:58 +00:00

PlasticDigits commented

2026-06-03 13:59:45 +00:00

(Migrated from gitlab.com)

Summary

Fixes #289: yieldomega_anvil_deploy_dev in scripts/lib/anvil_deploy_dev.sh assigned TA, PV, DOUB, CRED, and Kumbaya vars without local, clobbering the caller shell (e.g. false failures comparing DOUB across two deploys in verify-evm-dev-wallet-seed-anvil.sh).

What changed

Deploy helper uses local for all internal address assignments; seeding uses local copies.
Explicit export API:
- yieldomega_export_deploy_addrs_from_log "${DEPLOY_LOG}" "${ROOT}" → TA, PV, AV, RR, DOUB, CRED, CL8Y
- yieldomega_export_kumbaya_addrs_from_log "${DEPLOY_LOG}" when YIELDOMEGA_DEPLOY_KUMBAYA=1
Kumbaya fixture log appended to DEPLOY_LOG for re-export.
All yieldomega_anvil_deploy_dev callers updated.
Hermetic scripts/test-anvil-deploy-caller-scope.sh; invariants INV-DEPLOY-289-*; docs in e2e-anvil.md.

Acceptance checklist

Criterion	Verification	Result
Two deploy calls in one shell do not change caller vars unless explicit export	`bash scripts/verify-evm-dev-wallet-seed-anvil.sh`	PASS
`bash scripts/e2e-anvil.sh` (6 Playwright specs)	Cloud VM run	PASS (6/6)
`bash scripts/verify-evm-dev-wallet-seed-anvil.sh`	Cloud VM run	PASS
Grep callers updated	All `yieldomega_anvil_deploy_dev` sites call export API	PASS
Hermetic export API	`bash scripts/test-anvil-deploy-caller-scope.sh`	PASS

Third-party verification

export PATH="$HOME/.foundry/bin:$PATH"
bash scripts/test-anvil-deploy-caller-scope.sh
bash scripts/verify-evm-dev-wallet-seed-anvil.sh
bash scripts/e2e-anvil.sh

Issue #289 remains open until this MR merges.

## Summary Fixes #289: `yieldomega_anvil_deploy_dev` in [`scripts/lib/anvil_deploy_dev.sh`](scripts/lib/anvil_deploy_dev.sh) assigned `TA`, `PV`, `DOUB`, `CRED`, and Kumbaya vars without `local`, clobbering the caller shell (e.g. false failures comparing `DOUB` across two deploys in `verify-evm-dev-wallet-seed-anvil.sh`). **What changed** - Deploy helper uses `local` for all internal address assignments; seeding uses local copies. - Explicit export API: - `yieldomega_export_deploy_addrs_from_log "${DEPLOY_LOG}" "${ROOT}"` → `TA`, `PV`, `AV`, `RR`, `DOUB`, `CRED`, `CL8Y` - `yieldomega_export_kumbaya_addrs_from_log "${DEPLOY_LOG}"` when `YIELDOMEGA_DEPLOY_KUMBAYA=1` - Kumbaya fixture log appended to `DEPLOY_LOG` for re-export. - All `yieldomega_anvil_deploy_dev` callers updated. - Hermetic `scripts/test-anvil-deploy-caller-scope.sh`; invariants **`INV-DEPLOY-289-*`**; docs in [`e2e-anvil.md`](docs/testing/e2e-anvil.md#anvil-deploy-dev-caller-scope-gitlab-289). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Two deploy calls in one shell do not change caller vars unless explicit export | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | **PASS** | | `bash scripts/e2e-anvil.sh` (6 Playwright specs) | Cloud VM run | **PASS** (6/6) | | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | Cloud VM run | **PASS** | | Grep callers updated | All `yieldomega_anvil_deploy_dev` sites call export API | **PASS** | | Hermetic export API | `bash scripts/test-anvil-deploy-caller-scope.sh` | **PASS** | ## Third-party verification ```bash export PATH="$HOME/.foundry/bin:$PATH" bash scripts/test-anvil-deploy-caller-scope.sh bash scripts/verify-evm-dev-wallet-seed-anvil.sh bash scripts/e2e-anvil.sh ``` **Issue #289** remains open until this MR merges.

PlasticDigits commented

2026-06-03 13:59:53 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-03 14:04:52 +00:00

(Migrated from gitlab.com)

Security review (automated)

Reviewed commit: 823023f1054abffb5643824b0bf00e4bafe8257c
Scope: MR !419 — Anvil yieldomega_anvil_deploy_dev caller-scope fix (#289): scripts/lib/anvil_deploy_dev.sh, explicit yieldomega_export_*_from_log APIs, caller updates (e2e-anvil.sh, anvil-export-bot-env.sh, verify scripts), test-anvil-deploy-caller-scope.sh, docs/CI smoke.

Method: Diff-only review (aeb3be1 → 823023f1, 18 files). Traced deploy/log-parse/export paths; checked for injection, secret handling, authz, and production attack surfaces. No prior security-review threads on this MR.

Outcome: FINDINGS: 0 medium+ (no inline threads).

Summary

This change confines DeployDev address parsing to function-local variables and requires an explicit export from DEPLOY_LOG before callers use TA / DOUB / etc. That reduces the risk of stale or cross-deploy address confusion in local Anvil tooling (a reliability fix, not a production-facing surface).

Area	Assessment
Production / deployed services	Not in diff — no indexer, frontend API, or contract auth changes.
Shell injection	`_yieldomega_extract_addr_from_log` uses fixed label literals (`TimeArena`, `Doubloon`, …); `deploy_log` is a path read by `grep`, not interpolated into regex as user input.
Secret leakage	No new logging of `PRIVATE_KEY` / `KEY_EVM_*`; `anvil-export-bot-env.sh` still writes generated env with `umask 077`.
Log poisoning	Export trusts forge log content — same trust model as before; only affects local Anvil workflows where the operator controls `DEPLOY_LOG`.
Kumbaya vars	`yieldomega_anvil_deploy_dev` still briefly sets `KUMBAYA_*` via `yieldomega_kumbaya_extract_from_deploy_log` during deploy; callers that need them use `yieldomega_export_kumbaya_addrs_from_log` (documented). Dev-scope only; not a new medium+ issue on this diff.

Security review: no medium+ findings on this diff.

## Security review (automated) **Reviewed commit:** `823023f1054abffb5643824b0bf00e4bafe8257c` **Scope:** MR !419 — Anvil `yieldomega_anvil_deploy_dev` caller-scope fix ([#289](https://gitlab.com/PlasticDigits/yieldomega/-/issues/289)): `scripts/lib/anvil_deploy_dev.sh`, explicit `yieldomega_export_*_from_log` APIs, caller updates (`e2e-anvil.sh`, `anvil-export-bot-env.sh`, verify scripts), `test-anvil-deploy-caller-scope.sh`, docs/CI smoke. **Method:** Diff-only review (`aeb3be1` → `823023f1`, 18 files). Traced deploy/log-parse/export paths; checked for injection, secret handling, authz, and production attack surfaces. No prior security-review threads on this MR. **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Summary This change confines DeployDev address parsing to **function-local variables** and requires an **explicit export** from `DEPLOY_LOG` before callers use `TA` / `DOUB` / etc. That reduces the risk of **stale or cross-deploy address confusion** in local Anvil tooling (a reliability fix, not a production-facing surface). | Area | Assessment | |------|------------| | **Production / deployed services** | Not in diff — no indexer, frontend API, or contract auth changes. | | **Shell injection** | `_yieldomega_extract_addr_from_log` uses fixed label literals (`TimeArena`, `Doubloon`, …); `deploy_log` is a path read by `grep`, not interpolated into regex as user input. | | **Secret leakage** | No new logging of `PRIVATE_KEY` / `KEY_EVM_*`; `anvil-export-bot-env.sh` still writes generated env with `umask 077`. | | **Log poisoning** | Export trusts forge log content — same trust model as before; only affects **local Anvil** workflows where the operator controls `DEPLOY_LOG`. | | **Kumbaya vars** | `yieldomega_anvil_deploy_dev` still briefly sets `KUMBAYA_*` via `yieldomega_kumbaya_extract_from_deploy_log` during deploy; callers that need them use `yieldomega_export_kumbaya_addrs_from_log` (documented). Dev-scope only; not a new medium+ issue on this diff. | **Security review: no medium+ findings on this diff.**

PlasticDigits commented

2026-06-03 14:07:59 +00:00

(Migrated from gitlab.com)

mentioned in commit 0b2cbc0220

mentioned in commit 0b2cbc0220a156d8d62bdf4e1eb2d9f198bef329

PlasticDigits (Migrated from gitlab.com) merged commit 0b2cbc0220 into main

2026-06-03 14:07:59 +00:00

PlasticDigits commented

2026-06-08 08:45:13 +00:00

(Migrated from gitlab.com)

mentioned in commit 3bfa6ab0a4

mentioned in commit 3bfa6ab0a4a16f6b1255c1d8b790744031e1c581

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!419

No description provided.

Rows
Columns