Merge branch 'master' into palango/transfer

.github/workflows/release.yml

@@ -67,6 +67,10 @@ jobs:
     uses: ./.github/workflows/docker-publish.yml
 
   release:
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
     name: ${{ matrix.target }} (${{ matrix.runner }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 240
@@ -156,6 +160,7 @@ jobs:
             du -h "$bin" || true
             ldd "$bin" || true
             $bin --version || true
+            echo "${name}_bin_path=${bin}" >> $GITHUB_ENV
           done
 
       - name: Archive binaries
@@ -214,6 +219,15 @@ jobs:
             ${{ steps.artifacts.outputs.file_name }}
             ${{ steps.man.outputs.foundry_man }}
 
+      - name: Binaries attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            ${{ env.anvil_bin_path }}
+            ${{ env.cast_bin_path }}
+            ${{ env.chisel_bin_path }}
+            ${{ env.forge_bin_path }}
+
       # If this is a nightly release, it also updates the release
       # tagged `nightly` for compatibility with `foundryup`
       - name: Update nightly release

.github/workflows/test.yml

@@ -110,6 +110,13 @@ jobs:
           cache-on-failure: true
       - run: cargo hack check
 
+  deny:
+    uses: ithacaxyz/ci/.github/workflows/deny.yml@main
+    with:
+      # Clear out arguments to not pass `--all-features` to `cargo deny`.
+      # Many crates have an `openssl` feature which enables banned dependencies.
+      deny-flags: ""
+
   ci-success:
     runs-on: ubuntu-latest
     if: always()
@@ -122,6 +129,7 @@ jobs:
       - rustfmt
       - forge-fmt
       - crate-checks
+      - deny
     timeout-minutes: 30
     steps:
       - name: Decide whether the needed jobs succeeded or failed