Skip to content

sdk%feat(doc): introduce Zensical-based documentation site, WASM-based demos, GitHub Pages workflow #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kwvg merged 16 commits into from
Jun 18, 2026
Merged

sdk%feat(doc): introduce Zensical-based documentation site, WASM-based demos, GitHub Pages workflow #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
a6241b6
sdk%feat(lint): add markdown linter, fix lints, add doc corrections
kwvg Jun 18, 2026
c671bfb
primitives%fix(serde): use no_std-safe rounding in amount deserializer
kwvg Jun 15, 2026
2f95532
sdk%doc: clarify no_std + alloc as the baseline
kwvg Jun 15, 2026
c9647d1
sdk%doc(zen): add Zensical scaffold and landing page
kwvg Jun 18, 2026
b5b781b
sdk%refac(contrib): hoist shared helpers to top-level contrib
kwvg Jun 13, 2026
0f93de9
sdk%doc(zen): add documentation build pipeline
kwvg Jun 15, 2026
9cb7b88
sdk%doc(zen): add WASM packaging to build pipeline
kwvg Jun 18, 2026
c1458a7
sdk%doc(zen): add block and transaction parser WASM crate
kwvg Jun 18, 2026
947f3b1
sdk%ci: adjust lint infra to support multiple workspaces
kwvg Jun 15, 2026
ca9df9b
sdk%fix(codeql): consolidate `fileRelPath` into files.qll, fix regex
kwvg Jun 14, 2026
9fda4d6
sdk%feat(lint): adjust ESLint config to include `docs/`
kwvg Jun 13, 2026
fe8f183
sdk%doc(zen): wire parser demo into Zensical site
kwvg Jun 18, 2026
784d6a7
sdk%doc(zen): add genesis solver WASM crate
kwvg Jun 14, 2026
c2da295
sdk%doc(zen): wire genesis solver into Zensical site
kwvg Jun 18, 2026
4ac7c8b
sdk%doc(zen): add JS minification to build pipeline
kwvg Jun 14, 2026
5663de4
sdk%ci: add GitHub Pages deployment workflow
kwvg Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/workflows/build_msrv.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@ jobs:

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@1.85.0
with:
components: rustfmt

- name: Set up Node.js
uses: actions/setup-node@v5
Expand Down Expand Up @@ -65,7 +67,7 @@ jobs:
path: |
~/.cargo/registry
~/.cargo/git
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
key: cargo-deps-${{ hashFiles('Cargo.lock', 'contrib/samples/Cargo.lock') }}
restore-keys: cargo-deps-

- name: Restore build artifacts
Expand All @@ -83,7 +85,9 @@ jobs:
key: codeql-packs-${{ hashFiles('contrib/codeql/codeql-pack.lock.yml') }}

- name: Run linters
run: python3 contrib/lint/all_lint.py
run: python3 contrib/lint_all.py
env:
RUSTUP_TOOLCHAIN: 1.85.0

- name: Check PR commit messages
if: github.event_name == 'pull_request'
Expand Down Expand Up @@ -121,7 +125,7 @@ jobs:
path: |
~/.cargo/registry
~/.cargo/git
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
key: cargo-deps-${{ hashFiles('Cargo.lock', 'contrib/samples/Cargo.lock') }}
restore-keys: cargo-deps-

- name: Manage build artifacts
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/build_nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:
path: |
~/.cargo/registry
~/.cargo/git
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
key: cargo-deps-${{ hashFiles('Cargo.lock', 'contrib/samples/Cargo.lock') }}
restore-keys: cargo-deps-

- name: Manage build artifacts
Expand All @@ -71,8 +71,8 @@ jobs:
restore-keys: |
cargo-build-nightly-${{ runner.os }}-${{ runner.arch }}-${{ inputs.package }}-

- name: Format package
run: cargo fmt -p ${{ inputs.package }} --check
- name: Check formatting
run: python contrib/lint/lint_rust.py

- name: Lint package
run: cargo clippy -p ${{ inputs.package }} --features ${{ inputs.features }} --tests -- -D warnings
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build_stable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ jobs:
path: |
~/.cargo/registry
~/.cargo/git
key: cargo-deps-${{ hashFiles('Cargo.lock') }}
key: cargo-deps-${{ hashFiles('Cargo.lock', 'contrib/samples/Cargo.lock') }}
restore-keys: cargo-deps-

- name: Manage build artifacts
Expand Down
77 changes: 77 additions & 0 deletions .github/workflows/pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
name: Deploy docs

on:
push:
branches: [develop]
workflow_dispatch:

concurrency:
group: pages
cancel-in-progress: true

permissions:
contents: read

jobs:
build:
name: Build site
runs-on: ubuntu-24.04-arm

steps:
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 1
Comment on lines +21 to +24

@coderabbitai coderabbitai Bot Jun 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

find . -name "pages.yml" -path "*/.github/workflows/*" | head -5

Repository: dashpay/base-sdk

Length of output: 90

🏁 Script executed:

cat -n ./.github/workflows/pages.yml

Repository: dashpay/base-sdk

Length of output: 2265

🌐 Web query:

GitHub Actions security best practices pin commit SHA persist-credentials

💡 Result:

Securing GitHub Actions workflows involves two critical practices: pinning actions to commit SHAs to ensure immutability [1][2] and explicitly managing credential persistence to prevent unauthorized access [3][4]. Pinning Actions to Commit SHAs Pinning an action to a full-length commit SHA is the only way to ensure the action is an immutable release [1]. Unlike tags or branches, which are mutable and can be updated or redirected by a malicious actor to compromise your workflow [2][5], a commit SHA is immutable once a commit exists [2]. - Implementation: Reference the full-length SHA in your workflow file. It is recommended to include the version tag as a comment for readability [6][5]. - uses: actions/checkout@3df4ab1 # v4.0.0 - Governance: GitHub supports organization-level policies that enforce SHA pinning for all actions [7][2]. If enabled, any workflow using a tag or branch will fail [2][6]. - Automation: Use tools like Dependabot or Renovate (specifically the helpers:pinGitHubActionDigests preset) to automate updates to your pinned SHAs, ensuring you benefit from security patches without sacrificing immutability [2][6]. Managing Credential Persistence The actions/checkout action defaults to persist-credentials: true, which stores the GITHUB_TOKEN (or other credentials) in the runner's local Git configuration [8][3]. This exposes the token to every subsequent step in the job, increasing the risk of credential leakage if a malicious action or script is executed [3][4][9]. - Implementation: Explicitly set persist-credentials: false in your checkout steps unless your workflow specifically requires pushing commits back to the repository [3][4]. - uses: actions/checkout@v4 with: persist-credentials: false - Security Rationale: Setting this to false prevents the token from being persisted in the Git configuration file, thereby limiting the risk of it being accessed by third-party actions, logged, or accidentally included in build artifacts [3][10]. If your workflow must push changes, use a scoped GITHUB_TOKEN with the minimum required permissions [3][11]. Additional Best Practices - Principle of Least Privilege: Always set the default permissions for the GITHUB_TOKEN to read-only at the workflow or job level and grant specific write access only when necessary [12][11]. - Automated Auditing: Use tools like Zizmor or similar linters to audit your workflows for missing SHA pins and unsafe credential configurations [6][3][10].

Citations:

Pin third-party GitHub Actions to immutable commit SHAs and disable credential persistence.

Lines 22, 27, 36, 44, 56, and 76 use mutable version tags (@v*/@master), which creates supply-chain vulnerabilities. Pin each action to its full commit SHA instead. Additionally, add persist-credentials: false to the checkout step (lines 21-24) since this workflow performs no git push or authentication operations.

Suggested hardening diff 
      - name: Checkout
        uses: actions/checkout@v6
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 1
+          persist-credentials: false

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@<pinned-commit-sha>

      - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@<pinned-commit-sha>

      - name: Manage cargo registry
-        uses: actions/cache@v5
+        uses: actions/cache@<pinned-commit-sha>

      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@<pinned-commit-sha>

      - name: Deploy to GitHub Pages
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@<pinned-commit-sha>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 1
- name: Checkout
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
with:
fetch-depth: 1
persist-credentials: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 21-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pages.yml around lines 21 - 24, Replace all mutable GitHub
Actions version references with immutable full commit SHAs to eliminate
supply-chain vulnerabilities. Locate each actions/ reference that uses `@v`* or
`@master` tags (such as actions/checkout, and any other third-party actions), and
pin each to its corresponding full commit SHA instead. Additionally, add
persist-credentials: false to the checkout action step since this workflow does
not perform any git push operations or require credential persistence.

Source: Linters/SAST tools

persist-credentials: false

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@master
with:
toolchain: nightly-2026-02-01
targets: wasm32-unknown-unknown

- name: Install wasm-pack
run: cargo install wasm-pack@0.15.0

Comment thread
coderabbitai[bot] marked this conversation as resolved.
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version-file: pyproject.toml

- name: Install Python dependencies
run: pip install ".[dev]"

- name: Manage cargo registry
uses: actions/cache@v5
with:
path: |
~/.cargo/registry
~/.cargo/git
key: cargo-deps-${{ hashFiles('Cargo.lock', 'contrib/samples/Cargo.lock') }}
restore-keys: cargo-deps-

- name: Build documentation
run: python contrib/build_docs.py build

- name: Upload Pages artifact
uses: actions/upload-pages-artifact@v5
with:
path: public

deploy:
name: Deploy to GitHub Pages
needs: build
runs-on: ubuntu-24.04-arm

permissions:
pages: write
id-token: write

environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}

steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v5
13 changes: 13 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,3 +178,16 @@ cython_debug/
# PyPI configuration file
.pypirc

# Playwright browser binaries and test artifacts
.playwright/
**/.playwright/
.playwright-cli/
**/playwright-report/
**/test-results/
**/e2e/

# Built site
public/

# WASM builds
*.wasm
Expand Down
3 changes: 2 additions & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ use some_external_crate;

### Directory layout

```
```text
pkgs/<name>/
bench/
corpus/
Expand All @@ -103,6 +103,7 @@ pkgs/<name>/
```

`Cargo.toml` must set:

```toml
[package]
name = "dash-<name>"
Expand Down
8 changes: 8 additions & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

29 changes: 16 additions & 13 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
![Minimum Supported Rust Version](https://img.shields.io/badge/v1.85.0-msrv?style=flat&logo=rust&label=MSRV&color=orange)

> [!WARNING]
>
> This SDK is in early stages of development and different crates may have different levels of conformance
> and testing rigour. The completeness of one crate does not imply the completeness of others.
>
>
> This SDK is in early stages of development and different crates may have different levels of conformance and
> testing rigour. The completeness of one crate does not imply the completeness of others.
>
> As with any alternate implementation, unintended deviations from the reference implementation (i.e.
> [Dash Core](https://github.com/dashpay/dash)) are possible and must be accounted for as a risk when building
> on this SDK. If requirements demand strict conformance guarantees, it is recommended to interface with Dash Core
> through [RPC](https://docs.dash.org/en/22.0.0/docs/core/api/remote-procedure-calls.html),
> [REST](https://docs.dash.org/en/22.0.0/docs/core/api/http-rest.html) or
> [ZMQ](https://docs.dash.org/en/22.0.0/docs/core/api/zmq.html) instead.
> [Dash Core](https://github.com/dashpay/dash)) are possible and must be accounted for as a risk when building on
> this SDK. If requirements demand strict conformance guarantees, it is recommended to interface with Dash Core
> through [RPC](https://docs.dash.org/en/stable/docs/core/api/remote-procedure-calls.html),
> [REST](https://docs.dash.org/en/stable/docs/core/api/http-rest.html) or
> [ZMQ](https://docs.dash.org/en/stable/docs/core/api/zmq.html) instead.

`base-sdk` is a parsing and stateless verification SDK for Dash's layer 1 blockchain.

Expand Down Expand Up @@ -43,13 +43,14 @@ graph LR
script[dash-script]
pow[dash-pow]
pkc[dash-pkc]
primitives[dash-primitives]
end
subgraph " "
primitives[dash-primitives]
params[dash-params]
p2p_core[dash-p2p-core]
end

types --> num
types --> script
types --> pkc
types --> primitives
Expand All @@ -74,10 +75,11 @@ All crates support these standard features:

| Feature | Description | Crates |
|---------|-------------|--------|
| `default` | `no_std` + `alloc` (always enabled) | _All_ |
| _(baseline)_ | `no_std` + `alloc`, always available | _All_ |
| `std` | Enable standard library support | _All_ |
| `serde` | Enable serde serialization (where applicable) | [num](./pkgs/num), [p2p-core](./pkgs/p2p_core), [pkc](./pkgs/pkc), [primitives](./pkgs/primitives), [script](./pkgs/script), [types](./pkgs/types) |
| `full` | Enables all non-conflicting features | _All_ |
| `_internal` | Access to package internals, reserved for testing and benchmarks. **Not part of API contract.** | _All_ |

Specific crates define additional features:

Expand All @@ -86,10 +88,11 @@ Specific crates define additional features:
| `k256` | Enable secp256k1 support | [pkc](./pkgs/pkc) |
| `bls_ietf` | Enable standard (IETF) BLS support | [pkc](./pkgs/pkc) |
| `bls_chia` | Enable legacy (Chia) BLS support | [pkc](./pkgs/pkc) |
| `_internal` | Access to package internals, reserved for testing and benchmarks. **Not part of API contract.** | [pow](./pkgs/pow) |
| `aes_hw` | Enable hardware-accelerated AES on supported platforms | [pow](./pkgs/pow) |
| `simd` | Use SIMD backends (requires nightly) | [pow](./pkgs/pow) |

## License

Copyright &copy; 2026-present, The Dash Core developers. See the accompanying file [LICENSE](./LICENSE) or https://opensource.org/license/MIT
Copyright &copy; 2026-present, The Dash Core developers. See the accompanying file [LICENSE](./LICENSE) or
<!-- pyml disable-next-line no-bare-urls -->
https://opensource.org/license/MIT
1 change: 1 addition & 0 deletions contrib/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
"""Contributor tooling packages."""
Loading
Loading