{"id":18952242,"url":"https://github.com/step-security/foundry-toolchain","last_synced_at":"2026-01-29T23:20:03.090Z","repository":{"id":247470103,"uuid":"822973447","full_name":"step-security/foundry-toolchain","owner":"step-security","description":"GitHub action to install Foundry. Secure drop-in replacement for foundry-rs/foundry-toolchain.","archived":false,"fork":false,"pushed_at":"2026-01-26T00:34:24.000Z","size":9195,"stargazers_count":0,"open_issues_count":15,"forks_count":2,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-26T15:46:04.738Z","etag":null,"topics":["step-security-maintained-actions"],"latest_commit_sha":null,"homepage":"https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/step-security.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-07-02T07:30:27.000Z","updated_at":"2026-01-21T04:33:17.000Z","dependencies_parsed_at":"2024-08-19T09:58:59.457Z","dependency_job_id":"50d23231-a342-4d52-ac75-443572df8567","html_url":"https://github.com/step-security/foundry-toolchain","commit_stats":null,"previous_names":["step-security/foundry-toolchain"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/step-security/foundry-toolchain","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Ffoundry-toolchain","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Ffoundry-toolchain/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Ffoundry-toolchain/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Ffoundry-toolchain/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/step-security","download_url":"https://codeload.github.com/step-security/foundry-toolchain/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Ffoundry-toolchain/sbom","scorecard":{"id":1237668,"data":{"date":"2025-09-10T04:17:24Z","repo":{"name":"github.com/step-security/foundry-toolchain","commit":"0f33b42dd54256dc78d44981318d1a5c5f1c4958"},"scorecard":{"version":"v5.0.0","commit":"ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4"},"score":8.2,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is not required on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":10,"reason":"6 out of 6 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#code-review"}},{"name":"Contributors","score":6,"reason":"project has 2 contributing companies or organizations -- score normalized to 6","details":["Info: step-security contributor org/company found, ait pune contributor org/company found, "],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE-APACHE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE-APACHE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#license"}},{"name":"Maintained","score":10,"reason":"14 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  12 out of  12 GitHub-owned GitHubAction dependencies pinned","Info:   5 out of   5 third-party GitHubAction dependencies pinned","Info:   1 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":9,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 22 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#sast"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":10,"reason":"4 out of the last 4 releases have a total of 4 signed artifacts.","details":["Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/step-security/foundry-toolchain/releases/assets/252213774","Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/step-security/foundry-toolchain/releases/assets/233269636","Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/step-security/foundry-toolchain/releases/assets/187160577","Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/step-security/foundry-toolchain/releases/assets/178437893"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/actions_release.yml:18","Info: jobLevel 'actions' permission set to 'read': .github/workflows/actions_release.yml:16","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:32","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:31","Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:29","Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:30","Info: topLevel 'contents' permission set to 'read': .github/workflows/actions_release.yml:11","Warn: topLevel 'contents' permission set to 'write': .github/workflows/audit_package.yml:24","Info: topLevel 'packages' permission set to 'read': .github/workflows/audit_package.yml:26","Warn: topLevel 'contents' permission set to 'write': .github/workflows/auto_cherry_pick.yml:12","Info: topLevel 'packages' permission set to 'read': .github/workflows/auto_cherry_pick.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/check-dist.yml:16","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24","Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/guarddog.yml:10","Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:18"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-09-15T02:36:46.631Z","repository_id":247470103,"created_at":"2025-09-15T02:36:46.631Z","updated_at":"2025-09-15T02:36:46.631Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28889872,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-29T21:06:44.224Z","status":"ssl_error","status_checked_at":"2026-01-29T21:06:42.160Z","response_time":59,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["step-security-maintained-actions"],"created_at":"2024-11-08T13:32:03.189Z","updated_at":"2026-01-29T23:20:03.037Z","avatar_url":"https://github.com/step-security.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"## `foundry-toolchain` Action\n\nThis GitHub Action installs [Foundry](https://github.com/foundry-rs/foundry), the blazing fast, portable and modular\ntoolkit for Ethereum application development.\n\n### Example workflow\n\n```yml\nname: CI\n\npermissions: {}\n\non:\n  push:\n  pull_request:\n  workflow_dispatch:\n\nenv:\n  FOUNDRY_PROFILE: ci\n\njobs:\n  check:\n    name: Foundry project\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@v6\n        with:\n          persist-credentials: false\n          submodules: recursive\n\n      - name: Install Foundry\n        uses: step-security/foundry-toolchain@v1\n\n      - name: Show Forge version\n        run: forge --version\n\n      - name: Run Forge fmt\n        run: forge fmt --check\n\n      - name: Run Forge build\n        run: forge build --sizes\n\n      - name: Run Forge tests\n        run: forge test -vvv\n```\n\n### Inputs\n\n| **Name**             | **Required** | **Default**                           | **Description**                                                                                                               | **Type** |\n| -------------------- | ------------ | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | -------- |\n| `version`            | No           | `stable`                              | Version to install, e.g. `stable`, `rc`, `nightly` or any [SemVer](https://semver.org/) tag prefixed with `v` (e.g. `v1.3.6`) | string   |\n| `network`            | No           | `ethereum`                            | Network version to install, e.g. `ethereum`, `tempo`.                                                                         | string   |\n| `cache`              | No           | `true`                                | Whether to cache RPC responses or not.                                                                                        | bool     |\n| `cache-key`          | No           | `${{ github.job }}-${{ github.sha }}` | The cache key to use for caching.                                                                                             | string   |\n| `cache-restore-keys` | No           | `[${{ github.job }}-]`                | The cache keys to use for restoring the cache.                                                                                | string[] |\n\n### RPC Caching\n\nBy default, this action matches Forge's behavior and caches all RPC responses in the `~/.foundry/cache/rpc` directory.\nThis is done to speed up the tests and avoid hitting the rate limit of your RPC provider.\n\nThe logic of the caching is as follows:\n\n- Always load the latest valid cache, and always create a new one with the updated cache.\n- When there are no changes to the fork tests, the cache does not change but the key does, since the key is based on the\n  commit hash.\n- When the fork tests are changed, both the cache and the key are updated.\n\nIf you would like to disable the caching (e.g. because you want to implement your own caching mechanism), you can set\nthe `cache` input to `false`, like this:\n\n```yml\n- name: Install Foundry\n  uses: step-security/foundry-toolchain@v1\n  with:\n    cache: false\n```\n\n### Custom Cache Keys\n\nYou have the ability to define custom cache keys by utilizing the `cache-key` and `cache-restore-keys` inputs. This\nfeature is particularly beneficial when you aim to tailor the cache-sharing strategy across multiple jobs. It is\nimportant to ensure that the `cache-key` is unique for each execution to prevent conflicts and guarantee successful\ncache saving.\n\nFor instance, if you wish to utilize a shared cache between two distinct jobs, the following configuration can be\napplied:\n\n```yml\n- name: Install Foundry\n  uses: step-security/foundry-toolchain@v1\n  with:\n    cache-key: custom-seed-test-${{ github.sha }}\n    cache-restore-keys: |-\n      custom-seed-test-\n      custom-seed-\n---\n- name: Install Foundry\n  uses: step-security/foundry-toolchain@v1\n  with:\n    cache-key: custom-seed-coverage-${{ github.sha }}\n    cache-restore-keys: |-\n      custom-seed-coverage-\n      custom-seed-\n```\n\n#### Deleting Caches\n\nYou can delete caches via the GitHub Actions user interface. Just go to your repo's \"Actions\" page:\n\n```text\nhttps://github.com/\u003cOWNER\u003e/\u003cREPO\u003e/actions/caches\n```\n\nThen, locate the \"Management\" section, and click on \"Caches\". You will see a list of all of your current caches, which\nyou can delete by clicking on the trash icon.\n\nFor more detail on how to delete caches, read GitHub's docs on\n[managing caches](https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#managing-caches).\n\n#### Fuzzing\n\nNote that if you are fuzzing in your fork tests, the RPC cache strategy above will not work unless you set a\n[fuzz seed](https://book.getfoundry.sh/reference/config/testing#seed). You might also want to reduce your number of RPC\ncalls by using [Multicall](https://github.com/mds1/multicall).\n\n### Summaries\n\nYou can add the output of Forge and Cast commands to GitHub step summaries. The summaries support GitHub flavored\nMarkdown.\n\nFor example, to add the output of `forge snapshot` to a summary, you would change the snapshot step to:\n\n```yml\n- name: Run snapshot\n  run: NO_COLOR=1 forge snapshot \u003e\u003e $GITHUB_STEP_SUMMARY\n```\n\nSee the official\n[GitHub docs](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary)\nfor more information.\n\n### Building\n\nWhen opening a PR, you must build the action exactly following the below steps for CI to pass:\n\nInstall [nvm](https://github.com/nvm-sh/nvm).\n\n```console\n$ nvm install 24.9.0\n$ nvm use\n$ npm ci --ignore-scripts\n$ npm run build\n```\n\nYou **must** use the Node.js version `24.9.0` to build.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Ffoundry-toolchain","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstep-security%2Ffoundry-toolchain","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Ffoundry-toolchain/lists"}