
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
noir-gates-diff
Advanced tools
Add a workflow (.github/workflows/noir-gas-diff.yml
):
name: Report gates diff
on:
push:
branches:
- main
pull_request:
jobs:
compare_gas_reports:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
submodules: recursive
- name: Install Nargo
uses: noir-lang/noirup@v0.1.2
with:
toolchain: 0.11.0
# Add any step generating a gas report to a temporary file named gasreport.ansi. For example:
- name: Generate gates report
run: nargo info --json > gasreport.json # <- this file name should be unique in your repository!
- name: Compare gates reports
uses: TomAFrench/noir-gates-diff@v0.0.1
with:
summaryQuantile: 0.9 # only display the 10% most significant gas diffs in the summary (defaults to 20%)
id: gates_diff
- name: Add gates diff to sticky comment
if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
uses: marocchino/sticky-pull-request-comment@v2
with:
# delete the comment in case changes no longer impact gas costs
delete: ${{ !steps.gas_diff.outputs.markdown }}
message: ${{ steps.gas_diff.outputs.markdown }}
:information_source: An error will appear at first run!
🔴 Error: No workflow run found with an artifact named "main.gasreport.json"
As the action is expecting a comparative file stored on the base branch and cannot find it (because the action never ran on the target branch and thus has never uploaded any gas report)
Everytime somebody opens a Pull Request, the action expects Noir's nargo
to generate a gates report to a temporary file (named gatereport.json
by default).
Once generated, the action will fetch the comparative gates report stored as an artifact from previous runs; parse & compare them, storing the results in the action's outputs as shell and as markdown.
You can then do whatever you want with the results!
Our recommandation: Automatically submit a sticky comment displaying the gas diff!
report
{string}This should correspond to the path of a file where the output of forge's gas report has been logged. Only necessary when generating multiple gas reports on the same repository.
⚠️ Make sure this file uniquely identifies a gas report, to avoid messing up with a gas report of another workflow on the same repository!
Defaults to: gasreport.ansi
base
{string}The gas diff reference branch name, used to fetch the previous gas report to compare the freshly generated gas report to.
Defaults to: ${{ github.base_ref || github.ref_name }}
head
{string}The gas diff target branch name, used to upload the freshly generated gas report.
Defaults to: ${{ github.head_ref || github.ref_name }}
token
{string}The github token allowing the action to upload and download gas reports generated by foundry. You should not need to customize this, as the action already has access to the default Github Action token.
Defaults to: ${{ github.token }}
header
{string}The top section displayed in the markdown output. Can be used to identify multiple gas diffs in the same PR or add metadata/information to the markdown output.
Defaults to:
# Changes to circuit sizes
summaryQuantile
{number}The quantile threshold to filter avg gas cost diffs to display in the summary top section.
Defaults to: 0.8
Library gates reports
Nargo does not generate library gates reports. You need to wrap their usage in a contract calling the library to be able to compare gas costs of calling the library.
This repository is maintained independently from Nargo and may not work as expected with all versions of nargo
.
FAQs
Github Action reporting gates diff from Nargo info reports
The npm package noir-gates-diff receives a total of 30 weekly downloads. As such, noir-gates-diff popularity was classified as not popular.
We found that noir-gates-diff demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.