chore: setup caracal

[tserg]

Resolves #389.

[tserg]

Marked as ready to test CI

[milancermak]

Nice, it runs now! The reporting is a little meh, since we have to check the output every time right?

Should we be addressing the findings? There's one high impact:

 felt252-overflow Impact: High Confidence: Medium
The function aura::utils::types::StoreYangRedistribution::read uses the felt252 operation felt252_sub([62], [63]) -> ([64]), which is not overflow safe

[tserg]

Nice, it runs now! The reporting is a little meh, since we have to check the output every time right?

Yes, and it looks like there can be quite a number of false positives, although there is no other alternative at the moment.

Should we be addressing the findings? There's one high impact:

 felt252-overflow Impact: High Confidence: Medium
The function aura::utils::types::StoreYangRedistribution::read uses the felt252 operation felt252_sub([62], [63]) -> ([64]), which is not overflow safe

Honestly, I am not sure what to make of this finding, whether it is a false positive and whether it is within our means to fix it. My best guess is that it relates to the corelib's implementation of the Store trait since the YangRedistribution type itself does not have a member of felt252 type.

[tserg]

btw, this depends on #399.

[milancermak]

My best guess is that it relates to the corelib's implementation of the Store trait since the YangRedistribution type itself does not have a member of felt252 type.

Seems like it, but then there's no sub operation in the derived Store impl, so not quite sure where this is coming from. Might investigate more later after the migration. For now, we can merge (once the dependencies are resolved).

[milancermak]

Weird error. caracal detect . works for me locally

[tserg]

Weird error. caracal detect . works for me locally

There were some changes to Scarb in the nightly release yesterday that broke this CI. I have filed a PR but it will need to wait for Caracal to be bumped to the next Scarb release after v0.7.0 (unless we build Caracal from source).

[milancermak]

Good job figuring out the root cause 👏

[milancermak]

caracal 0.2.2 was just released a couple of hours 🎉

[milancermak]

If we're very bored we could write some parser of the caracal output to summarize it and either post it to the PR as a comment or only count the number of high impact findings and make it fail then. But I also think the tool will improve with sth similar.