Changed config to support V8 envs #152

br41nlet · 2024-10-04T10:29:19Z

Note

Medium Risk
Touches core configuration/constants (network IDs, contracts, gas defaults) that can affect runtime behavior across environments, and introduces CI automation that may unexpectedly merge or fail builds if misconfigured.

Overview
Updates repository tooling and docs: adds .env.example, expands .gitignore, tweaks README.md formatting and points the demo link to v8/develop.

Refactors configuration/constants for v8 by removing the root constants.js (CommonJS) and introducing constants/constants.js (ESM) plus constants/index.js/constants/index.cjs exports; constants are updated/expanded (new chain IDs, updated RPC/contract addresses, new paranet/gas/fee-related settings, and larger MAX_FILE_SIZE).

Adds GitHub Actions workflows to automatically merge v8/develop into Test_Publish_Query and to fail CI when package-lock.json is missing/out-of-sync via npm ci --dry-run.

^{Written by Cursor Bugbot for commit b4af128. This will update automatically on new commits. Configure here.}

8.0.0+001 release - Gnosis gas price fix

…sis-gas-price

Fix blockchain default prices

…tibility V8 - allowance backwards compatibility

…se-allowance-and-demo-fix

…ectionAllowance

…mo-fix Decrease allowance and demo fix

Updated publish finality

cursor · 2025-12-16T14:27:26Z

constants/index.cjs

+    BLOCKCHAIN_IDS.NEUROWEB_MAINNET,
+    BLOCKCHAIN_IDS.HARDHAT_1,
+    BLOCKCHAIN_IDS.HARDHAT_2,
+];


Bug: Orphaned array expression creates dead code

An array literal is created with blockchain IDs but never assigned to a variable or exported. This appears to be incomplete code that was meant to be NEUROWEB_INCENTIVE_TYPE_CHAINS, matching the equivalent export in constants/constants.js. The array expression evaluates but has no effect, suggesting this was accidentally committed or incompletely implemented.

cursor · 2025-12-16T14:27:26Z

.github/workflows/auto-merge-main-to-Test_Publish_Query.yml

+
+      - name: Merge v8/develop into Test_Publish_Query
+        run: |
+          git merge origin/v8/develop --no-edit || echo "Merge failed but continuing"


Bug: Workflow silently masks merge failures before pushing

The merge command uses || echo "Merge failed but continuing" which causes the step to succeed even when the merge fails. The subsequent push step then executes, but since HEAD hasn't changed (due to the failed merge), nothing meaningful is pushed. The workflow reports success despite failing to actually merge the branches, which could mislead teams into thinking branches are synchronized when they aren't.

…ange-and-only-buffer-multiply percentile 80, bufferPercent multiply

cursor · 2025-12-17T15:31:08Z

.env.example

@@ -0,0 +1 @@
+PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80


Bug: Example file includes real private key

.env.example contains a concrete PRIVATE_KEY value. Even if intended for local Hardhat usage, it’s easy for users/CI to copy it into .env and accidentally reuse a known key outside local testing, leading to compromised funds or account control.

cursor · 2025-12-17T15:31:08Z

constants/index.js

@@ -0,0 +1,3 @@
+import { BLOCKCHAIN_IDS } from './constants.js';
+
+export { BLOCKCHAIN_IDS };


Bug: Public constants export is incomplete

package.json exposes ./constants, but constants/index.js/constants/index.cjs only export BLOCKCHAIN_IDS even though constants/constants.js defines many other configuration constants. This makes dkg.js/constants unusable for expected config values and can break consumers relying on exported constants beyond BLOCKCHAIN_IDS.

Additional Locations (1)

constants/index.cjs#L1-L26

8.2.2

github-advanced-security · 2025-12-17T21:59:56Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

.github/workflows/auto-merge-main-to-Test_Publish_Query.yml

+    if: github.event.pull_request.merged == true || github.event_name == 'push'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout target branch (Test_Publish_Query)
+        uses: actions/checkout@v3
+        with:
+          ref: Test_Publish_Query
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Git identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch latest v8/develop
+        run: git fetch origin v8/develop
+
+      - name: Merge v8/develop into Test_Publish_Query
+        run: |
+          git merge origin/v8/develop --no-edit || echo "Merge failed but continuing"
+
+      - name: Push updated branch
+        run: git push origin HEAD:Test_Publish_Query


To fix the issue, an explicit permissions block should be added to either the root of the workflow or to the individual job in the workflow YAML file. Since this workflow pushes commits to a branch (git push) and performs merges, it requires contents: write permission for repository contents (code, branches). The safest and most maintainable fix is to add a permissions block at the root of the YAML file (below name: and before on:), giving contents: write. This immediately clarifies what the workflow can do, prevents privilege escalation should defaults change, and adheres to GitHub's security guidelines.

Implementation Steps:

Edit .github/workflows/auto-merge-main-to-Test_Publish_Query.yml.

Insert the following after the name: line (line 1), before the on: block:
permissions: contents: write

…e keeping create wrapper

Add EIP-1559 gas mode, nonce reservation, and exposed asset creation phases Bump to 8.2.3

add package lock github actions check

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2026-01-28T11:49:30Z

constants/constants.js

+};
+
+export const DEFAULT_PROXIMITY_SCORE_FUNCTIONS_PAIR_IDS = {
+    development: { 'hardhat1:31337': 2, 'hardhat2:31337': 2, 'otp:2043': 2 },


Inconsistent blockchain config between related constants

Medium Severity

DEFAULT_PROXIMITY_SCORE_FUNCTIONS_PAIR_IDS.development includes 'otp:2043': 2, but BLOCKCHAINS.development no longer contains 'otp:2043' (it was removed in this commit). This creates an inconsistency where code looking up proximity score functions for development may expect otp:2043 to be a valid development blockchain, but it won't be found in BLOCKCHAINS.development.

Additional Locations (1)

constants/constants.js#L33-L43

update package-lock test

…led-without-sufficient-TRAC

…ufficient-TRAC Fix for approve called without sufficient trac

br41nlet self-assigned this Oct 4, 2024

Mihajlo-Pavlovic approved these changes Oct 4, 2024

View reviewed changes

brkagithub and others added 28 commits December 26, 2024 16:08

PR feedback

a701d09

Run build

198a731

Merge pull request #210 from OriginTrail/fix/gnosis-gas-price

a1e019d

8.0.0+001 release - Gnosis gas price fix

version bump

b71d768

correct version for npm

5d94b7c

Change defaults for other blockchains, fix defaulting

00a8886

merge

d9bca33

Merge remote-tracking branch 'origin/v8/kcs-integration' into fix/gno…

8611005

…sis-gas-price

Bump verison, build again, fix typos

ac801ae

Merge pull request #211 from OriginTrail/fix/gnosis-gas-price

4be5dea

Fix blockchain default prices

Implement get/increase allowance for new contracts

e168965

Merge pull request #212 from OriginTrail/v8/allowance-backwards-compa…

ad287e2

…tibility V8 - allowance backwards compatibility

Add validation for signatures

2ddb486

add signature validaton code

53a2289

Fix decrease allowance issue

89fc850

Fixed demo.js

dd74aaa

Changeg constant name

129ece2

Merge remote-tracking branch 'origin/v8/updating-demo' into v8/decrea…

b25e108

…se-allowance-and-demo-fix

Add dotenv adn fix demo

1ce759f

Add development pub key

3dc61fc

PR suggesstions

e2bcd2b

Capitalize constants

bdf7f7c

remove knowledgeCollectionAddress as a param of increaseKnowledgeColl…

daa1839

…ectionAllowance

Bump version num

5237e10

Merge pull request #215 from OriginTrail/v8/decrease-allowance-and-de…

86dd523

…mo-fix Decrease allowance and demo fix

Apdated publish finality

c5cf29e

Merge pull request #216 from OriginTrail/v8/adding-publish-finality

7d4422b

Updated publish finality

Changes contract names

5916555

cursor bot reviewed Dec 16, 2025

View reviewed changes

MilanKomsa and others added 5 commits December 17, 2025 13:24

percentile 80, bufferPercent multiply

7435a82

variable priorityFeePercentile

a5ad0a4

80 percentile fallback

827f326

fix fallback applyGasPriceBuffer

0e6a648

Merge pull request #267 from OriginTrail/patch/percentile-constant-ch…

53d7f99

…ange-and-only-buffer-multiply percentile 80, bufferPercent multiply

cursor bot reviewed Dec 17, 2025

View reviewed changes

MilanKomsa and others added 2 commits December 17, 2025 16:31

8.2.2

c9516b4

Merge pull request #268 from OriginTrail/version-bump

55a57f7

8.2.2

github-advanced-security bot found potential problems Dec 17, 2025

View reviewed changes

OTLegend and others added 10 commits December 22, 2025 13:07

[feature] Split asset creation into publish/mint/finalize phases whil…

940d3ac

…e keeping create wrapper

Add EIP-1559 gas mode toggle and nonce reservation”

21fd410

[fix] Clarify gas fee fallbacks and validate publish finality UAL

8ca834e

Normalize gas mode handling and record actual gas prices

51cb952

8.2.3

82655b1

Merge pull request #269 from OriginTrail/feature-split-asset-crate

4327d03

Add EIP-1559 gas mode, nonce reservation, and exposed asset creation phases Bump to 8.2.3

add package lock github actions check

668e0ad

improve pakcage lock check

331965b

fix bugbot issue

a17ac07

Merge pull request #270 from OriginTrail/package-lock-check

99c513e

add package lock github actions check

cursor bot reviewed Jan 28, 2026

View reviewed changes

Bojan131 and others added 8 commits February 9, 2026 12:31

update package-lock test

091bcbe

update package-lock

28d5a4d

update node version

4030151

Merge pull request #271 from OriginTrail/package-lock-check

a09f3dc

update package-lock test

fix

761c17f

Merge remote-tracking branch 'origin/v8/develop' into fix/approve-cal…

f3acdf6

…led-without-sufficient-TRAC

8.2.4

7c4f437

Merge pull request #272 from OriginTrail/fix/approve-called-without-s…

b4af128

…ufficient-TRAC Fix for approve called without sufficient trac

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Changed config to support V8 envs #152

Changed config to support V8 envs #152

Uh oh!

br41nlet commented Oct 4, 2024 •

edited by cursor bot

Loading

Uh oh!

cursor bot Dec 16, 2025

Uh oh!

cursor bot Dec 16, 2025

Uh oh!

cursor bot Dec 17, 2025

Uh oh!

cursor bot Dec 17, 2025

Uh oh!

github-advanced-security bot commented Dec 17, 2025

Uh oh!

Check warning

Copilot Autofix

Implementation Steps:

cursor bot left a comment

Uh oh!

cursor bot Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

		@@ -0,0 +1 @@
		PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80

		@@ -0,0 +1,3 @@
		import { BLOCKCHAIN_IDS } from './constants.js';

		export { BLOCKCHAIN_IDS };

@@ -1,4 +1,6 @@
             name: Auto Merge v8/develop into Test_Publish_Query
+            permissions:
+              contents: write
             on:
               push:

Changed config to support V8 envs #152

Are you sure you want to change the base?

Changed config to support V8 envs #152

Uh oh!

Conversation

br41nlet commented Oct 4, 2024 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Dec 16, 2025

Choose a reason for hiding this comment

Bug: Orphaned array expression creates dead code

Uh oh!

cursor bot Dec 16, 2025

Choose a reason for hiding this comment

Bug: Workflow silently masks merge failures before pushing

Uh oh!

cursor bot Dec 17, 2025

Choose a reason for hiding this comment

Bug: Example file includes real private key

Uh oh!

cursor bot Dec 17, 2025

Choose a reason for hiding this comment

Bug: Public constants export is incomplete

Uh oh!

github-advanced-security bot commented Dec 17, 2025

Uh oh!

Check warning

Copilot Autofix

Implementation Steps:

cursor bot left a comment

Choose a reason for hiding this comment

This PR is being reviewed by Cursor Bugbot

Uh oh!

cursor bot Jan 28, 2026

Choose a reason for hiding this comment

Inconsistent blockchain config between related constants

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

br41nlet commented Oct 4, 2024 •

edited by cursor bot

Loading