CI gate

Block a risky upgrade in the pipeline that builds it.

How it works

tidemark diff exits with code 2 when the risk reaches --fail-on (default high). Use --fail-on medium to also stop on a new instruction handler or indirect call. An unknown level is a usage error (exit 1), never a silent pass.

GitHub Actions

yaml

- name: Review the upgrade against what is deployed
  run: |
    cargo install --git https://github.com/IIITManjeet/Tidemark tidemark-cli
    tidemark fetch $PROGRAM_ID --rpc $RPC -o deployed.so
    tidemark diff deployed.so target/deploy/my_program.so --json tidemark.json --fail-on high

Keep tidemark.json as a build artifact; its verdict hash is the one reviewers attest on chain. Add --cache .tidemark-cache to skip re-reviewing identical pairs, but never restore that folder from untrusted pull requests.

Web app

Risk rules