Foundry/alert autofix 19

[Dargon789]

Motivation

Solution

PR Checklist

• Added Tests
• Added Documentation
• Breaking changes

Summary by Sourcery

Overhaul EVM coverage analysis by migrating to solar AST/HIR, enhance coverage item ordering and rendering, streamline forge coverage CLI and tests, apply bug fixes in Cheatcodes and Anvil, clean up compiler flags, bump dependencies, and improve CI workflows

New Features:

• Add single_statement_loop coverage test for edge-case branch coverage
• Add Docker Image CI workflow for building the Docker image on pushes

Bug Fixes:

• Ensure accounts are touched before state access in Cheatcodes inspector
• Add fallback mnemonic generation in Anvil command without panicking
• Handle unreachable cases in hardfork mapping to prevent unexpected panics

Enhancements:

• Rewrite EVM coverage source analysis to use solar AST and HIR, improving branch and call resolution
• Implement ordering and Display improvements for CoverageItemKind and CoverageItem, including inline source snippets
• Simplify forge coverage CLI by reusing contract instances in tests and updating prepare signature
• Remove deprecated verify flag from ProjectCompiler interface
• Adjust Anvil tracing initialization to merge node logs into the EnvFilter

Build:

• Bump alloy-hardforks and alloy-op-hardforks to 0.3.2 and add solar to the workspace

CI:

• Install cross from a specific Git revision in workflows
• Enhance GitHub workflows for release, issue creation, and Docker Image CI

Tests:

• Update coverage CLI tests to reuse contract instances and adjust expected coverage outputs
• Remove obsolete cfg guard in optimizer tests

Chores:

• Minor refactoring in test result formatting and workflow cleanup in CODEOWNERS

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
next	Ready	Preview	Comment	Oct 13, 2025 10:45am

[sourcery-ai]

Reviewer's Guide

This PR overhauls the EVM coverage pipeline by migrating the AST visitor to Solar’s AST and HIR, adds full ordering and richer formatting for coverage items, and adapts Forge’s coverage command and reporter to the new analysis. It also includes focused utility tweaks and CI improvements.

Class diagram for updated coverage analysis visitor

classDiagram
    class SourceVisitor {
        +source_id: u32
        +gcx: Gcx
        +contract_name: Arc<str>
        +branch_id: u32
        +items: Vec<CoverageItem>
        +all_lines: Vec<u32>
        +function_calls: Vec<Span>
        +function_calls_set: FxHashSet<Span>
        +new(source_id: u32, gcx: Gcx)
        +checkpoint(): SourceVisitorCheckpoint
        +restore_checkpoint(checkpoint: SourceVisitorCheckpoint)
        +visit_contract(contract: ast::ItemContract)
        +has_tests(checkpoint: SourceVisitorCheckpoint): bool
        +disambiguate_functions()
        +resolve_function_calls(hir_source_id: hir::SourceId)
        +sort()
        +push_lines()
        +push_stmt(span: Span)
        +push_item_kind(kind: CoverageItemKind, span: Span)
        +source_location_for(span: Span): SourceLocation
        +byte_range(span: Span): Range<u32>
        +line_range(span: Span): Range<u32>
        +next_branch_id(): u32
    }
    class SourceVisitorCheckpoint {
        +items: usize
        +all_lines: usize
        +function_calls: usize
    }
    class CoverageItem {
        +kind: CoverageItemKind
        +loc: SourceLocation
        +hits: u32
        +fmt_with_source(src: Option<&str>): Display
        +ord_key(): Ord
    }
    class CoverageItemKind {
        <<enum>>
        Line
        Statement
        Branch
        Function
        +ord_key(): Ord
    }
    class SourceLocation {
        +source_id: usize
        +contract_name: Arc<str>
        +bytes: Range<u32>
        +lines: Range<u32>
        +bytes(): Range<usize>
        +len(): u32
    }
    SourceVisitor --> SourceVisitorCheckpoint
    SourceVisitor --> CoverageItem
    CoverageItem --> CoverageItemKind
    CoverageItem --> SourceLocation

Loading

Class diagram for updated SourceFiles and SourceAnalysis

classDiagram
    class SourceFiles {
        +sources: HashMap<u32, PathBuf>
    }
    class SourceAnalysis {
        +new(data: &SourceFiles, output: &ProjectCompileOutput): Result<Self>
    }
    SourceAnalysis --> SourceFiles

Loading

File-Level Changes

Change	Details	Files
Refactor coverage AST visitor to use Solar AST/HIR	Renamed ContractVisitor to SourceVisitor and updated fields Introduced checkpoint/restore logic to skip test functions Collected all lines and function calls, resolving calls via HIR Added sorting, deduplication, and line-pushing phases Updated SourceAnalysis::new to drive visitor using ProjectCompileOutput	crates/evm/coverage/src/analysis.rs crates/forge/src/cmd/coverage.rs
Implement ordering and enhanced formatting for coverage items	Derived Ord/Eq for CoverageItemKind and CoverageItem Refactored Display to include optional source snippet and wrap hits Added bytes() helper to SourceLocation	crates/evm/coverage/src/lib.rs
Adapt Forge’s coverage prepare and reporter	Changed CoverageArgs::prepare to take &mut ProjectCompileOutput Lower ASTs and convert errors before analysis Mapped versioned sources by path instead of AST Updated DebugReporter to read source and print snippets for uncovered items	crates/forge/src/cmd/coverage.rs crates/forge/src/coverage.rs
Ensure consistent logging, mnemonic fallback, and account touch	init_tracing now injects node=info when RUST_LOG lacks filter Fallback to 12-word mnemonic on error Cheatcodes inspector touches accounts before transactions	crates/anvil/src/lib.rs crates/anvil/src/cmd.rs crates/cheatcodes/src/inspector.rs
Remove unused verify flag and bump dependencies	Dropped verify field and builder from ProjectCompiler Bumped alloy-hardforks and alloy-op-hardforks to 0.3.2	crates/common/src/compile.rs Cargo.toml
PIN cross in CI and add Docker image workflow	Install cross from specific Git rev Added .github/workflows/docker-image.yml Updated existing workflow permissions and pinning	.github/workflows/release.yml .github/workflows/docker-publish.yml .github/workflows/docker-image.yml

Possibly linked issues

• fix: chore(common): deprecate ProjectCompiler::verify and fix compile_target vercel link on cloud  #73: PR fully implements the updated coverage analysis visitor, incorporating Solar AST/HIR, deprecating verify, and associated tooling/dependency updates.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[gemini-code-assist]

Summary of Changes

Hello @Dargon789, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request primarily focuses on updating a wide array of Rust dependencies across the project, ensuring the use of the latest stable versions and their associated security and performance improvements. A significant refactor of the Solidity coverage analysis mechanism has been implemented, transitioning from foundry-compilers AST to the solar compiler's AST and HIR for more precise and reliable coverage data extraction. Additionally, several minor enhancements and bug fixes have been introduced, such as improved mnemonic generation fallback in Anvil, refined tracing configuration, and better state handling in cheatcodes, alongside updates to the test suite to reflect these changes and improve coverage reporting.

Highlights

• Dependency Updates: Numerous Rust dependencies across the project have been updated to their latest versions, including alloy-hardforks, alloy-op-hardforks, indexmap, itertools, rustc-hash, bindgen, chrono, aws-sdk-*, rustix, windows-sys, serde, and pest, ensuring the use of stable and up-to-date libraries.
• Coverage Analysis Refactor: The core Solidity coverage analysis logic has been significantly refactored to leverage the solar compiler's AST and HIR. This change aims for more accurate and robust detection of coverage items (functions, statements, branches) by directly interacting with the compiler's internal representation.
• Mnemonic Generation Fallback: Anvil's mnemonic generation now includes a more robust fallback mechanism. If a requested word count for a mnemonic fails, it will now generate a valid 12-word random mnemonic instead of relying on a default static one, logging a warning in the process.
• Tracing Configuration Enhancement: The handling of the RUST_LOG environment variable for tracing in Anvil has been improved. It now automatically ensures that node=info logs are included if RUST_LOG is set without explicitly defining the node level, preventing unexpected silent node behavior.
• Cheatcode State Touch: Broadcasted transactions within cheatcodes now explicitly mark the new_origin account as 'touched' in the journaled state. This ensures correct and consistent state tracking during transaction processing.
• Test Suite Enhancements: The Forge CLI coverage test suite has been updated with several improvements, including refactoring test contracts for better reusability, adding a new test case to verify coverage for break and continue statements within loops, and adjusting expected coverage percentages in existing tests to reflect the new analysis logic.

Ignored Files

• Ignored by pattern: .github/workflows/** (3)
  • .github/workflows/docker-image.yml
  • .github/workflows/docker-publish.yml
  • .github/workflows/release.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[sourcery-ai]

Hey there - I've reviewed your changes and found some issues that need to be addressed.

• The extensive visitor implementations in SourceVisitor contain duplicated branch-handling patterns—consider extracting shared logic into helper functions to improve readability and maintainability.
• There are several unchecked unwrap() and expect() calls when fetching AST/HIR and source snippets that could panic at runtime—please add proper error handling or context-aware errors to avoid unexpected CLI crashes.
• The signature fn ord_key(&self) -> impl Ord + use<> appears to contain a stray use<> constraint—please clean up the return type signature to remove this placeholder and ensure correct compilation.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The extensive visitor implementations in `SourceVisitor` contain duplicated branch-handling patterns—consider extracting shared logic into helper functions to improve readability and maintainability.
- There are several unchecked `unwrap()` and `expect()` calls when fetching AST/HIR and source snippets that could panic at runtime—please add proper error handling or context-aware errors to avoid unexpected CLI crashes.
- The signature `fn ord_key(&self) -> impl Ord + use<>` appears to contain a stray `use<>` constraint—please clean up the return type signature to remove this placeholder and ensure correct compilation.

## Individual Comments

### Comment 1
<location> `crates/evm/coverage/src/lib.rs:358` </location>
<code_context>
+}
+
+impl CoverageItemKind {
+    fn ord_key(&self) -> impl Ord + use<> {
+        match *self {
+            Self::Line => 0,
</code_context>

<issue_to_address>
**issue (bug_risk):** The use of `impl Ord + use<>` is invalid syntax and will not compile.

Replace `impl Ord + use<>` with a valid return type, such as a tuple or a concrete type implementing `Ord`. Remove `+ use<>` from the signature.
</issue_to_address>

### Comment 2
<location> `crates/evm/coverage/src/analysis.rs:144` </location>
<code_context>
-            node.attribute("kind").ok_or_else(|| eyre::eyre!("Function has no kind"))?;
+    /// Creates a coverage item for a given kind and source location. Pushes item to the internal
+    /// collection (plus additional coverage line if item is a statement).
+    fn push_item_kind(&mut self, kind: CoverageItemKind, span: Span) {
+        let item = CoverageItem { kind, loc: self.source_location_for(span), hits: 0 };

</code_context>

<issue_to_address>
**issue (complexity):** Consider extracting helper methods for branch and require handling to reduce repeated code in coverage item creation.

Here are a few small refactorings you can do to collapse a lot of the repeated `push_item_kind` and `push_stmt` logic without touching any of the existing behavior:

1) Extract a `push_branch` helper so all of your branch pushes look like:

```rust
impl<'gcx> SourceVisitor<'gcx> {
    #[inline]
    fn push_branch(&mut self, span: Span, branch_id: u32, path_id: u32, is_first: bool) {
        self.push_item_kind(
            CoverageItemKind::Branch {
                branch_id,
                path_id,
                is_first_opcode: is_first,
            },
            span,
        );
    }
}
```

Then in your `visit_stmt` / `visit_yul_stmt` you can replace:

```rust
let branch_id = self.next_branch_id();
self.push_item_kind(
    CoverageItemKind::Branch { branch_id, path_id: 0, is_first_opcode: true },
    then_stmt.span,
);
if let Some(_) = else_stmt {
    self.push_item_kind(
        CoverageItemKind::Branch { branch_id, path_id: 1, is_first_opcode: false },
        stmt.span,
    );
}
```

with

```rust
let branch_id = self.next_branch_id();
self.push_branch(then_stmt.span, branch_id, 0, true);
if else_stmt.is_some() {
    self.push_branch(stmt.span, branch_id, 1, false);
}
```

2) Extract a `handle_require` since the “require → 2-branch” pattern is identical in two places:

```rust
impl<'gcx> SourceVisitor<'gcx> {
    #[inline]
    fn handle_require(&mut self, span: Span) {
        let id = self.next_branch_id();
        // false‐path
        self.push_branch(span, id, 0, false);
        // true‐path
        self.push_branch(span, id, 1, false);
    }
}
```

and then replace in your Expr visitor:

```rust
if ident.as_str() == "require" {
    self.handle_require(expr.span);
}
```

These two helpers alone will collapse dozens of lines of boilerplate, make your visitor arms much shorter, and keep the exact same coverage behavior.
</issue_to_address>

### Comment 3
<location> `crates/evm/coverage/src/lib.rs:337` </location>
<code_context>
     },
 }

+impl PartialEq for CoverageItemKind {
+    fn eq(&self, other: &Self) -> bool {
+        self.ord_key() == other.ord_key()
</code_context>

<issue_to_address>
**issue (complexity):** Consider using #[repr(u8)] and deriving comparison traits for CoverageItemKind, and simplifying CoverageItem's comparison logic to reduce manual boilerplate.

```rust
// 1. Use `#[repr(u8)]` + `derive` on `CoverageItemKind` – drops ALL of your manual
//    `PartialEq/Eq/PartialOrd/Ord` + `ord_key()` boilerplate.
#[repr(u8)]
#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
pub enum CoverageItemKind {
    Line = 0,
    Statement = 1,
    Branch {
        branch_id: u32,
        path_id:   u32,
        is_first_opcode: bool,
    },
    Function { name: Box<str> },
}

// — remove your `impl PartialEq/Eq/PartialOrd/Ord for CoverageItemKind` and the
//   `fn ord_key(&self) -> impl Ord + use<> { … }` entirely.

// 2. Simplify `CoverageItem::ord_key()` to return a concrete tuple
//    (no `impl Trait`), then derive `PartialEq/Eq`, and only hand‐write `Ord`:
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct CoverageItem {
    pub kind: CoverageItemKind,
    pub loc: SourceLocation,
    pub hits: u32,
}

impl CoverageItem {
    fn ord_key(&self) -> (std::cmp::Reverse<usize>, u32, u32, CoverageItemKind, u32, u32) {
        (
            std::cmp::Reverse(self.loc.source_id),
            self.loc.lines.start,
            self.loc.lines.end,
            self.kind.clone(),
            self.loc.bytes.start,
            self.loc.bytes.end,
        )
    }
}

impl PartialOrd for CoverageItem {
    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
        Some(self.cmp(other))
    }
}

impl Ord for CoverageItem {
    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
        self.ord_key().cmp(&other.ord_key())
    }
}

// 3. Now you can drop all the manual trait‐impls that merely forwarded to `ord_key()`.
//
// These changes preserve your sort–order logic exactly, but
// eliminate dozens of lines of boilerplate.
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request is a significant and impressive overhaul of the EVM coverage analysis, migrating to the solar AST/HIR for improved accuracy and maintainability. The changes are extensive but well-contained, touching upon dependency updates, bug fixes in Anvil and Cheatcodes, and streamlining the forge coverage CLI and its tests. The code quality is high, and the refactoring appears to be a solid improvement. I've identified one high-severity issue in the Anvil logging initialization that could regress user experience, and I've provided a suggestion to address it. The rest of the changes, including bug fixes and test improvements, look excellent.