// deploy/001_deploy_governance_token.js
const { ethers } = require("hardhat");

/**
 * 部署治理代币并转移所有权给多签地址
 *
 * 使用方法：
 *   npx hardhat deploy --network sepolia --tags GovernanceToken
 *
 * 环境变量要求：
 *   MULTISIG_ADDRESS - 最终拥有合约所有权的多签地址
 *   DEPLOYER_PK      - 部署者私钥（通过 .env 注入）
 */
module.exports = async ({ getNamedAccounts, deployments }) => {
  const { deploy, log, save } = deployments;
  const { deployer } = await getNamedAccounts();

  const multisigAddress = process.env.MULTISIG_ADDRESS;
  if (!multisigAddress) {
    throw new Error("MULTISIG_ADDRESS environment variable is not set");
  }

  log(`Deploying GovernanceToken with deployer: ${deployer}`);

  // 步骤 1：部署合约
  const deployResult = await deploy("GovernanceToken", {
    from: deployer,
    args: ["MyGovernance", "GOV", ethers.parseEther("1000000")],
    log: true,
    waitConfirmations: 2,
  });

  log(`Contract deployed at: ${deployResult.address}`);

  // 步骤 2：获取合约实例并转移所有权
  const tokenContract = await ethers.getContractAt(
    "GovernanceToken",
    deployResult.address,
    deployer
  );

  const currentOwner = await tokenContract.owner();
  if (currentOwner !== multisigAddress) {
    const tx = await tokenContract.transferOwnership(multisigAddress);
    await tx.wait(2);
    log(`Ownership transferred to multisig: ${multisigAddress}`);
  } else {
    log("Ownership already set to multisig address");
  }

  // 步骤 3：保存部署摘要到文件（可选日志）
  save("GovernanceToken", {
    address: deployResult.address,
    abi: deployResult.abi,
    receipt: deployResult.receipt,
    args: ["MyGovernance", "GOV", ethers.parseEther("1000000")],
  });

  log("Deployment complete.");
};

module.exports.tags = ["GovernanceToken"];

// hardhat.config.js
require("@nomicfoundation/hardhat-toolbox");
require("hardhat-deploy");
require("dotenv").config();

const PRIVATE_KEY = process.env.DEPLOYER_PK || "";
const ETHERSCAN_API_KEY = process.env.ETHERSCAN_API_KEY || "";

/** @type import('hardhat/config').HardhatUserConfig */
module.exports = {
  solidity: {
    version: "0.8.20",
    settings: {
      optimizer: { enabled: true, runs: 200 },
    },
  },
  namedAccounts: {
    deployer: { default: 0 },
  },
  networks: {
    hardhat: {
      chainId: 31337,
    },
    sepolia: {
      url: process.env.SEPOLIA_RPC_URL || "",
      accounts: [PRIVATE_KEY],
      chainId: 11155111,
    },
    ethereum: {
      url: process.env.MAINNET_RPC_URL || "",
      accounts: [PRIVATE_KEY],
      chainId: 1,
    },
    arbitrum: {
      url: process.env.ARBITRUM_RPC_URL || "",
      accounts: [PRIVATE_KEY],
      chainId: 42161,
    },
    polygon: {
      url: process.env.POLYGON_RPC_URL || "",
      accounts: [PRIVATE_KEY],
      chainId: 137,
    },
  },
  etherscan: {
    apiKey: {
      sepolia: ETHERSCAN_API_KEY,
      mainnet: ETHERSCAN_API_KEY,
      arbitrum: process.env.ARBISCAN_API_KEY || "",
      polygon: process.env.POLYGONSCAN_API_KEY || "",
    },
  },
};

// script/DeployGovernanceToken.s.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script} from "forge-std/Script.sol";
import {GovernanceToken} from "../src/GovernanceToken.sol";

/**
 * @title DeployGovernanceToken
 * @notice Foundry forge script 部署治理代币并转移所有权
 *
 * 使用方法：
 *   forge script script/DeployGovernanceToken.s.sol \
 *     --rpc-url sepolia \
 *     --private-key $DEPLOYER_PK \
 *     --broadcast \
 *     --verify
 *
 * 生产环境建议使用 --ledger 或 --trezor 代替明文私钥
 */
contract DeployGovernanceToken is Script {
    // 从环境变量读取多签地址
    address public constant MULTISIG =
        0x70997970C51812dc3A010C7d01b50e0d17dc79C8; // 替换实际地址

    function run() external returns (GovernanceToken) {
        uint256 deployerPrivateKey = vm.envUint("PRIVATE_KEY");

        // 步骤 1：开始广播——此后的交易将被签名并提交
        vm.startBroadcast(deployerPrivateKey);

        // 步骤 2：部署合约
        GovernanceToken token = new GovernanceToken(
            "MyGovernance",
            "GOV",
            1_000_000e18
        );

        // 步骤 3：所有权转移给多签
        token.transferOwnership(MULTISIG);

        vm.stopBroadcast();

        // 步骤 4：日志输出
        console.log("GovernanceToken deployed at:", address(token));
        console.log("Ownership transferred to:", MULTISIG);

        return token;
    }
}

# foundry.toml
[profile.default]
src = "src"
out = "out"
libs = ["lib"]
solc_version = "0.8.20"
optimizer = true
optimizer_runs = 200

[rpc_endpoints]
localhost = "http://127.0.0.1:8545"
sepolia = "${SEPOLIA_RPC_URL}"
mainnet = "${MAINNET_RPC_URL}"
arbitrum = "${ARBITRUM_RPC_URL}"
polygon = "${POLYGON_RPC_URL}"

[etherscan]
sepolia = { key = "${ETHERSCAN_API_KEY}" }
mainnet = { key = "${ETHERSCAN_API_KEY}" }
arbitrum = { key = "${ARBISCAN_API_KEY}" }
polygon = { key = "${POLYGONSCAN_API_KEY}" }

# 验证所有部署的合约
npx hardhat verify --network sepolia <CONTRACT_ADDRESS> <CONSTRUCTOR_ARG1> <CONSTRUCTOR_ARG2>

// scripts/verify-args.js
module.exports = [
  "MyGovernance",
  "GOV",
  ethers.parseEther("1000000"),
];

npx hardhat verify --network sepolia \
  --constructor-args scripts/verify-args.js \
  0x1234567890123456789012345678901234567890

forge verify-contract \
  --chain sepolia \
  --constructor-args \
    $(cast abi-encode "constructor(string,string,uint256)" "MyGovernance" "GOV" 1000000000000000000000000) \
  --etherscan-api-key $ETHERSCAN_API_KEY \
  0x1234567890123456789012345678901234567890 \
  src/GovernanceToken.sol:GovernanceToken

// hardhat.config.js 追加配置段
module.exports = {
  // ... 原有配置
  sourcify: {
    enabled: true,
    apiUrl: "https://sourcify.dev/server",
    browserUrl: "https://sourcify.dev",
  },
};

forge verify-contract \
  --chain sepolia \
  --verifier sourcify \
  --verifier-url https://sourcify.dev/server \
  0x1234567890123456789012345678901234567890 \
  src/GovernanceToken.sol:GovernanceToken

# .github/workflows/contracts.yml
name: Solidity CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  FOUNDRY_PROFILE: ci
  GAS_REPORT: true

jobs:
  lint:
    name: Lint & Format Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 18
      - name: Install dependencies
        run: npm ci
      - name: Run Solhint
        run: npx solhint "contracts/**/*.sol"
      - name: Check Prettier formatting
        run: npx prettier --check "contracts/**/*.sol"

  compile-and-test:
    name: Compile & Test
    needs: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@v1
        with:
          version: nightly
      - name: Install dependencies
        run: forge install
      - name: Build
        run: forge build --sizes
      - name: Run tests
        run: forge test -vvv
      - name: Generate coverage report
        run: forge coverage --report lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          files: ./lcov.info
          fail_ci_if_error: true

  slither-scan:
    name: Slither Static Analysis
    needs: compile-and-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: Install Slither
        run: |
          python -m pip install --upgrade pip
          pip install slither-analyzer
      - name: Run Slither analysis
        run: |
          slither . \
            --filter-paths "lib" \
            --exclude-dependencies \
            --fail-pedantic \
            --json slither-report.json || true
      - name: Upload Slither report
        uses: actions/upload-artifact@v3
        with:
          name: slither-report
          path: slither-report.json

  coverage-gate:
    name: Coverage Gate
    needs: compile-and-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@v1
        with:
          version: nightly
      - name: Install dependencies
        run: forge install
      - name: Generate coverage with branch metrics
        run: forge coverage --report summary
      - name: Check coverage thresholds
        run: |
          forge coverage --report summary | tee coverage-summary.txt
          # 行覆盖率 >= 80%，分支覆盖率 >= 70%
          LINE_COV=$(grep -oP 'Lines:\s+\K[\d.]+(?=%)' coverage-summary.txt || echo "0")
          BRANCH_COV=$(grep -oP 'Branches:\s+\K[\d.]+(?=%)' coverage-summary.txt || echo "0")
          echo "Line coverage: ${LINE_COV}%"
          echo "Branch coverage: ${BRANCH_COV}%"
          if (( $(echo "$LINE_COV < 80" | bc -l) )); then
            echo "ERROR: Line coverage ${LINE_COV}% is below 80% threshold"
            exit 1
          fi
          if (( $(echo "$BRANCH_COV < 70" | bc -l) )); then
            echo "ERROR: Branch coverage ${BRANCH_COV}% is below 70% threshold"
            exit 1
          fi
          echo "All coverage thresholds passed!"

# 生成 lcov 格式报告（集成 Codecov 时使用）
forge coverage --report lcov

# 生成终端摘要（含行/分支/函数覆盖率百分比）
forge coverage --report summary

# 生成 HTML 可视化报告
forge coverage --report report

# 指定覆盖率分析的合约路径（排除 lib 目录）
forge coverage --report lcov --match-path "src/**/*.sol"

# 使用 Docker 运行 Slither（避免本地 Python 环境冲突）
docker run --rm -v "$PWD":/src trailofbits/eth-security-toolbox \
  slither /src \
    --filter-paths "lib" \
    --exclude-dependencies \
    --fail-pedantic \
    --json /src/slither-report.json

# 或使用 pip 安装后直接运行
pip install slither-analyzer
slither . \
  --filter-paths "lib,node_modules" \
  --exclude-dependencies \
  --fail-low \
  --json slither-report.json