A CI check that reads a diff and validates it against another repo
Stop a wrong token definition reaching the Base bridge by checking it in CI.
A GitHub Action that triggers on any pull request touching
apps/bridge/assets.ts in base-org/web, finds newly added L2symbol entries,
and validates each against optimism.tokenlist.json in the Optimism repo. Two
invariants: present with chainId 8453, and a baseBridgeAddress of
0x4200000000000000000000000000000000000010. Pass and the PR is compliant; fail
and a human looks.
The first mechanism is extracting semantic additions from a TypeScript diff. A text diff says lines changed; what is needed is which symbols were added, which means reading the source rather than the patch. Getting that wrong permissively is the dangerous direction, because the check then reports success on exactly the PR it existed to catch.
The second is depending on a file in a repository you do not control, at CI time. Fetching live breaks when their repo is unreachable; pinning validates against a stale list and rejects legitimate additions. What matters is that an upstream failure reads as “could not verify” rather than as a rejection.
It cannot catch a token that satisfies both invariants and is still the wrong token.