Palango/celo9

.envrc.example

@@ -66,3 +66,18 @@ export ETHERSCAN_API_KEY=
 # Private key to use for contract deployments, you don't need to worry about
 # this for the Getting Started guide.
 export PRIVATE_KEY=
+
+# CELO additional configuration
+export ENABLE_GOVERNANCE=false
+export FUNDS_DEV_ACCOUNTS=false
+export USE_ALTDA=false
+# Set to false if migrating state from a Celo L1. True for new testnets
+export DEPLOY_CELO_CONTRACTS=false
+
+export USE_CUSTOM_GAS_TOKEN=true
+# Set to "0x0000000000000000000000000000000000000000" when the contract
+# should get deployed (via create2) on L1 as part of the deploy script.
+# Set to the deployed contract address when already deployed on L1
+# This only works when USE_CUSTOM_GAS_TOKEN=true
+export CUSTOM_GAS_TOKEN_ADDRESS=0x0000000000000000000000000000000000000000
+

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(docker): "
     labels:
@@ -20,7 +20,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(actions): "
     labels:
@@ -33,7 +33,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     versioning-strategy: "auto"
     commit-message:
       prefix: "dependabot(npm): "
@@ -47,7 +47,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(gomod): "
     labels:

.github/workflows/contracts-celo.yaml

@@ -0,0 +1,99 @@
+name: Alfajores-Holesky Deploy Celo4 L1 Contracts
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_contracts:
+        required: false
+        type: boolean
+        default: true
+      contracts_tag:
+        required: false
+        type: string
+        default: 'celo4'
+      deployment_context:
+        required: false
+        type: string
+        default: 'test-celo4'
+      l2_chain_id:
+        required: false
+        default: '42069'
+
+jobs:
+  deploy-contracts:
+    runs-on: ubuntu-latest
+    permissions: # Must change the job token permissions to use Akeyless JWT auth
+      id-token: write
+      contents: read
+    if: ${{ ! startsWith(github.triggering_actor, 'akeyless') }}
+    env:
+      DEPLOY_CONTRACTS: ${{ github.event_name == 'push' && 'true' || inputs.deploy_contracts }}
+      CONTRACTS_TAG: ${{ github.event_name == 'push' && 'op-contracts/v1.3.0' || inputs.contracts_tag }}
+      DEPLOYMENT_CONTEXT: ${{ github.event_name == 'push' && 'test' || inputs.deployment_context }}
+      L2_CHAIN_ID: ${{ github.event_name == 'push' && '42069' || inputs.l2_chain_id }}
+      L1_CHAIN_ID: '17000' # Holesky
+      L1_RPC_URL: 'https://ethereum-holesky-rpc.publicnode.com'
+      GS_ADMIN_ADDRESS: '0xb2397dF29AFB4B4661559436180019bEb7912985'
+      GS_BATCHER_ADDRESS: '0x7fDBe8F4D22ab511340667d7Ce5675568d09eBB4'
+      GS_PROPOSER_ADDRESS: '0xdCf30236Fa0aBE2ca0BEc2eE0a2F40b16A144DB3'
+      GS_SEQUENCER_ADDRESS: '0x3e2Df8efB6fA1d6E6021572a99BB67BA9ab2C59D'
+    steps:
+
+      - name: "Get GitHub Token from Akeyless"
+        id: get_auth_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/optimism/contents=write,pull_requests=write":"PAT"}'
+
+      # "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/HOLESKY_QUICKNODE_URL":"L1_RPC_URL",
+      - name: Akeyless get secrets
+        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          static-secrets: '{
+            "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/GS_ADMIN_PRIVATE_KEY":"GS_ADMIN_PRIVATE_KEY"
+            }'
+
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Generate config JSON
+        run: |
+          cd packages/contracts-bedrock
+          ./scripts/getting-started/config-vars-celo.sh
+
+      - name: Deploy L1 contracts
+        if: ${{ env.DEPLOY_CONTRACTS != 'false' }}
+        run: |
+          export IMPL_SALT=$(openssl rand -hex 32)
+          cd packages/contracts-bedrock
+          echo "Broadcasting ..."
+          forge script scripts/Deploy.s.sol:Deploy --private-key $GS_ADMIN_PRIVATE_KEY --broadcast --rpc-url $L1_RPC_URL --legacy
+
+      - name: Generate genesis files
+        run: |
+          mkdir -p l2-config-files/$DEPLOYMENT_CONTEXT
+          cd op-node
+          go run cmd/main.go genesis l2 \
+            --deploy-config ../packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json \
+            --l1-deployments ../packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy \
+            --outfile.l2 ../l2-config-files/$DEPLOYMENT_CONTEXT/genesis-$(date +%s).json \
+            --outfile.rollup ../l2-config-files/$DEPLOYMENT_CONTEXT/rollup-$(date +%s).json \
+            --l1-rpc $L1_RPC_URL
+
+      - name: "Commit genesis files"
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '[Automatic] - Commit genesis files'
+          branch: alvarof2/contracts
+          file_pattern: 'l2-config-files packages/contracts-bedrock/**'

.github/workflows/contracts-op-stack.yaml

@@ -0,0 +1,117 @@
+name: Alfajores-Holesky Deploy OP-Stack L1 Contracts
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_contracts:
+        required: false
+        type: boolean
+        default: true
+      contracts_tag:
+        required: false
+        type: string
+        default: 'op-contracts/v1.3.0'
+      deployment_context:
+        required: false
+        type: string
+        default: 'test-alvaro'
+      l2_chain_id:
+        required: false
+        default: '42069'
+
+jobs:
+  deploy-contracts:
+    runs-on: ubuntu-latest
+    permissions: # Must change the job token permissions to use Akeyless JWT auth
+      id-token: write
+      contents: read
+    if: ${{ ! startsWith(github.triggering_actor, 'akeyless') }}
+    env:
+      DEPLOY_CONTRACTS: ${{ github.event_name == 'push' && 'true' || inputs.deploy_contracts }}
+      CONTRACTS_TAG: ${{ github.event_name == 'push' && 'op-contracts/v1.3.0' || inputs.contracts_tag }}
+      DEPLOYMENT_CONTEXT: ${{ github.event_name == 'push' && 'test' || inputs.deployment_context }}
+      L2_CHAIN_ID: ${{ github.event_name == 'push' && '42069' || inputs.l2_chain_id }}
+      L1_CHAIN_ID: '17000' # Holesky
+      L1_RPC_URL: 'https://ethereum-holesky-rpc.publicnode.com'
+      GS_ADMIN_ADDRESS: '0xb2397dF29AFB4B4661559436180019bEb7912985'
+      GS_BATCHER_ADDRESS: '0x7fDBe8F4D22ab511340667d7Ce5675568d09eBB4'
+      GS_PROPOSER_ADDRESS: '0xdCf30236Fa0aBE2ca0BEc2eE0a2F40b16A144DB3'
+      GS_SEQUENCER_ADDRESS: '0x3e2Df8efB6fA1d6E6021572a99BB67BA9ab2C59D'
+    steps:
+
+      - name: "Get GitHub Token from Akeyless"
+        id: get_auth_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/optimism/contents=write,pull_requests=write":"PAT"}'
+
+      # "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/HOLESKY_QUICKNODE_URL":"L1_RPC_URL",
+      - name: Akeyless get secrets
+        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          static-secrets: '{
+            "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/GS_ADMIN_PRIVATE_KEY":"GS_ADMIN_PRIVATE_KEY"
+            }'
+
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: "Checkout OP Repo"
+        uses: actions/checkout@v4
+        with:
+          repository: 'ethereum-optimism/optimism'
+          ref: '${{ env.CONTRACTS_TAG }}'
+          path: ethereum-optimism
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Generate config JSON
+        run: |
+          cd packages/contracts-bedrock
+          ./scripts/getting-started/config-vars-op-stack.sh
+          cp deploy-config/$DEPLOYMENT_CONTEXT.json /home/runner/work/optimism/optimism/ethereum-optimism/packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json
+
+      - name: Deploy L1 contracts
+        if: ${{ env.DEPLOY_CONTRACTS != 'false' }}
+        run: |
+          export IMPL_SALT=$(openssl rand -hex 32)
+          cd ethereum-optimism/packages/contracts-bedrock
+          echo "Broadcasting ..."
+          forge script scripts/Deploy.s.sol:Deploy --private-key $GS_ADMIN_PRIVATE_KEY --broadcast --rpc-url $L1_RPC_URL --legacy
+          mkdir -p /home/runner/work/optimism/optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT
+          cp deployments/$DEPLOYMENT_CONTEXT/.deploy /home/runner/work/optimism/optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy
+
+      - name: Copy old .deploy file if contracts not deployed
+        if: ${{ env.DEPLOY_CONTRACTS == 'false' }}
+        run: |
+          mkdir -p ethereum-optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT
+          cp packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy ethereum-optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy
+
+      - name: Generate genesis files
+        run: |
+          mkdir -p l2-config-files/$DEPLOYMENT_CONTEXT
+          cd ethereum-optimism/op-node
+          go run cmd/main.go genesis l2 \
+            --deploy-config ../packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json \
+            --l1-deployments ../packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy \
+            --outfile.l2 ../../l2-config-files/$DEPLOYMENT_CONTEXT/genesis-$(date +%s).json \
+            --outfile.rollup ../../l2-config-files/$DEPLOYMENT_CONTEXT/rollup-$(date +%s).json \
+            --l1-rpc $L1_RPC_URL
+
+      - name: "Commit genesis files"
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '[Automatic] - Commit genesis files'
+          branch: alvarof2/contracts
+          file_pattern: 'l2-config-files packages/contracts-bedrock/**'

.github/workflows/docker-build-scan.yaml

@@ -0,0 +1,102 @@
+name: Docker Build Scan
+on:
+  pull_request:
+    branches:
+      - 'master'
+      - 'celo*'
+  push:
+    branches:
+      - 'master'
+      - 'celo*'
+  workflow_dispatch:
+
+jobs:
+  detect-files-changed:
+    runs-on: ubuntu-latest
+    outputs:
+      files-changed: ${{ steps.detect-files-changed.outputs.all_changed_files }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Detect files changed
+        id: detect-files-changed
+        uses: tj-actions/changed-files@v44
+        with:
+          separator: ','
+
+  build-cel2-migration-tool:
+    runs-on: ubuntu-latest
+    env:
+      GIT_COMMIT: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+    needs: detect-files-changed
+    if: |
+      contains(needs.detect-files-changed.outputs.files-changed, 'go.sum') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/cmd/celo-migrate') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/Dockerfile') ||
+      contains(needs.detect-files-changed.outputs.files-changed, '.github/workflows/docker-build-scan.yaml') ||
+      github.event_name == 'workflow_dispatch' ||
+      true
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Login at GCP Artifact Registry
+        uses: celo-org/reusable-workflows/.github/actions/[email protected]
+        with:
+          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos'
+          service-account: '[email protected]'
+          docker-gcp-registries: us-west1-docker.pkg.dev
+      - name: Build and push container
+        uses: celo-org/reusable-workflows/.github/actions/[email protected]
+        with:
+          platforms: linux/amd64
+          registry: us-west1-docker.pkg.dev/devopsre/dev-images/cel2-migration-tool
+          tags: ${{ env.GIT_COMMIT }}
+          context: ./
+          dockerfile: ./op-chain-ops/Dockerfile
+          push: true
+          trivy: false
+
+  # Build op-node op-batcher op-proposer using docker-bake
+  build-op-stack:
+    runs-on: ubuntu-latest
+    needs: detect-files-changed
+    if: |
+      contains(needs.detect-files-changed.outputs.files-changed, 'go.sum') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'ops/docker') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-node/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-batcher/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-proposer/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-service/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, '.github/workflows/docker-build-scan.yaml') ||
+      github.event_name == 'workflow_dispatch' ||
+      true
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write
+    env:
+      GIT_COMMIT: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      GIT_DATE: ${{ github.event.head_commit.timestamp }}
+      IMAGE_TAGS: ${{ (github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/celo')) && 'latest,' || '') }}${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      REGISTRY: us-west1-docker.pkg.dev
+      REPOSITORY: blockchaintestsglobaltestnet/dev-images
+    steps:
+      - uses: actions/checkout@v4
+      - name: Login at GCP Artifact Registry
+        uses: celo-org/reusable-workflows/.github/actions/[email protected]
+        with:
+          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos'
+          service-account: '[email protected]'
+          docker-gcp-registries: us-west1-docker.pkg.dev
+      # We need a custom steps as it's using docker bake
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push
+        uses: docker/bake-action@v5
+        with:
+          push: true
+          source: .
+          files: docker-bake.hcl
+          targets: op-node,op-batcher,op-proposer