Merge branch 'master' into arv/note_hash_siloing

.github/workflows/devnet-deploy.yml

@@ -0,0 +1,133 @@
+name: Deploy devnet
+
+on:
+  workflow_dispatch:
+    inputs:
+      namespace:
+        description: The namespace to deploy to, e.g. smoke
+        required: true
+      aztec_docker_image:
+        description: The Aztec Docker image to use
+        required: true
+      deployment_mnemonic_secret_name:
+        description: The name of the secret which holds the boot node's contract deployment mnemonic
+        required: true
+        default: testnet-deployment-mnemonic
+      respect_tf_lock:
+        description: Whether to respect the Terraform lock
+        required: false
+        default: "true"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  CONTRACT_S3_BUCKET: s3://static.aztec.network
+  CLUSTER_NAME: aztec-gke
+  REGION: us-west1-a
+  NAMESPACE: ${{ inputs.namespace }}
+  AZTEC_DOCKER_IMAGE: ${{ inputs.aztec_docker_image }}
+
+jobs:
+  deploy-network:
+    uses: ./.github/workflows/network-deploy.yml
+    with:
+      namespace: ${{ github.event.inputs.namespace }}
+      values_file: release-devnet.yaml
+      aztec_docker_image: ${{ github.event.inputs.aztec_docker_image }}
+      deployment_mnemonic_secret_name: ${{ github.event.inputs.deployment_mnemonic_secret_name }}
+      respect_tf_lock: ${{ github.event.inputs.respect_tf_lock }}
+    secrets:
+      GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+
+
+  bootstrap-network:
+    runs-on: ubuntu-latest
+    needs: deploy-network
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
+          aws-region: eu-west-2
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Setup kubectl access
+        run: |
+          gcloud components install kubectl gke-gcloud-auth-plugin --quiet
+          gcloud container clusters get-credentials ${{ env.CLUSTER_NAME }} --region ${{ env.REGION }}
+
+      - name: Setup helm
+        run: |
+          curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
+          chmod +x get_helm.sh
+          sudo ./get_helm.sh
+          rm get_helm.sh
+
+      - name: Bootstrap network
+        run: |
+          set -eu -o pipefail
+
+          pxe_port_forward_pid=""
+          ethereum_port_forward_pid=""
+
+          cleanup() {
+              echo "Cleaning up port-forward processes..."
+              if [ -n "$pxe_port_forward_pid" ]; then
+                  kill $pxe_port_forward_pid 2>/dev/null || true
+              fi
+              if [ -n "$ethereum_port_forward_pid" ]; then
+                  kill $ethereum_port_forward_pid 2>/dev/null || true
+              fi
+          }
+
+          trap cleanup EXIT
+
+          echo "Waiting for PXE pods to be ready..."
+          if ! kubectl wait -n $NAMESPACE --for=condition=ready pod -l app=pxe --timeout=10m; then
+              echo "Error: PXE pods did not become ready within timeout"
+              exit 1
+          fi
+
+          helm get values $NAMESPACE -n $NAMESPACE -o json --all > helm_values.json
+
+          PXE_PORT="$(jq -r .pxe.service.nodePort helm_values.json)"
+          ETHEREUM_PORT="$(jq -r .ethereum.service.port helm_values.json)"
+          L1_CHAIN_ID="$(jq -r .ethereum.chainId helm_values.json)"
+
+          MNEMONIC="$(jq -r .aztec.l1DeploymentMnemonic helm_values.json)"
+          echo "::add-mask::$MNEMONIC"
+
+          rm helm_values.json
+
+          kubectl port-forward -n $NAMESPACE svc/$NAMESPACE-aztec-network-pxe $PXE_PORT &
+          pxe_port_forward_pid=$!
+
+          # port-forward directly to the pod because the Eth node does not have a service definition
+          ETH_POD_NAME=$(kubectl get pods -n $NAMESPACE -l app=ethereum -o jsonpath='{.items[0].metadata.name}')
+          kubectl port-forward -n $NAMESPACE pod/$ETH_POD_NAME $ETHEREUM_PORT &
+          ethereum_port_forward_pid=$!
+
+          # wait for port-forwards to establish
+          sleep 5
+
+          docker run --rm --network host $AZTEC_DOCKER_IMAGE bootstrap-network \
+            --rpc-url http://127.0.0.1:$PXE_PORT \
+            --l1-rpc-url http://127.0.0.1:$ETHEREUM_PORT \
+            --l1-chain-id "$L1_CHAIN_ID" \
+            --mnemonic "$MNEMONIC" \
+            --json | tee ./basic_contracts.json
+
+          aws s3 cp ./basic_contracts.json ${{ env.CONTRACT_S3_BUCKET }}/devnet/basic_contracts.json
+