Deploy to testnet-staging #337
Conversation
WalkthroughThe pull request modifies the GitHub Actions workflow file for building the xmtpd image. The primary change involves updating the Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/build-xmtpd.yml (1)
Line range hint
73-76: Verify terraform-deployer action versionThe workflow uses
xmtp-labs/terraform-deployer@v1. Consider pinning to a specific commit SHA for better security and reproducibility.- uses: xmtp-labs/terraform-deployer@v1 + uses: xmtp-labs/terraform-deployer@{specific-commit-sha}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build-xmtpd.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/build-xmtpd.yml (2)
89-90: LGTM: Secure image reference configuration
The variable prefix configuration properly restricts deployments to official ghcr.io images with SHA256 digests, which is a crucial security control for ensuring image integrity.
87-87: Verify terraform workspace configuration
The change from testnet to testnet-staging aligns with the PR objective. However, let's verify that this workspace is properly configured.
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
dev/contracts/deploy-testnet (1)
Line range hint
3-3: Addpipefailto error handlingThe script is missing
pipefailin the error handling setup, which could mask pipeline failures.-set -euo +set -euo pipefail
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
dev/contracts/deploy-ephemeral(1 hunks)dev/contracts/deploy-local(1 hunks)dev/contracts/deploy-testnet(1 hunks)
🔇 Additional comments (2)
dev/contracts/deploy-ephemeral (1)
9-9: Verify the impact of switching to forge soldeer install
The change from update to install makes deployments more deterministic by using exact versions from the lockfile instead of potentially pulling in newer versions. While this is generally safer, please verify:
- That this aligns with the testnet-staging deployment requirements
- That the lockfile is up-to-date with all required dependencies
✅ Verification successful
forge soldeer install is consistently used across all deployment scripts
The change to forge soldeer install is already implemented consistently across all deployment scripts (local, ephemeral, and testnet), and a soldeer.lock file exists in the contracts directory. This indicates that:
- The change aligns with deployment requirements across all environments
- The dependency management system is properly set up with a lockfile
The consistent usage across all deployment scripts suggests this was an intentional standardization of dependency management approach.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check if lockfile exists and when it was last updated
find . -name "foundry.lock" -type f -exec stat -f "%m %N" {} \;
# List all soldeer dependencies
forge soldeer list
Length of output: 183
Script:
#!/bin/bash
# Check if there's a foundry.toml config
find . -name "foundry.toml" -type f
# Look for any dependency management related files
find . -name "*.lock" -type f
find . -maxdepth 2 -type f -name "*dependencies*"
# Search for any forge commands in scripts
rg "forge\s+(install|update|soldeer)" -A 2 -B 2
Length of output: 1109
dev/contracts/deploy-testnet (1)
8-8: Verify chain ID and verifier configuration for testnet-staging
While the dependency management change is consistent with other scripts, please verify:
- That chain ID 241320161 is correct for testnet-staging
- That the Blockscout verifier URL is properly configured in the environment
✅ Verification successful
Let me gather more information about the chain ID configuration and deployment scripts.
Let me try one more verification to check for environment templates with a corrected command.
Chain ID and verifier configuration verified for testnet-staging
The verification is successful:
- Chain ID 241320161 is correctly used in the deployment script for testnet-staging environment
- Verifier URL is properly documented in
doc/deploy.mdashttps://explorer-testnet-staging-88dqtxdinc.t.conduit.xyz/api - The deployment script correctly uses Blockscout as the verifier with the environment variables
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check environment variables and configuration
if [ -f ./contracts/.env ]; then
# Safely check if verifier URL is set (without revealing it)
if grep -q "VERIFIER_URL" ./contracts/.env; then
echo "Verifier URL is configured"
else
echo "Missing VERIFIER_URL configuration"
fi
fi
# Search for chain ID references
rg -l "241320161"
Length of output: 76
Script:
#!/bin/bash
# Check for chain ID references in deployment scripts and configuration files
rg -A 5 "241320161"
# Look for any chain configuration files
fd -e json -e toml -e yaml -e yml | xargs rg -l "chain.*id"
# Check for any environment templates or example files
fd -g "*env*" -g "*.example*"
Length of output: 576
Script:
#!/bin/bash
# Check for environment templates with proper fd syntax
fd -g ".env*" -g "*.example"
# Look for chain ID documentation in markdown files
rg -i "chain.*id.*241320161|testnet.*staging" -g "*.md"
# Check deployment script contents
cat dev/contracts/deploy-testnet
Length of output: 1519
| @@ -11,7 +11,7 @@ mkdir -p ./build | |||
| cd ./contracts | |||
|
|
|||
| # Update depencencies | |||
| forge soldeer update | |||
| forge soldeer install | |||
There was a problem hiding this comment.
💡 Codebase verification
Typo in dependency command across deployment scripts
The command forge soldeer install appears to be a typo across multiple deployment scripts. The correct Forge command should be forge install as "soldeer" is not a valid Forge subcommand.
dev/contracts/deploy-local: Line 14- Similar typo found in other deployment scripts
🔗 Analysis chain
Consistent with other deployment scripts
The dependency management change matches other scripts, maintaining consistency across environments.
Let me verify the dependency command change by checking other deployment scripts.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Verify environment setup and contract sources
if [ -f dev/contracts/.env ]; then
echo "Environment file exists"
fi
# Check if all referenced contract files exist
for contract in "src/GroupMessages.sol" "src/Nodes.sol" "src/IdentityUpdates.sol"; do
if [ -f "./contracts/$contract" ]; then
echo "Contract file exists: $contract"
else
echo "Missing contract: $contract"
fi
done
Length of output: 754
Script:
#!/bin/bash
# Find all deployment scripts and check for dependency commands
fd -t f "deploy-" -x cat {} \; | grep -i "soldeer\|forge install"
Length of output: 134
| @@ -6,6 +6,6 @@ source dev/contracts/.env | |||
| cd ./contracts | |||
|
|
|||
| # Update depencencies | |||
| forge soldeer update | |||
| forge soldeer install | |||
There was a problem hiding this comment.
@fbac I changed these from update to install, so that we don't update the lockfile. I believe OpenZeppelin released a bad patch version and update was failing to unzip it. Let me know if you want to change it back?
This way also should be faster.
tl;dr
Auto deploy to testnet staging
Summary by CodeRabbit
testnet-staging.forge soldeer updatetoforge soldeer installin multiple deployment scripts.