Skip to content

ci(deploy): scope testnet deploy to a GitHub Environment #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
rubydusa wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

ci(deploy): scope testnet deploy to a GitHub Environment #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/_deploy-testnet.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,10 @@ on:
description: 'Git ref for etherform scripts checkout (default: main)'
type: string
default: 'main'
environment:
description: 'GitHub Environment to scope the deploy to (e.g. for required reviewers + scoped secrets). Empty disables the gate.'
type: string
default: 'testnet'
secrets:
PRIVATE_KEY:
required: true
Expand All @@ -50,6 +54,7 @@ jobs:
deploy-testnet:
name: Deploy to Testnet
runs-on: ubuntu-latest
environment: ${{ inputs.environment }}
outputs:
network_name: ${{ steps.network.outputs.network_name }}
blockscout_url: ${{ steps.network.outputs.blockscout_url }}
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/_foundry-cicd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,10 @@ on:
description: 'Verify deployed contracts on Blockscout'
type: boolean
default: true
deploy-environment:
description: 'GitHub Environment to scope the testnet deploy to (e.g. for required reviewers + scoped secrets). Empty disables the gate.'
type: string
default: 'testnet'
# Halmos Options
run-halmos:
description: 'Run Halmos symbolic execution'
Expand Down Expand Up @@ -449,6 +453,7 @@ jobs:
needs.upgrade-safety.result == 'success' &&
inputs.deploy-on-pr &&
github.event_name == 'pull_request'
environment: ${{ inputs.deploy-environment }}
outputs:
blockscout_url: ${{ steps.network.outputs.blockscout_url }}
broadcast_file: ${{ steps.parse.outputs.broadcast_file }}
Expand Down
10 changes: 10 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,14 @@ If your Foundry project uses npm/yarn/pnpm for Solidity dependencies (e.g., Open
| `RPC_URL` | All workflows | Network RPC endpoint (also used for fork-based tests) |
| `DEPLOY_ENV_VARS` | Deploy workflows | Optional; newline-separated `KEY=VALUE` pairs exported as environment variables before running the deploy script |

### Protecting deploys with a GitHub Environment

The deploy job in `_deploy-testnet.yml` (and the `deploy-testnet` job in `_foundry-cicd.yml`) is scoped to a GitHub Environment via the `environment` / `deploy-environment` input (default: `testnet`).

In the consumer repo, create an Environment matching that name and configure protection rules — typically **required reviewers** and a **deployment branch policy** restricted to `main`. Store `PRIVATE_KEY` (and any deploy-only secrets) on the Environment rather than the repo, so they're only available after a maintainer approves the run.

To opt out (e.g., for an internal sandbox), pass an empty string: `environment: ''`.

## Workflow Inputs

### `_ci.yml`
Expand Down Expand Up @@ -232,6 +240,7 @@ If your Foundry project uses npm/yarn/pnpm for Solidity dependencies (e.g., Open
| `verify-contracts` | boolean | `true` | Verify on Blockscout |
| `package-manager` | string | `'none'` | Package manager (`none`, `npm`, `yarn`, `pnpm`) |
| `node-version` | string | `'20'` | Node.js version for package installation |
| `environment` | string | `'testnet'` | GitHub Environment to scope the deploy to. Empty disables the gate. |
| `etherform-ref` | string | `'main'` | Git ref for etherform scripts checkout |

### `_foundry-cicd.yml`
Expand All @@ -244,6 +253,7 @@ The all-in-one workflow accepts all inputs from the above workflows plus:
| `contract-paths` | string | `src/**`, `script/**`, etc. | Paths to watch for changes |
| `main-branch` | string | `'main'` | Base branch for upgrade safety comparison |
| `deploy-on-pr` | boolean | `false` | Deploy to testnet on PR |
| `deploy-environment` | string | `'testnet'` | GitHub Environment to scope the deploy to. Empty disables the gate. |

All workflows also accept `etherform-ref` (default: `'main'`) to control which etherform branch the scripts are checked out from. Override this when testing against an unreleased etherform branch.

Expand Down