feat: support generic keys in wizards #5121
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, closed] | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| inputs: | |
| sha: | |
| description: 'Commit SHA to build' | |
| required: true | |
| type: string | |
| env: | |
| AWS_REGION: "eu-central-1" | |
| SSH_AUTH_SOCK: /tmp/ssh_agent.sock | |
| permissions: | |
| id-token: write | |
| contents: write | |
| packages: write | |
| jobs: | |
| ### Pre merge workflow ############################################################################################################### | |
| build-linux-x86_64-pre-merge: | |
| runs-on: nixos | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == false | |
| steps: | |
| - name: Clean runner environment | |
| run: rm -rf ./* | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| clean: true | |
| - name: Restore Rust cache from host | |
| run: | | |
| set -e | |
| echo "--- Restoring Rust cache from host ---" | |
| if [ -d /tmp/rust-cache ]; then | |
| echo "Rust cache found. Restoring..." | |
| mkdir -p ~/.cargo/git ~/.cargo/registry ./target | |
| nix shell nixpkgs#rsync -c bash -c " | |
| rsync -a /tmp/rust-cache/cargo-git/ ~/.cargo/git/ | |
| rsync -a /tmp/rust-cache/cargo-registry/ ~/.cargo/registry/ | |
| rsync -a /tmp/rust-cache/target/ ./target/ | |
| " | |
| else | |
| echo "No Rust cache found. Will be created after build." | |
| fi | |
| - name: Acquire AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_ARN_SECRET }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Login to container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ secrets.ECR_REGISTRY_SECRET }} | |
| - name: Build | |
| run: nix develop -c bash -c "cargo build --locked --profile=release" | |
| - name: Test | |
| run: nix develop -c bash -c "cargo test --locked --profile=release --features=runtime-benchmarks" | |
| - name: Lint | |
| run: nix develop -c bash -c "RUSTFLAGS=-Dwarnings cargo clippy --all-targets --all-features" | |
| - name: Formatting | |
| run: nix develop -c bash -c "cargo fmt --check" | |
| - name: Save Rust cache to host | |
| if: always() | |
| run: | | |
| set -e | |
| echo "--- Saving Rust cache to host cache ---" | |
| mkdir -p /tmp/rust-cache | |
| nix shell nixpkgs#rsync -c bash -c " | |
| rsync -a ~/.cargo/git/ /tmp/rust-cache/cargo-git/ | |
| rsync -a ~/.cargo/registry/ /tmp/rust-cache/cargo-registry/ | |
| rsync -a ./target/ /tmp/rust-cache/target/ | |
| " | |
| echo "--- Verifying cache contents ---" | |
| ls -laR /tmp/rust-cache | |
| #- name: Run cargo-deny to check licenses | |
| # uses: EmbarkStudios/cargo-deny-action@v1 | |
| # with: | |
| # command: check licenses | |
| - name: Build chain specs | |
| run: | | |
| source ./dev/envs/devnet/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh devnet_chain_spec.json" | |
| source ./dev/envs/ci-preview/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh ci_preview_chain_spec.json" | |
| source ./dev/envs/staging-preview/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh staging_preview_chain_spec.json" | |
| - name: Build and push docker image | |
| run: | | |
| cp target/release/partner-chains-demo-node . | |
| nix develop -c bash -c "patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 partner-chains-demo-node" | |
| docker build -t ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }} . | |
| docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }} | |
| - name: Upload partner-chains-node artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: partner-chains-node-artifact | |
| path: ./partner-chains-demo-node | |
| - name: Upload chain spec artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: chain-specs | |
| path: | | |
| ./devnet_chain_spec.json | |
| ./ci_preview_chain_spec.json | |
| ./staging_preview_chain_spec.json | |
| local-env: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == false | |
| needs: build-linux-x86_64-pre-merge | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| markers: [smoke, rpc, reserve, governed_map, delegator_rewards, ariadne, wizards] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - name: Deploy and test against local environment | |
| uses: ./.github/actions/tests/local-environment-tests | |
| with: | |
| tag: CI | |
| image: ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }} | |
| sha: ${{ github.sha }} | |
| markers: ${{ matrix.markers }} | |
| env: | |
| SUBSTRATE_REPO_SSH_KEY: ${{ secrets.SUBSTRATE_REPO_SSH_KEY }} | |
| AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }} | |
| AWS_REGION: ${{ env.AWS_REGION }} | |
| ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }} | |
| ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }} | |
| TEST_ENVIRONMENT: local | |
| local-env-alert: | |
| needs: local-env | |
| if: >- | |
| always() && ( | |
| needs.local-env.result != 'skipped' | |
| ) && github.event_name == 'pull_request' && github.event.pull_request.merged == false | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| markers: [smoke, rpc, reserve, governed_map, delegator_rewards, ariadne, wizards] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - name: Download test report | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: test-results-${{ matrix.markers }} | |
| path: e2e-tests/logs-${{ matrix.markers }} | |
| - name: Report to slack | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| JIRA_URL: ${{ secrets.JIRA_URL }} | |
| repository: ${{ github.repository }} | |
| slack_ref_name: ${{ github.ref_name }} | |
| job_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| github_actor_username: ${{ github.actor }} | |
| env: local-pre-merge | |
| run: | | |
| cd e2e-tests | |
| # Ensure logs directory exists | |
| mkdir -p logs | |
| # Copy downloaded artifacts to where the script expects them, including hidden files | |
| cp -r logs-${{ matrix.markers }}/. logs/ | |
| ./report_slack.sh $repository $slack_ref_name $job_url $env $github_actor_username null "${{ matrix.markers }}" | |
| shell: bash | |
| documentation-tests: | |
| needs: build-linux-x86_64-pre-merge | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == false | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - name: Run Documentation Tests | |
| uses: ./.github/actions/tests/doc-tests | |
| upload-chain-specs-pre-merge: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == false | |
| needs: build-linux-x86_64-pre-merge | |
| runs-on: eks | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - name: Upload chain spec artifacts to Kubernetes | |
| uses: ./.github/actions/deploy/upload-chain-specs | |
| with: | |
| sha: ${{ needs.build-linux-x86_64-pre-merge.outputs.sha }} | |
| env: | |
| kubeconfig_base64: ${{ secrets.kubeconfig_base64 }} | |
| K8S_SERVER: ${{ secrets.K8S_SERVER }} | |
| K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }} | |
| pre-merge-checks-complete: | |
| if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.merged == false }} | |
| needs: [ | |
| build-linux-x86_64-pre-merge, | |
| local-env, | |
| upload-chain-specs-pre-merge, | |
| documentation-tests | |
| ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check if any needed job failed | |
| run: | | |
| if [[ "${{ needs.build-linux-x86_64-pre-merge.result }}" != "success" || | |
| "${{ needs.local-env.result }}" != "success" || | |
| "${{ needs.upload-chain-specs-pre-merge.result }}" != "success" || | |
| "${{ needs.documentation-tests.result }}" != "success" ]]; then | |
| echo "One or more needed jobs failed." | |
| exit 1 | |
| else | |
| echo "All needed jobs passed." | |
| fi | |
| ### Post merge workflow ############################################################################################################### | |
| build-linux-x86_64-post-merge: | |
| runs-on: nixos | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == true | |
| outputs: | |
| sha: ${{ steps.get_sha.outputs.sha }} | |
| steps: | |
| - name: Clean runner environment | |
| run: rm -rf ./* | |
| - name: Checkout master branch code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: master | |
| clean: true | |
| - name: Restore Rust cache from host | |
| run: | | |
| set -e | |
| echo "--- Restoring Rust cache from host ---" | |
| if [ -d /tmp/rust-cache ]; then | |
| echo "Rust cache found. Restoring..." | |
| mkdir -p ~/.cargo/git ~/.cargo/registry ./target | |
| nix shell nixpkgs#rsync -c bash -c " | |
| rsync -a /tmp/rust-cache/cargo-git/ ~/.cargo/git/ | |
| rsync -a /tmp/rust-cache/cargo-registry/ ~/.cargo/registry/ | |
| rsync -a /tmp/rust-cache/target/ ./target/ | |
| " | |
| else | |
| echo "No Rust cache found. Will be created after build." | |
| fi | |
| - name: Get current commit SHA | |
| id: get_sha | |
| run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT | |
| - name: Acquire AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_ARN_SECRET }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Login to container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ secrets.ECR_REGISTRY_SECRET }} | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build | |
| run: nix develop -c bash -c "cargo build --locked --profile=release" | |
| - name: Build chain specs | |
| run: | | |
| source ./dev/envs/devnet/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh devnet_chain_spec.json" | |
| source ./dev/envs/ci-preview/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh ci_preview_chain_spec.json" | |
| source ./dev/envs/staging-preview/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh staging_preview_chain_spec.json" | |
| - name: Build and push docker image | |
| run: | | |
| cp target/release/partner-chains-demo-node . | |
| nix develop -c bash -c "patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 partner-chains-demo-node" | |
| docker build -t ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} . | |
| docker tag ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest | |
| docker tag ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest | |
| docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} | |
| docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest | |
| docker push ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest | |
| - name: Save Rust cache to host | |
| if: always() | |
| run: | | |
| set -e | |
| echo "--- Saving Rust cache to host cache ---" | |
| mkdir -p /tmp/rust-cache | |
| nix shell nixpkgs#rsync -c bash -c " | |
| rsync -a ~/.cargo/git/ /tmp/rust-cache/cargo-git/ | |
| rsync -a ~/.cargo/registry/ /tmp/rust-cache/cargo-registry/ | |
| rsync -a ./target/ /tmp/rust-cache/target/ | |
| " | |
| echo "--- Verifying cache contents ---" | |
| ls -laR /tmp/rust-cache | |
| - name: Rename artifact | |
| run: | | |
| cp ./partner-chains-demo-node partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux | |
| chmod +x ./partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux | |
| cp ./partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux partner-chains-node-binary | |
| #- name: Copy to binary-host | |
| # uses: ./.github/actions/artifacts/copy-to-binary-host | |
| # with: | |
| # sha: ${{ steps.get_sha.outputs.sha }} | |
| # env: "ci-preview" | |
| # env: | |
| # AWS_REGION: "eu-central-1" | |
| # AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }} | |
| # kubeconfig_base64: ${{ secrets.kubeconfig_base64 }} | |
| # K8S_SERVER: ${{ secrets.K8S_SERVER }} | |
| # K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }} | |
| - name: Upload partner-chains-node artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: partner-chains-node-linux-artifact | |
| path: partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux | |
| - name: Upload chain spec artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: chain-specs | |
| path: | | |
| devnet_chain_spec.json | |
| ci_preview_chain_spec.json | |
| staging_preview_chain_spec.json | |
| upload-to-s3: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == true | |
| needs: | |
| - build-linux-x86_64-post-merge | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: write | |
| steps: | |
| - name: Checkout master | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: master | |
| - name: Get current commit SHA | |
| id: get_sha | |
| run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT | |
| - name: Upload Artifacts to S3 | |
| uses: ./.github/actions/artifacts/upload-to-s3 | |
| with: | |
| sha: ${{ steps.get_sha.outputs.sha }} | |
| bucket-name: ${{ secrets.AWS_CD_ARTIFACT_S3_BUCKET }} | |
| env: | |
| AWS_REGION: ${{ env.AWS_REGION }} | |
| AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_S3_ROLE_ARN_SECRET }} | |
| upload-chain-specs: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == true | |
| needs: build-linux-x86_64-post-merge | |
| runs-on: eks | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: master | |
| - name: Upload chain spec artifacts to Kubernetes | |
| uses: ./.github/actions/deploy/upload-chain-specs | |
| with: | |
| sha: ${{ needs.build-linux-x86_64-post-merge.outputs.sha }} | |
| env: | |
| kubeconfig_base64: ${{ secrets.kubeconfig_base64 }} | |
| K8S_SERVER: ${{ secrets.K8S_SERVER }} | |
| K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }} | |
| deploy-rustdoc: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == true | |
| needs: build-linux-x86_64-post-merge | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: master | |
| - name: Deploy Rust Docs | |
| uses: ./.github/actions/deploy/deploy-rustdoc | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| deploy-ci-preview: | |
| needs: | |
| - build-linux-x86_64-post-merge | |
| permissions: | |
| id-token: write | |
| contents: write | |
| runs-on: eks | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: master | |
| - name: Deploy ci-preview | |
| uses: ./.github/actions/deploy/deploy-ci-preview | |
| with: | |
| image: ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ needs.build-linux-x86_64-post-merge.outputs.sha }} | |
| sha: ${{ needs.build-linux-x86_64-post-merge.outputs.sha }} | |
| no-wipe: true | |
| env: | |
| AWS_REGION: "eu-central-1" | |
| SSH_AUTH_SOCK: /tmp/ssh_agent.sock | |
| ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }} | |
| AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }} | |
| ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }} | |
| kubeconfig_base64: ${{ secrets.kubeconfig_base64 }} | |
| K8S_SERVER: ${{ secrets.K8S_SERVER }} | |
| K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }} | |
| ci-preview-tests-post-merge: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.merged == true | |
| needs: deploy-ci-preview | |
| runs-on: eks | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: master | |
| - name: Setup tests | |
| uses: ./.github/actions/tests/setup-python | |
| env: | |
| ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }} | |
| kubeconfig_base64: ${{ secrets.kubeconfig_base64 }} | |
| K8S_SERVER: ${{ secrets.K8S_SERVER }} | |
| K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }} | |
| - name: Test against ci-preview | |
| uses: ./.github/actions/tests/run-e2e-tests | |
| with: | |
| env: ci | |
| decrypt: true | |
| blockchain: substrate | |
| post-merge-actions-complete: | |
| if: ${{ always() && (github.event_name == 'pull_request' && github.event.pull_request.merged == true) }} | |
| needs: | |
| [ | |
| build-linux-x86_64-post-merge, | |
| deploy-rustdoc, | |
| upload-chain-specs, | |
| ci-preview-tests-post-merge, | |
| deploy-ci-preview, | |
| upload-to-s3, | |
| ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check if any needed job failed | |
| run: | | |
| if [[ "${{ needs.build-linux-x86_64-post-merge.result }}" != "success" || | |
| "${{ needs.deploy-rustdoc.result }}" != "success" || | |
| "${{ needs.upload-chain-specs.result }}" != "success" || | |
| "${{ needs.ci-preview-tests-post-merge.result }}" != "success" || | |
| "${{ needs.deploy-ci-preview.result }}" != "success" || | |
| "${{ needs.upload-to-s3.result }}" != "success" ]]; then | |
| echo "One or more needed jobs failed." | |
| exit 1 | |
| else | |
| echo "All needed jobs passed." | |
| fi | |
| ### Workflow dispatch flow ############################################################################################################### | |
| build-linux-x86_64-workflow-dispatch: | |
| runs-on: nixos | |
| if: github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: Clean runner environment | |
| run: rm -rf ./* | |
| - name: Checkout target code to build | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ inputs.sha }} | |
| clean: true | |
| - name: Restore Rust cache from host | |
| run: | | |
| set -e | |
| echo "--- Restoring Rust cache from host ---" | |
| if [ -d /tmp/rust-cache ]; then | |
| echo "Rust cache found. Restoring..." | |
| mkdir -p ~/.cargo/git ~/.cargo/registry ./target | |
| nix shell nixpkgs#rsync -c bash -c " | |
| rsync -a /tmp/rust-cache/cargo-git/ ~/.cargo/git/ | |
| rsync -a /tmp/rust-cache/cargo-registry/ ~/.cargo/registry/ | |
| rsync -a /tmp/rust-cache/target/ ./target/ | |
| " | |
| else | |
| echo "No Rust cache found. Will be created after build." | |
| fi | |
| - name: Acquire AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_ARN_SECRET }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Login to container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ secrets.ECR_REGISTRY_SECRET }} | |
| - name: Build | |
| run: nix develop -c bash -c "cargo build --locked --profile=release" | |
| - name: Test | |
| run: nix develop -c bash -c "cargo test --locked --profile=release --features=runtime-benchmarks" | |
| - name: Lint | |
| run: nix develop -c bash -c "RUSTFLAGS=-Dwarnings cargo clippy --all-targets --all-features" | |
| - name: Formatting | |
| run: nix develop -c bash -c "cargo fmt --check" | |
| - name: Save Rust cache to host | |
| if: always() | |
| run: | | |
| set -e | |
| echo "--- Saving Rust cache to host cache ---" | |
| mkdir -p /tmp/rust-cache | |
| nix shell nixpkgs#rsync -c bash -c " | |
| rsync -a ~/.cargo/git/ /tmp/rust-cache/cargo-git/ | |
| rsync -a ~/.cargo/registry/ /tmp/rust-cache/cargo-registry/ | |
| rsync -a ./target/ /tmp/rust-cache/target/ | |
| " | |
| echo "--- Verifying cache contents ---" | |
| ls -laR /tmp/rust-cache | |
| #- name: Run cargo-deny to check licenses | |
| # uses: EmbarkStudios/cargo-deny-action@v1 | |
| # with: | |
| # command: check licenses | |
| - name: Build chain specs | |
| run: | | |
| source dev/envs/devnet/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh devnet_chain_spec.json" | |
| source dev/envs/ci-preview/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh ci_preview_chain_spec.json" | |
| source dev/envs/staging-preview/.envrc | |
| target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json | |
| nix develop -c bash -c "./dev/update-chain-spec.sh staging_preview_chain_spec.json" | |
| - name: Build and push docker image | |
| run: | | |
| cp target/release/partner-chains-demo-node . | |
| nix develop -c bash -c "patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 partner-chains-demo-node" | |
| docker build -t ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }} . | |
| docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }} | |
| - name: Rename and prepare artifact for workflow dispatch | |
| run: | | |
| ARTIFACT_NAME="partner-chains-node-${{ inputs.sha }}-x86_64-linux" | |
| cp ./partner-chains-demo-node "$ARTIFACT_NAME" | |
| chmod +x "$ARTIFACT_NAME" | |
| shell: bash | |
| - name: Upload partner-chains-node artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: partner-chains-node-linux-artifact | |
| path: partner-chains-node-${{ inputs.sha }}-x86_64-linux | |
| - name: Upload chain spec artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: chain-specs | |
| path: | | |
| devnet_chain_spec.json | |
| ci_preview_chain_spec.json | |
| staging_preview_chain_spec.json | |
| upload-to-s3-workflow-dispatch: | |
| if: github.event_name == 'workflow_dispatch' | |
| needs: | |
| - build-linux-x86_64-workflow-dispatch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: write | |
| steps: | |
| - name: Checkout specific SHA | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.sha }} | |
| - name: Upload Artifacts to S3 | |
| uses: ./.github/actions/artifacts/upload-to-s3 | |
| with: | |
| sha: ${{ inputs.sha }} | |
| bucket-name: ${{ secrets.AWS_CD_ARTIFACT_S3_BUCKET }} | |
| env: | |
| AWS_REGION: ${{ env.AWS_REGION }} | |
| AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_S3_ROLE_ARN_SECRET }} | |
| upload-chain-specs-workflow-dispatch: | |
| if: github.event_name == 'workflow_dispatch' | |
| needs: build-linux-x86_64-workflow-dispatch | |
| runs-on: eks | |
| steps: | |
| - name: Checkout specific SHA | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.sha }} | |
| - name: Upload chain spec artifacts to Kubernetes | |
| uses: ./.github/actions/deploy/upload-chain-specs | |
| with: | |
| sha: ${{ inputs.sha }} | |
| env: | |
| kubeconfig_base64: ${{ secrets.kubeconfig_base64 }} | |
| K8S_SERVER: ${{ secrets.K8S_SERVER }} | |
| K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }} | |
| workflow-dispatch-flow-complete: | |
| if: ${{ always() && github.event_name == 'workflow_dispatch' }} | |
| needs: [build-linux-x86_64-workflow-dispatch, upload-to-s3-workflow-dispatch, upload-chain-specs-workflow-dispatch] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check if any needed job failed | |
| run: | | |
| if [[ "${{ needs.build-linux-x86_64-workflow-dispatch.result }}" != "success" || | |
| "${{ needs.upload-to-s3-workflow-dispatch.result }}" != "success" || | |
| "${{ needs.upload-chain-specs-workflow-dispatch.result }}" != "success" ]]; then | |
| echo "One or more needed jobs failed." | |
| exit 1 | |
| else | |
| echo "All needed jobs passed." | |
| fi |