devnet-deploy.yml

name: Deploy devnet

on:
  workflow_dispatch:
    inputs:
      namespace:
        description: The namespace to deploy to, e.g. smoke
        required: true
      aztec_docker_image:
        description: The Aztec Docker image to use
        required: true
      deployment_mnemonic_secret_name:
        description: The name of the secret which holds the boot node's contract deployment mnemonic
        required: true
        default: testnet-deployment-mnemonic
      deployment_salt:
        description: The salt to use for this deployment. Defaults to random
        required: false
        type: string
        default: ""
      respect_tf_lock:
        description: Whether to respect the Terraform lock
        required: false
        default: "true"
      sepolia_deployment:
        description: Whether to deploy to Sepolia
        required: false
        default: "false"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  CONTRACT_S3_BUCKET: s3://static.aztec.network
  CLUSTER_NAME: aztec-gke
  REGION: us-west1-a
  NAMESPACE: ${{ inputs.namespace }}
  AZTEC_DOCKER_IMAGE: ${{ inputs.aztec_docker_image }}

jobs:
  deploy-network:
    uses: ./.github/workflows/network-deploy.yml
    with:
      namespace: ${{ github.event.inputs.namespace }}
      values_file: release-devnet.yaml
      aztec_docker_image: ${{ github.event.inputs.aztec_docker_image }}
      deployment_mnemonic_secret_name: ${{ github.event.inputs.deployment_mnemonic_secret_name }}
      deployment_salt: ${{ github.event.inputs.deployment_salt }}
      respect_tf_lock: ${{ github.event.inputs.respect_tf_lock }}
      run_terraform_destroy: "true"
      sepolia_deployment: ${{ github.event.inputs.sepolia_deployment }}
    secrets:
      GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}

  bootstrap-network:
    runs-on: ubuntu-latest
    needs: deploy-network
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-2

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Setup kubectl access
        run: |
          gcloud components install kubectl gke-gcloud-auth-plugin --quiet
          gcloud container clusters get-credentials ${{ env.CLUSTER_NAME }} --region ${{ env.REGION }}

      - name: Setup helm
        run: |
          curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
          chmod +x get_helm.sh
          sudo ./get_helm.sh
          rm get_helm.sh

      - name: Bootstrap network
        run: |
          set -eu -o pipefail

          port_forward_pids=()

          cleanup() {
              echo "Cleaning up port-forwards..."
              for pid in "${port_forward_pids[@]}"; do
                  kill $pid 2>/dev/null
              done
          }

          trap cleanup EXIT

          echo "Waiting for PXE pods to be ready..."
          if ! kubectl wait -n $NAMESPACE --for=condition=ready pod -l app=pxe --timeout=10m; then
              echo "Error: PXE pods did not become ready within timeout"
              exit 1
          fi

          helm get values $NAMESPACE -n $NAMESPACE -o json --all > helm_values.json

          PXE_PORT="$(jq -r .pxe.service.nodePort helm_values.json)"
          FAUCET_PORT="$(jq -r .faucet.apiServerPort helm_values.json)"
          ETHEREUM_PORT="$(jq -r .ethereum.service.port helm_values.json)"
          L1_CHAIN_ID="$(jq -r .ethereum.chainId helm_values.json)"

          MNEMONIC="$(jq -r .aztec.l1DeploymentMnemonic helm_values.json)"
          echo "::add-mask::$MNEMONIC"

          rm helm_values.json

          kubectl port-forward -n $NAMESPACE svc/$NAMESPACE-aztec-network-pxe $PXE_PORT &>/dev/null &
          port_forward_pids+=($!)

          kubectl port-forward -n $NAMESPACE svc/$NAMESPACE-aztec-network-faucet-api $FAUCET_PORT &>/dev/null &
          port_forward_pids+=($!)

          # port-forward directly to the pod because the Eth node does not have a service definition
          ETH_POD_NAME=$(kubectl get pods -n $NAMESPACE -l app=ethereum -o jsonpath='{.items[0].metadata.name}')
          kubectl port-forward -n $NAMESPACE pod/$ETH_POD_NAME $ETHEREUM_PORT &>/dev/null &
          port_forward_pids+=($!)

          # wait for port-forwards to establish
          sleep 5

          docker run --rm --network host $AZTEC_DOCKER_IMAGE bootstrap-network \
            --rpc-url http://127.0.0.1:$PXE_PORT \
            --l1-rpc-url http://127.0.0.1:$ETHEREUM_PORT \
            --l1-chain-id "$L1_CHAIN_ID" \
            --mnemonic "$MNEMONIC" \
            --json | tee ./basic_contracts.json

          aws s3 cp ./basic_contracts.json ${{ env.CONTRACT_S3_BUCKET }}/devnet/basic_contracts.json

          DEVCOIN_L1_ADDRESS=$(jq -r .devCoinL1 ./basic_contracts.json)
          DEVCOIN_DRIP_AMOUNT=1000000000
          curl -X POST -d address=$DEVCOIN_L1_ADDRESS -d amount=$DEVCOIN_DRIP_AMOUNT \
            http://127.0.0.1:$FAUCET_PORT/l1-asset