Add kurtosis devnet for celo-rebase-13

.dockerignore

@@ -11,3 +11,6 @@ build/_workspace
 build/bin
 build/_bin
 tests/testdata
+
+# Ignore generated credentials from google-github-actions/auth
+gha-creds-*.json

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(gomod): "
     labels:

.github/workflows/contracts-celo.yaml

@@ -0,0 +1,99 @@
+name: Alfajores-Holesky Deploy Celo4 L1 Contracts
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_contracts:
+        required: false
+        type: boolean
+        default: true
+      contracts_tag:
+        required: false
+        type: string
+        default: 'celo4'
+      deployment_context:
+        required: false
+        type: string
+        default: 'test-celo4'
+      l2_chain_id:
+        required: false
+        default: '42069'
+
+jobs:
+  deploy-contracts:
+    runs-on: ubuntu-latest
+    permissions: # Must change the job token permissions to use Akeyless JWT auth
+      id-token: write
+      contents: read
+    if: ${{ ! startsWith(github.triggering_actor, 'akeyless') }}
+    env:
+      DEPLOY_CONTRACTS: ${{ github.event_name == 'push' && 'true' || inputs.deploy_contracts }}
+      CONTRACTS_TAG: ${{ github.event_name == 'push' && 'op-contracts/v1.3.0' || inputs.contracts_tag }}
+      DEPLOYMENT_CONTEXT: ${{ github.event_name == 'push' && 'test' || inputs.deployment_context }}
+      L2_CHAIN_ID: ${{ github.event_name == 'push' && '42069' || inputs.l2_chain_id }}
+      L1_CHAIN_ID: '17000' # Holesky
+      L1_RPC_URL: 'https://ethereum-holesky-rpc.publicnode.com'
+      GS_ADMIN_ADDRESS: '0xb2397dF29AFB4B4661559436180019bEb7912985'
+      GS_BATCHER_ADDRESS: '0x7fDBe8F4D22ab511340667d7Ce5675568d09eBB4'
+      GS_PROPOSER_ADDRESS: '0xdCf30236Fa0aBE2ca0BEc2eE0a2F40b16A144DB3'
+      GS_SEQUENCER_ADDRESS: '0x3e2Df8efB6fA1d6E6021572a99BB67BA9ab2C59D'
+    steps:
+
+      - name: "Get GitHub Token from Akeyless"
+        id: get_auth_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/optimism/contents=write,pull_requests=write":"PAT"}'
+
+      # "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/HOLESKY_QUICKNODE_URL":"L1_RPC_URL",
+      - name: Akeyless get secrets
+        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          static-secrets: '{
+            "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/GS_ADMIN_PRIVATE_KEY":"GS_ADMIN_PRIVATE_KEY"
+            }'
+
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Generate config JSON
+        run: |
+          cd packages/contracts-bedrock
+          ./scripts/getting-started/config-vars-celo.sh
+
+      - name: Deploy L1 contracts
+        if: ${{ env.DEPLOY_CONTRACTS != 'false' }}
+        run: |
+          export IMPL_SALT=$(openssl rand -hex 32)
+          cd packages/contracts-bedrock
+          echo "Broadcasting ..."
+          forge script scripts/Deploy.s.sol:Deploy --private-key $GS_ADMIN_PRIVATE_KEY --broadcast --rpc-url $L1_RPC_URL --legacy
+
+      - name: Generate genesis files
+        run: |
+          mkdir -p l2-config-files/$DEPLOYMENT_CONTEXT
+          cd op-node
+          go run cmd/main.go genesis l2 \
+            --deploy-config ../packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json \
+            --l1-deployments ../packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy \
+            --outfile.l2 ../l2-config-files/$DEPLOYMENT_CONTEXT/genesis-$(date +%s).json \
+            --outfile.rollup ../l2-config-files/$DEPLOYMENT_CONTEXT/rollup-$(date +%s).json \
+            --l1-rpc $L1_RPC_URL
+
+      - name: "Commit genesis files"
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '[Automatic] - Commit genesis files'
+          branch: alvarof2/contracts
+          file_pattern: 'l2-config-files packages/contracts-bedrock/**'

.github/workflows/contracts-op-stack.yaml

@@ -0,0 +1,117 @@
+name: Alfajores-Holesky Deploy OP-Stack L1 Contracts
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_contracts:
+        required: false
+        type: boolean
+        default: true
+      contracts_tag:
+        required: false
+        type: string
+        default: 'op-contracts/v1.3.0'
+      deployment_context:
+        required: false
+        type: string
+        default: 'test-alvaro'
+      l2_chain_id:
+        required: false
+        default: '42069'
+
+jobs:
+  deploy-contracts:
+    runs-on: ubuntu-latest
+    permissions: # Must change the job token permissions to use Akeyless JWT auth
+      id-token: write
+      contents: read
+    if: ${{ ! startsWith(github.triggering_actor, 'akeyless') }}
+    env:
+      DEPLOY_CONTRACTS: ${{ github.event_name == 'push' && 'true' || inputs.deploy_contracts }}
+      CONTRACTS_TAG: ${{ github.event_name == 'push' && 'op-contracts/v1.3.0' || inputs.contracts_tag }}
+      DEPLOYMENT_CONTEXT: ${{ github.event_name == 'push' && 'test' || inputs.deployment_context }}
+      L2_CHAIN_ID: ${{ github.event_name == 'push' && '42069' || inputs.l2_chain_id }}
+      L1_CHAIN_ID: '17000' # Holesky
+      L1_RPC_URL: 'https://ethereum-holesky-rpc.publicnode.com'
+      GS_ADMIN_ADDRESS: '0xb2397dF29AFB4B4661559436180019bEb7912985'
+      GS_BATCHER_ADDRESS: '0x7fDBe8F4D22ab511340667d7Ce5675568d09eBB4'
+      GS_PROPOSER_ADDRESS: '0xdCf30236Fa0aBE2ca0BEc2eE0a2F40b16A144DB3'
+      GS_SEQUENCER_ADDRESS: '0x3e2Df8efB6fA1d6E6021572a99BB67BA9ab2C59D'
+    steps:
+
+      - name: "Get GitHub Token from Akeyless"
+        id: get_auth_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/optimism/contents=write,pull_requests=write":"PAT"}'
+
+      # "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/HOLESKY_QUICKNODE_URL":"L1_RPC_URL",
+      - name: Akeyless get secrets
+        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          static-secrets: '{
+            "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/GS_ADMIN_PRIVATE_KEY":"GS_ADMIN_PRIVATE_KEY"
+            }'
+
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: "Checkout OP Repo"
+        uses: actions/checkout@v4
+        with:
+          repository: 'ethereum-optimism/optimism'
+          ref: '${{ env.CONTRACTS_TAG }}'
+          path: ethereum-optimism
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Generate config JSON
+        run: |
+          cd packages/contracts-bedrock
+          ./scripts/getting-started/config-vars-op-stack.sh
+          cp deploy-config/$DEPLOYMENT_CONTEXT.json /home/runner/work/optimism/optimism/ethereum-optimism/packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json
+
+      - name: Deploy L1 contracts
+        if: ${{ env.DEPLOY_CONTRACTS != 'false' }}
+        run: |
+          export IMPL_SALT=$(openssl rand -hex 32)
+          cd ethereum-optimism/packages/contracts-bedrock
+          echo "Broadcasting ..."
+          forge script scripts/Deploy.s.sol:Deploy --private-key $GS_ADMIN_PRIVATE_KEY --broadcast --rpc-url $L1_RPC_URL --legacy
+          mkdir -p /home/runner/work/optimism/optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT
+          cp deployments/$DEPLOYMENT_CONTEXT/.deploy /home/runner/work/optimism/optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy
+
+      - name: Copy old .deploy file if contracts not deployed
+        if: ${{ env.DEPLOY_CONTRACTS == 'false' }}
+        run: |
+          mkdir -p ethereum-optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT
+          cp packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy ethereum-optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy
+
+      - name: Generate genesis files
+        run: |
+          mkdir -p l2-config-files/$DEPLOYMENT_CONTEXT
+          cd ethereum-optimism/op-node
+          go run cmd/main.go genesis l2 \
+            --deploy-config ../packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json \
+            --l1-deployments ../packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy \
+            --outfile.l2 ../../l2-config-files/$DEPLOYMENT_CONTEXT/genesis-$(date +%s).json \
+            --outfile.rollup ../../l2-config-files/$DEPLOYMENT_CONTEXT/rollup-$(date +%s).json \
+            --l1-rpc $L1_RPC_URL
+
+      - name: "Commit genesis files"
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '[Automatic] - Commit genesis files'
+          branch: alvarof2/contracts
+          file_pattern: 'l2-config-files packages/contracts-bedrock/**'

.github/workflows/docker-build-scan.yaml

@@ -0,0 +1,70 @@
+name: Docker Build Scan
+on:
+  pull_request:
+    branches:
+      - 'master'
+      - 'celo*'
+  push:
+    branches:
+      - 'master'
+      - 'celo*'
+  workflow_dispatch:
+
+jobs:
+  detect-files-changed:
+    runs-on: ubuntu-latest
+    outputs:
+      files-changed: ${{ steps.detect-files-changed.outputs.all_changed_files }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Detect files changed
+        id: detect-files-changed
+        uses: step-security/changed-files@3dbe17c78367e7d60f00d78ae6781a35be47b4a1
+        with:
+          separator: ','
+
+  # Build op-node op-batcher op-proposer using docker-bake
+  build-op-stack:
+    runs-on: ubuntu-latest
+    needs: detect-files-changed
+    if: |
+      contains(needs.detect-files-changed.outputs.files-changed, 'go.sum') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'ops/docker') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-node/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-batcher/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-conductor/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-challenger/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-dispute-mon/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-proposer/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-service/') ||
+      contains(needs.detect-files-changed.outputs.files-changed, '.github/workflows/docker-build-scan.yaml') ||
+      github.event_name == 'workflow_dispatch' ||
+      true
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write
+    env:
+      GIT_COMMIT: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      GIT_DATE: ${{ github.event.head_commit.timestamp }}
+      IMAGE_TAGS: ${{ (github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/celo')) && 'latest,' || '') }}${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      REGISTRY: us-west1-docker.pkg.dev
+      REPOSITORY: blockchaintestsglobaltestnet/dev-images
+    steps:
+      - uses: actions/checkout@v4
+      - name: Login at GCP Artifact Registry
+        uses: celo-org/reusable-workflows/.github/actions/[email protected]
+        with:
+          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos'
+          service-account: '[email protected]'
+          docker-gcp-registries: us-west1-docker.pkg.dev
+      # We need a custom steps as it's using docker bake
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push
+        uses: docker/bake-action@v5
+        with:
+          push: true
+          source: .
+          files: docker-bake.hcl
+          targets: op-node,op-batcher,op-proposer,op-conductor,op-challenger,op-dispute-mon

.github/workflows/docker-op-ufm-build-push.yaml

@@ -0,0 +1,41 @@
+---
+name: Build op-ufm container and push to cLabs registry
+on:
+    push:
+      branches:
+        - cel4
+      paths:
+        # Run if any of the following files are changed
+        - 'op-ufm/**'
+    workflow_dispatch:
+
+jobs:
+    build:
+      runs-on: ['self-hosted', 'org', '8-cpu']
+      permissions: # Required for workload identity auth and push the trivy results to GitHub
+        contents: read
+        id-token: write
+        security-events: write
+      steps:
+
+        - name: Checkout
+          uses: actions/checkout@v4
+
+        - name: Authenticate to Google Cloud
+          uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@main
+          with:
+            workload-id-provider: projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos
+            service-account: [email protected]
+            access-token-lifetime: "60m"
+            docker-gcp-registries: us-west1-docker.pkg.dev
+
+        - name: Build, push and scan the container
+          uses: celo-org/reusable-workflows/.github/actions/build-container@main
+          with:
+            platforms: linux/amd64
+            registry: us-west1-docker.pkg.dev/devopsre/dev-images/op-ufm
+            tags: test
+            context: .
+            dockerfile: op-ufm/Dockerfile
+            push: true
+            trivy: false

.github/workflows/pages.yml

@@ -0,0 +1,36 @@
+name: Build and publish forkdiff github-pages
+permissions:
+  contents: write
+on:
+  push:
+    branches:
+      - celo[0-9]+
+
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    concurrency: ci-${{ github.ref }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # make sure to fetch the old commit we diff against
+
+      - name: Build forkdiff
+        uses: "docker://protolambda/forkdiff:0.1.0"
+        with:
+          args: -repo=/github/workspace -fork=/github/workspace/fork.yaml -out=/github/workspace/index.html
+
+      - name: Build pages
+        run: |
+          mkdir -p tmp/pages
+          mv index.html tmp/pages/index.html
+          touch tmp/pages/.nojekyll
+
+      - name: Deploy
+        uses: JamesIves/github-pages-deploy-action@v4
+        with:
+          folder: tmp/pages
+          clean: true