deploy.yml

name: deploy

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  actions: write

concurrency:
  group: deploy-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  ENCLAVE_NAME: cdk

jobs:
  run-without-args:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4

      - name: Pre kurtosis run
        uses: ./.github/actions/kurtosis-pre-run
        with:
          docker_username: ${{ secrets.DOCKER_USERNAME }}
          docker_token: ${{ secrets.DOCKER_TOKEN }}

      - name: Kurtosis run
        run: kurtosis run --enclave=${{ env.ENCLAVE_NAME }} .

      - name: Inspect enclave
        run: kurtosis enclave inspect ${{ env.ENCLAVE_NAME }}

      - name: Monitor pessimistic consensus chain (CDK Erigon Permissionless RPC)
        working-directory: .github/scripts
        run: |
          ./monitor-pessimistic-chain.sh \
            --enclave ${{ env.ENCLAVE_NAME }} \
            --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} cdk-erigon-rpc-001 rpc)

      - name: Run bridge tests
        run: |
          kurtosis service exec ${{ env.ENCLAVE_NAME }} test-runner "bats --filter 'bridge native ETH from L1 to L2' tests/agglayer/bridges.bats"
          kurtosis service exec ${{ env.ENCLAVE_NAME }} test-runner "bats --filter 'bridge native ETH from L2 to L1' tests/agglayer/bridges.bats"

      - name: Post kurtosis run
        if: always()
        uses: ./.github/actions/kurtosis-post-run
        with:
          enclave_name: ${{ env.ENCLAVE_NAME }}

  list-ymls:
    runs-on: ubuntu-latest
    timeout-minutes: 2
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4

      - name: Generate test combinations
        working-directory: .github/tests
        run: ./combine-ymls.sh

      - id: set-matrix
        run: |
          # Only run a subset of the tests in CI.
          file_paths=$(ls -R ./.github/tests/combinations/*.yml ./.github/tests/nightly/op-rollup/op-default.yml)
          matrix=$(echo "${file_paths}" | while read -r file_path; do
            file_name=$(basename -s ".yml" "$file_path")
            echo "{\"name\": \"$file_name\", \"path\": \"$file_path\"}"
          done | jq -s -c '.')
          echo "matrix=${matrix}" >> $GITHUB_OUTPUT

  run-with-args:
    needs: list-ymls
    name: run-with-${{ matrix.file.name }}
    runs-on: ubuntu-latest
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        file: ${{ fromJson(needs.list-ymls.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Pre kurtosis run
        uses: ./.github/actions/kurtosis-pre-run
        with:
          docker_username: ${{ secrets.DOCKER_USERNAME }}
          docker_token: ${{ secrets.DOCKER_TOKEN }}

      - name: Kurtosis run
        run: |
          # Add test runner and tx spammer to the args file.
          yq --in-place --yaml-roundtrip '.args.additional_services += ["test_runner", "tx_spammer"]' ${{ matrix.file.path }}
          kurtosis run --enclave=${{ env.ENCLAVE_NAME }} --args-file=${{ matrix.file.path }} .

      - name: Inspect enclave
        run: kurtosis enclave inspect ${{ env.ENCLAVE_NAME }}

      - name: Monitor pessimistic chain virtual batches (Central RPC)
        run: |
          result=$(yq --raw-output '.args.consensus_contract_type' ${{ matrix.file.path }})
          if [[ "$result" == "pessimistic" ]]; then
            echo "Skipping block verification as consensus is pessimistic."
          else
            sequencer_type=$(yq --raw-output '.args.sequencer_type' ${{ matrix.file.path }})
            rpc_name=""
            if [[ "$sequencer_type" == "erigon" ]]; then
              rpc_name="cdk-erigon-rpc-001"
            elif [[ "$sequencer_type" == "zkevm" ]]; then
              rpc_name="zkevm-node-rpc-001"
            elif [[ "$sequencer_type" == "null" ]]; then
              rpc_name="cdk-erigon-rpc-001"
            else
              echo "Unknown sequencer type: $sequencer_type"
              exit 1
            fi
            echo "RPC name: $rpc_name"
            ./.github/scripts/monitor-pessimistic-chain.sh \
              --enclave ${{ env.ENCLAVE_NAME }} \
              --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} $rpc_name rpc)
          fi

      - name: Monitor CDK chain verified batches (zkEVM Permissionless RPC)
        run: |
          result=$(yq --raw-output '.args.consensus_contract_type' ${{ matrix.file.path }})
          if [[ "$result" == "pessimistic" ]]; then
            echo "Skipping block verification as consensus is pessimistic."
          else
            result=$(yq --raw-output '.args.additional_services // [] | contains(["pless_zkevm_node"])' ${{ matrix.file.path }})
            if [[ "$result" == "true" ]]; then
              ./.github/scripts/monitor-cdk-chain.sh \
                --enclave ${{ env.ENCLAVE_NAME }} \
                --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} zkevm-node-rpc-pless-001 rpc)
            else
              echo "Skipping batch verification as there is no zkevm permissionless RPC in the environment"
            fi
          fi

      - name: Monitor OP rollup finalized blocks (OP CL RPC)
        run: |
          result=$(yq --raw-output '.deployment_stages.deploy_optimism_rollup' ${{ matrix.file.path }})
          if [[ "$result" == "true" ]]; then
            ./.github/scripts/monitor-op-rollup.sh \
              --enclave ${{ env.ENCLAVE_NAME }} \
              --cl-rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} op-cl-1-op-node-op-geth-001 http)
          else
            echo "Skipping block verification as there is no OP rollup in the environment"
          fi

      - name: Run bridge tests
        run: |
          kurtosis service exec ${{ env.ENCLAVE_NAME }} test-runner "bats --filter 'bridge native ETH from L1 to L2' tests/agglayer/bridges.bats"
          kurtosis service exec ${{ env.ENCLAVE_NAME }} test-runner "bats --filter 'bridge native ETH from L2 to L1' tests/agglayer/bridges.bats"

      - name: Post kurtosis run
        if: always()
        uses: ./.github/actions/kurtosis-post-run
        with:
          enclave_name: ${{ env.ENCLAVE_NAME }}
          args_filename: ${{ matrix.file.name }}

  additional-services:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - name: Pre kurtosis run
        uses: ./.github/actions/kurtosis-pre-run
        with:
          docker_username: ${{ secrets.DOCKER_USERNAME }}
          docker_token: ${{ secrets.DOCKER_TOKEN }}

      - name: Kurtosis run
        run: kurtosis run --enclave=${{ env.ENCLAVE_NAME }} --args-file=./.github/tests/additional-services.yml .

      - name: Inspect enclave
        run: kurtosis enclave inspect ${{ env.ENCLAVE_NAME }}

      - name: Monitor pessimistic chain virtual batches (CDK Erigon Permissionless RPC)
        working-directory: .github/scripts
        run: |
          ./monitor-pessimistic-chain.sh \
            --enclave ${{ env.ENCLAVE_NAME }} \
            --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} cdk-erigon-rpc-001 rpc)

      - name: Verify arpeggio rpc
        run: |
          result=$(yq '.args.additional_services | contains(["arpeggio"])' ./.github/tests/additional-services.yml)
          if [ "$result" = "true" ]; then
            cast bn --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} arpeggio-001 rpc)
          else
            echo "Arpeggio is not deployed."
          fi

      - name: Verify blutgang rpc
        run: |
          result=$(yq '.args.additional_services | contains(["blutgang"])' ./.github/tests/additional-services.yml)
          if [ "$result" = "true" ]; then
            cast bn --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} blutgang-001 http)
          else
            echo "Blutgang is not deployed."
          fi

      - name: Verify erpc rpc
        run: |
          result=$(yq '.args.additional_services | contains(["erpc"])' ./.github/tests/additional-services.yml)
          if [ "$result" = "true" ]; then
            cast bn --rpc-url "$(kurtosis port print ${{ env.ENCLAVE_NAME }} erpc-001 rpc)/main/evm/10101"
          else
            echo "ERPC is not deployed."
          fi

      - name: Verify permissionless zkevm-node rpc
        run: |
          result=$(yq '.args.additional_services | contains(["pless_zkevm_node"])' ./.github/tests/additional-services.yml)
          if [ "$result" = "true" ]; then
            cast bn --rpc-url $(kurtosis port print ${{ env.ENCLAVE_NAME }} zkevm-node-rpc-pless-001 rpc)
          else
            echo "Permissionless zkevm-node is not deployed."
          fi

      - name: Verify that prometheus collects panoptichain metrics
        run: |
          result=$(yq '.args.additional_services | contains(["prometheus_grafana"])' ./.github/tests/additional-services.yml)
          if [ "$result" = "true" ]; then
            echo "Wait for one minute while Prometheus gathers metrics..."
            sleep 60

            echo "Retrieve Panoptichain metrics from Prometheus..."
            panoptichain_metric="panoptichain_system_uptime"
            prometheus_url=$(kurtosis port print ${{ env.ENCLAVE_NAME }} prometheus-001 http)
            prometheus_query=$(curl "$prometheus_url/api/v1/query?query=$panoptichain_metric")
            echo $prometheus_query | jq
            if [ "$(jq -r '.data.result[0].metric.__name__' <<<$prometheus_query)" == "$panoptichain_metric" ]; then
              echo "✅ Prometheus collects panoptichain metrics!"
            else
              echo "❌ Prometheus does not collect panoptichain metrics..."
              exit 1
            fi
          else
            echo "Prometheus is not deployed."
          fi

      - name: Post kurtosis run
        if: always()
        uses: ./.github/actions/kurtosis-post-run
        with:
          enclave_name: ${{ env.ENCLAVE_NAME }}
          args_filename: additional-services

  deploy-to-external-l1:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4

      - name: Pre kurtosis run
        uses: ./.github/actions/kurtosis-pre-run
        with:
          docker_username: ${{ secrets.DOCKER_USERNAME }}
          docker_token: ${{ secrets.DOCKER_TOKEN }}

      - name: Deploy local L1 chain
        run: kurtosis run --enclave=${{ env.ENCLAVE_NAME }} --args-file=./.github/tests/external-l1/deploy-local-l1.yml .

      - name: Deploy to local L1 chain
        run: |
          # Add test runner and tx spammer to the args file.
          yq --in-place --yaml-roundtrip '.args.additional_services += ["test_runner", "tx_spammer"]' .github/tests/external-l1/deploy-cdk-to-local-l1.yml
          kurtosis run --enclave=${{ env.ENCLAVE_NAME }} --args-file=./.github/tests/external-l1/deploy-cdk-to-local-l1.yml .

      - name: Inspect enclave
        run: kurtosis enclave inspect ${{ env.ENCLAVE_NAME }}

      - name: Monitor pessimistic chain virtual batches (CDK Erigon Permissionless RPC)
        working-directory: .github/scripts
        run: |
          ./monitor-pessimistic-chain.sh \
            --enclave ${{ env.ENCLAVE_NAME }} \
            --rpc-url "$(kurtosis port print ${{ env.ENCLAVE_NAME }} cdk-erigon-rpc-001 rpc)"

      - name: Run bridge tests
        run: |
          kurtosis service exec ${{ env.ENCLAVE_NAME }} test-runner "bats --filter 'bridge native ETH from L1 to L2' tests/agglayer/bridges.bats"
          kurtosis service exec ${{ env.ENCLAVE_NAME }} test-runner "bats --filter 'bridge native ETH from L2 to L1' tests/agglayer/bridges.bats"

      - name: Post kurtosis run
        if: always()
        uses: ./.github/actions/kurtosis-post-run
        with:
          enclave_name: ${{ env.ENCLAVE_NAME }}
          args_filename: deploy-to-external-l1

  run-with-cdk-op-geth-succinct:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4

      - name: Pre kurtosis run
        uses: ./.github/actions/kurtosis-pre-run
        with:
          docker_username: ${{ secrets.DOCKER_USERNAME }}
          docker_token: ${{ secrets.DOCKER_TOKEN }}

      - name: Kurtosis run
        run: kurtosis run --enclave=${{ env.ENCLAVE_NAME }} --args-file=./.github/tests/chains/op-succinct.yml .

      - name: Inspect enclave
        run: kurtosis enclave inspect ${{ env.ENCLAVE_NAME }}

      - name: Check for error logs in op-succinct-proposer service
        working-directory: .github/scripts
        run: |
          LOGS=$(kurtosis service logs ${{ env.ENCLAVE_NAME }} op-succinct-proposer-001 2>&1)
          echo "$LOGS"
          if echo "$LOGS" | grep -i "error\|exception\|failed\|fatal"; then
            echo "Errors found in container logs!"
            exit 1  # Fail the workflow if errors are found
          else
            echo "No errors found in logs."
          fi

      - name: Post kurtosis run
        if: always()
        uses: ./.github/actions/kurtosis-post-run
        with:
          enclave_name: ${{ env.ENCLAVE_NAME }}
          args_filename: cdk-op-geth-succinct