Skip to content

Commit 8a54d94

Browse files
Maddiaa0Maddiaa0
committed
Merge branch 'next' into md/opt-sol-honk
2 parents a7e0ded + 9089619 commit 8a54d94

File tree

3,144 files changed

+167803
-91213
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

3,144 files changed

+167803
-91213
lines changed

‎.github/.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
.secrets
1+
.secrets
2+
.act-tool-cache

‎.github/actions/setup-k8s-terraform/action.yml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
name: "Setup K8s and Terraform"
2+
description: "Common setup for Kubernetes cluster access and Terraform initialization"
3+
4+
inputs:
5+
cluster:
6+
description: "The cluster to deploy to (e.g., aztec-gke-private or kind)"
7+
required: true
8+
namespace:
9+
description: "The namespace to deploy to"
10+
required: true
11+
ref:
12+
description: "The branch name to deploy from"
13+
required: false
14+
default: "next"
15+
region:
16+
description: "GCP region"
17+
required: false
18+
default: "us-west1-a"
19+
gcp_sa_key:
20+
description: "GCP service account JSON key"
21+
required: true
22+
kubeconfig_b64:
23+
description: "Base64 encoded kubeconfig for kind clusters"
24+
required: false
25+
terraform_dir:
26+
description: "Terraform working directory"
27+
required: true
28+
tf_state_bucket:
29+
description: "Terraform state bucket for GCS backend"
30+
required: false
31+
default: "aztec-terraform"
32+
tf_state_prefix:
33+
description: "Terraform state prefix for GCS backend"
34+
required: true
35+
additional_state_path:
36+
description: "Additional path component for state (e.g., salt value)"
37+
required: false
38+
default: ""
39+
run_terraform_destroy:
40+
description: "Whether to run terraform destroy"
41+
required: false
42+
default: "false"
43+
44+
outputs:
45+
kubectl_context:
46+
description: "The current kubectl context"
47+
value: ${{ steps.setup_vars.outputs.kubectl_context }}
48+
49+
runs:
50+
using: "composite"
51+
steps:
52+
- name: Check if directory exists
53+
id: check_dir
54+
shell: bash
55+
run: |
56+
if [ -d ".git" ]; then
57+
echo "exists=true" >> $GITHUB_OUTPUT
58+
else
59+
echo "exists=false" >> $GITHUB_OUTPUT
60+
fi
61+
62+
- name: Checkout code
63+
if: ${{ steps.check_dir.outputs.exists != 'true' }}
64+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
65+
with:
66+
ref: ${{ inputs.ref }}
67+
68+
- name: Authenticate to Google Cloud
69+
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f
70+
with:
71+
credentials_json: ${{ inputs.gcp_sa_key }}
72+
73+
- name: Set up Cloud SDK
74+
uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a
75+
76+
- name: Install GKE Auth Plugin
77+
shell: bash
78+
run: |
79+
gcloud components install gke-gcloud-auth-plugin --quiet
80+
81+
- name: Configure kubectl with GKE cluster
82+
if: ${{ inputs.cluster != 'kind' }}
83+
shell: bash
84+
run: |
85+
gcloud container clusters get-credentials ${{ inputs.cluster }} --region ${{ inputs.region }}
86+
87+
- name: Configure kubectl with kind cluster
88+
if: ${{ inputs.cluster == 'kind' }}
89+
shell: bash
90+
run: |
91+
if [ -z "${{ inputs.kubeconfig_b64 }}" ]; then
92+
echo "KUBECONFIG_B64 is not set"
93+
exit 1
94+
fi
95+
mkdir -p $HOME/.kube
96+
echo "${{ inputs.kubeconfig_b64 }}" | base64 -d > $HOME/.kube/config
97+
kubectl config use-context kind-kind
98+
99+
- name: Set up kubectl context
100+
id: setup_vars
101+
shell: bash
102+
run: |
103+
CLUSTER_CONTEXT=$(kubectl config current-context)
104+
echo "kubectl_context=${CLUSTER_CONTEXT}" >> $GITHUB_OUTPUT
105+
echo "TF_VAR_K8S_CLUSTER_CONTEXT=${CLUSTER_CONTEXT}" >> $GITHUB_ENV
106+
107+
- name: Setup Terraform
108+
uses: hashicorp/setup-terraform@v3
109+
with:
110+
terraform_version: "1.5.0"
111+
112+
- name: Terraform Init
113+
shell: bash
114+
working-directory: ${{ inputs.terraform_dir }}
115+
run: |
116+
# Clean up any previous backend overrides
117+
rm -f backend_override.tf
118+
119+
# Build the state path
120+
STATE_PATH="${{ inputs.cluster }}/${{ inputs.namespace }}"
121+
if [ -n "${{ inputs.additional_state_path }}" ]; then
122+
STATE_PATH="${STATE_PATH}/${{ inputs.additional_state_path }}"
123+
fi
124+
125+
if [ "${{ inputs.cluster }}" == "kind" ]; then
126+
# For kind, use local backend
127+
cat > backend_override.tf << EOF
128+
terraform {
129+
backend "local" {
130+
path = "state/${STATE_PATH}/terraform.tfstate"
131+
}
132+
}
133+
EOF
134+
else
135+
# For GKE, use GCS backend
136+
cat > backend_override.tf << EOF
137+
terraform {
138+
backend "gcs" {
139+
bucket = "${{ inputs.tf_state_bucket }}"
140+
prefix = "${{ inputs.tf_state_prefix }}/${{ inputs.region }}/${STATE_PATH}/terraform.tfstate"
141+
}
142+
}
143+
EOF
144+
fi
145+
146+
terraform init -reconfigure
147+
148+
- name: Terraform Destroy
149+
if: ${{ inputs.run_terraform_destroy == 'true' }}
150+
shell: bash
151+
working-directory: ${{ inputs.terraform_dir }}
152+
continue-on-error: true
153+
run: |
154+
terraform destroy -auto-approve

‎.github/local_workflow.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
3+
# Runs a github workflow locally.
4+
#
5+
# Needs `act`. See https://nektosact.com/installation/index.html
6+
#
7+
# Bind-mounts the local directory into the container, which executes as the current user.
8+
# Attempts to use a GCP service account, which you can download from
9+
# https://console.cloud.google.com/iam-admin/serviceaccounts
10+
11+
# Your workflow may not need a GCP service account, nor a kubeconfig, etc.
12+
# Feel free to send a PR to tweak the script ;)
13+
14+
# example usage:
15+
# export GOOGLE_APPLICATION_CREDENTIALS=/your/path/to/testnet-helm-sa.json
16+
# alias lwfl=/your/path/to/aztec-clones/alpha/.github/local_workflow.sh
17+
# lwfl deploy_eth_devnet --input cluster=kind --input resource_profile=dev --input namespace=mitch-eth-devnet --input create_static_ips=false
18+
# lwfl deploy_eth_devnet --input cluster=aztec-gke-private --input resource_profile=prod --input namespace=mitch-eth-devnet --input create_static_ips=false
19+
20+
workflow_name=$1
21+
22+
REPO_ROOT=$(git rev-parse --show-toplevel)
23+
24+
if [ -z "$workflow_name" ]; then
25+
echo "Usage: $0 <workflow_name> [args ...]"
26+
exit 1
27+
fi
28+
29+
# get the rest of the args (skip the first one which is the workflow name)
30+
shift
31+
args=("$@")
32+
33+
SA_KEY_JSON=$(cat "$GOOGLE_APPLICATION_CREDENTIALS")
34+
35+
mkdir -p $REPO_ROOT/.github/.act-tool-cache
36+
37+
act workflow_dispatch -j $workflow_name \
38+
--env RUNNER_TOOL_CACHE=/work/toolcache \
39+
-s GITHUB_TOKEN="$(gh auth token)" \
40+
-s GCP_SA_KEY="$SA_KEY_JSON" \
41+
-s KUBECONFIG_B64="$(cat $HOME/.kube/config | base64 -w0)" \
42+
--container-options "-v $REPO_ROOT/.github/.act-tool-cache:/work/toolcache --user $(id -u):$(id -g)" \
43+
--bind \
44+
--directory $REPO_ROOT "${args[@]}"

‎.github/workflows/canary-release-tag.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Canary Release Tag
2+
3+
on:
4+
workflow_dispatch:
5+
6+
# Add permissions for the GitHub Actions bot to push tags
7+
permissions:
8+
contents: write
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
13+
jobs:
14+
nightly-release-tag:
15+
runs-on: ubuntu-latest
16+
steps:
17+
# Check out the repository so we can read files and create tags.
18+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
19+
with:
20+
token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
21+
22+
# Extract the current release version from the manifest.
23+
# Then, create a canary tag using the current version and the current UTC date.
24+
- name: Create Canary Tag
25+
run: |
26+
git config --global user.email "[email protected]"
27+
git config --global user.name "AztecBot"
28+
current_version=$(jq -r '."."' .release-please-manifest.json)
29+
# Compute the next major version. e.g. if current version is 1.2.3, next major version is 2.0.0.
30+
if [[ "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
31+
major=$(( ${BASH_REMATCH[1]} + 1 ))
32+
next_major_version="${major}.0.0"
33+
else
34+
echo "Error: Current version format is invalid: $current_version"
35+
exit 1
36+
fi
37+
echo "Current version: $current_version"
38+
echo "Next version: $next_major_version"
39+
canary_tag="v${next_major_version}-canary.$(git rev-parse --short HEAD)"
40+
echo "Canary tag: $canary_tag"
41+
# Tag and push.
42+
git tag -a "$canary_tag" -m "$canary_tag"
43+
git push origin "$canary_tag"

‎.github/workflows/ci3-external.yml‎

Lines changed: 42 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
with:
3232
# The commit to checkout. We want our actual commit, and not the result of merging the PR to the target.
3333
ref: ${{ github.event.pull_request.head.sha || github.sha }}
34+
persist-credentials: false
3435

3536
# NOTE: in ci3.yml we just rely on draft mode not being mergable.
3637
# Here we are a little more careful than just skipping the worklfow, in case of an edge case allowing merge.
@@ -43,7 +44,7 @@ jobs:
4344
run: |
4445
set -o pipefail
4546
git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1 &>/dev/null
46-
forbidden_changes=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }} HEAD -- ci3 .github ci.sh)
47+
forbidden_changes=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }} HEAD -- ci3 .github ci.sh scripts)
4748
if echo "$forbidden_changes" | grep -q .; then
4849
echo "Error: External PRs can't contain CI changes (forbidden files: $forbidden_changes)."
4950
exit 1
@@ -63,6 +64,10 @@ jobs:
6364
# Remove any ci-external-once labels.
6465
GITHUB_TOKEN=${{ secrets.AZTEC_BOT_GITHUB_TOKEN }} gh pr edit ${{ github.event.pull_request.number }} --remove-label "ci-external-once"
6566
67+
- name: CI Merge Queue Override (grind on PR)
68+
if: contains(github.event.pull_request.labels.*.name, 'ci-merge-queue')
69+
run: echo "CI_MERGE_QUEUE=1" >> $GITHUB_ENV
70+
6671
- name: CI Full Override
6772
if: contains(github.event.pull_request.labels.*.name, 'ci-full')
6873
run: echo "CI_FULL=1" >> $GITHUB_ENV
@@ -82,10 +87,21 @@ jobs:
8287
echo ${{ secrets.BUILD_INSTANCE_SSH_KEY }} | base64 --decode > ~/.ssh/build_instance_key
8388
chmod 600 ~/.ssh/build_instance_key
8489
90+
- name: Get Tree Hash
91+
run: echo "TREE_HASH=$(git rev-parse HEAD^{tree})" >> $GITHUB_ENV
92+
93+
- name: Check CI Cache
94+
id: ci_cache
95+
uses: actions/cache@v3
96+
with:
97+
path: ci-success.txt
98+
key: ci-external-${{ env.TREE_HASH }}
99+
85100
#############
86101
# Run
87102
#############
88103
- name: Run
104+
if: steps.ci_cache.outputs.cache-hit != 'true'
89105
env:
90106
# We need to pass these creds to start the AWS ec2 instance.
91107
# They are not injected into that instance. Instead, it has minimal
@@ -97,8 +113,32 @@ jobs:
97113
ARCH: amd64
98114
RUN_ID: ${{ github.run_id }}
99115
run: |
100-
if [ "${CI_FULL:-0}" -eq 1 ]; then
116+
if [ "${CI_MERGE_QUEUE:-0}" -eq 1 ]; then
101117
exec ./ci.sh merge-queue
118+
elif [ "${CI_FULL:-0}" -eq 1 ]; then
119+
exec ./ci.sh full
102120
else
103121
exec ./ci.sh fast
104122
fi
123+
124+
- name: Save CI Success
125+
if: steps.ci_cache.outputs.cache-hit != 'true'
126+
run: echo "success" > ci-success.txt
127+
128+
# If we have passed CI and labelled with ci-squash-and-merge, squash the PR.
129+
# This will rerun CI on the squash commit - but is intended to be a no-op due to caching.
130+
- name: CI Squash and Merge
131+
if: contains(github.event.pull_request.labels.*.name, 'ci-squash-and-merge')
132+
env:
133+
GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
134+
run: |
135+
# Reauth the git repo with our GITHUB_TOKEN
136+
git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}
137+
# Get the base commit (merge-base) for the PR
138+
./scripts/merge-train/squash-pr.sh \
139+
"${{ github.event.pull_request.number }}" \
140+
"${{ github.event.pull_request.head.ref }}" \
141+
"${{ github.event.pull_request.base.ref }}" \
142+
"${{ github.event.pull_request.base.sha }}"
143+
gh pr edit "${{ github.event.pull_request.number }}" --remove-label "ci-squash-and-merge"
144+
gh pr merge "${{ github.event.pull_request.number }}" --auto -m || true

0 commit comments

Comments
 (0)