Feature/ci multisig management (#132)

avernikoz · web-flow · commit 17c5307d16cd · 2026-02-22T17:39:30.000+04:00
diff --git a/.github/workflows/build-manage-multisig-config-tx.yml b/.github/workflows/build-manage-multisig-config-tx.yml
@@ -1,4 +1,4 @@
-name: Manage Multisig Config
+name: Build Multisig Config Transaction
 
 on:
     workflow_dispatch:
@@ -19,6 +19,7 @@ jobs:
             MULTISIG_SIGNERS_BASE64_PUBKEYS: ${{ vars.MULTISIG_SIGNERS_BASE64_PUBKEYS }}
             MULTISIG_THRESHOLD: ${{ vars.MULTISIG_THRESHOLD }}
             MULTISIG_WEIGHTS: ${{ vars.MULTISIG_WEIGHTS }}
+            MULTISIG_ADMIN_CAP_HOLDER_ADDRESS: ${{ vars.MULTISIG_ADMIN_CAP_HOLDER_ADDRESS }}
         steps:
             - name: Checkout Code
               uses: actions/checkout@v4
diff --git a/.github/workflows/build-manage-version-tx.yml b/.github/workflows/build-manage-version-tx.yml
@@ -1,47 +1,47 @@
-name: Manage Protocol Version
+name: Build Protocol Version Transaction
 
 on:
-    workflow_dispatch:
-        inputs:
-            action_type:
-                description: "Select action"
-                type: choice
-                options:
-                    - Enable Version
-                    - Disable Version
-            target_version:
-                description: "Protocol Version Number (e.g., 1, 2, etc.)"
-                required: true
-                type: string
+  workflow_dispatch:
+    inputs:
+      action_type:
+        description: "Select action"
+        type: choice
+        options:
+          - Enable Version
+          - Disable Version
+      target_version:
+        description: "Protocol Version Number (e.g., 1, 2, etc.)"
+        required: true
+        type: string
 
 jobs:
-    build-version-tx:
-        runs-on: ubuntu-latest
-        env:
-            # Multisig specific config (can be secrets or vars)
-            MULTISIG_ADDRESS: ${{ vars.MULTISIG_ADDRESS }}
-            MULTISIG_SIGNERS_BASE64_PUBKEYS: ${{ vars.MULTISIG_SIGNERS_BASE64_PUBKEYS }}
-            MULTISIG_THRESHOLD: ${{ vars.MULTISIG_THRESHOLD }}
-            MULTISIG_WEIGHTS: ${{ vars.MULTISIG_WEIGHTS }}
+  build-version-tx:
+    runs-on: ubuntu-latest
+    env:
+      # Multisig specific config (can be secrets or vars)
+      MULTISIG_ADDRESS: ${{ vars.MULTISIG_ADDRESS }}
+      MULTISIG_SIGNERS_BASE64_PUBKEYS: ${{ vars.MULTISIG_SIGNERS_BASE64_PUBKEYS }}
+      MULTISIG_THRESHOLD: ${{ vars.MULTISIG_THRESHOLD }}
+      MULTISIG_WEIGHTS: ${{ vars.MULTISIG_WEIGHTS }}
 
-            # Dynamic Inputs
-            PROTOCOL_VERSION: ${{ inputs.target_version }}
-        steps:
-            - name: Checkout Code
-              uses: actions/checkout@v4
+      # Dynamic Inputs
+      PROTOCOL_VERSION: ${{ inputs.target_version }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
 
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 20
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
 
-            - name: Install Dependencies
-              run: npm ci
+      - name: Install Dependencies
+        run: npm ci
 
-            - name: Build Enable Version Transaction
-              if: ${{ inputs.action_type == 'Enable Version' }}
-              run: npx tsx examples/treasury/versions/enable-version.ts
+      - name: Build Enable Version Transaction
+        if: ${{ inputs.action_type == 'Enable Version' }}
+        run: npx tsx examples/treasury/versions/enable-version.ts
 
-            - name: Build Disable Version Transaction
-              if: ${{ inputs.action_type == 'Disable Version' }}
-              run: npx tsx examples/treasury/versions/disable-version.ts
+      - name: Build Disable Version Transaction
+        if: ${{ inputs.action_type == 'Disable Version' }}
+        run: npx tsx examples/treasury/versions/disable-version.ts
diff --git a/.github/workflows/build-withdraw-fees-tx.yml b/.github/workflows/build-withdraw-fees-tx.yml
@@ -1,52 +1,52 @@
-name: Withdraw Fees Transaction
+name: Build Withdraw Fees Transaction
 
 on:
-    workflow_dispatch:
-        inputs:
-            withdrawal_type:
-                description: "Select what to withdraw"
-                type: choice
-                options:
-                    - Withdraw Protocol Fees
-                    - Withdraw Coverage Fees
-                    - Withdraw DEEP Reserves
-            tickets:
-                description: "Comma-separated list of Ticket Object IDs (e.g. 0x123..., 0xabc...)"
-                required: true
-                type: string
+  workflow_dispatch:
+    inputs:
+      withdrawal_type:
+        description: "Select what to withdraw"
+        type: choice
+        options:
+          - Withdraw Protocol Fees
+          - Withdraw Coverage Fees
+          - Withdraw DEEP Reserves
+      tickets:
+        description: "Comma-separated list of Ticket Object IDs (e.g. 0x123..., 0xabc...)"
+        required: true
+        type: string
 
 jobs:
-    build-withdraw-tx:
-        runs-on: ubuntu-latest
-        env:
-            # Multisig specific config (can be secrets or vars)
-            MULTISIG_ADDRESS: ${{ vars.MULTISIG_ADDRESS }}
-            MULTISIG_SIGNERS_BASE64_PUBKEYS: ${{ vars.MULTISIG_SIGNERS_BASE64_PUBKEYS }}
-            MULTISIG_THRESHOLD: ${{ vars.MULTISIG_THRESHOLD }}
-            MULTISIG_WEIGHTS: ${{ vars.MULTISIG_WEIGHTS }}
-
-            # Dynamic Inputs
-            TICKETS: ${{ inputs.tickets }}
-        steps:
-            - name: Checkout Code
-              uses: actions/checkout@v4
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-
-            - name: Install Dependencies
-              run: npm ci
-
-            - name: Build Protocol Fees Withdrawal
-              if: ${{ inputs.withdrawal_type == 'Withdraw Protocol Fees' }}
-              run: npx tsx examples/ticket/admin-withdraw-protocol-fee.ts
-
-            - name: Build Coverage Fees Withdrawal
-              if: ${{ inputs.withdrawal_type == 'Withdraw Coverage Fees' }}
-              run: npx tsx examples/ticket/admin-withdraw-all-coins-coverage-fee.ts
-
-            - name: Build DEEP Reserves Withdrawal
-              if: ${{ inputs.withdrawal_type == 'Withdraw DEEP Reserves' }}
-              run: npx tsx examples/ticket/admin-withdraw-all-deep-reserves.ts
+  build-withdraw-tx:
+    runs-on: ubuntu-latest
+    env:
+      # Multisig specific config (can be secrets or vars)
+      MULTISIG_ADDRESS: ${{ vars.MULTISIG_ADDRESS }}
+      MULTISIG_SIGNERS_BASE64_PUBKEYS: ${{ vars.MULTISIG_SIGNERS_BASE64_PUBKEYS }}
+      MULTISIG_THRESHOLD: ${{ vars.MULTISIG_THRESHOLD }}
+      MULTISIG_WEIGHTS: ${{ vars.MULTISIG_WEIGHTS }}
+
+      # Dynamic Inputs
+      TICKETS: ${{ inputs.tickets }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Build Protocol Fees Withdrawal
+        if: ${{ inputs.withdrawal_type == 'Withdraw Protocol Fees' }}
+        run: npx tsx examples/ticket/admin-withdraw-protocol-fee.ts
+
+      - name: Build Coverage Fees Withdrawal
+        if: ${{ inputs.withdrawal_type == 'Withdraw Coverage Fees' }}
+        run: npx tsx examples/ticket/admin-withdraw-all-coins-coverage-fee.ts
+
+      - name: Build DEEP Reserves Withdrawal
+        if: ${{ inputs.withdrawal_type == 'Withdraw DEEP Reserves' }}
+        run: npx tsx examples/ticket/admin-withdraw-all-deep-reserves.ts
diff --git a/examples/multisig/buildAndLogMultisigTransaction.ts b/examples/multisig/buildAndLogMultisigTransaction.ts
@@ -7,8 +7,8 @@ import { MULTISIG_CONFIG } from "./multisig";
  * Handles the boilerplate of building, dry running, and logging a multisig transaction.
  * @param tx - The transaction block to process.
  */
-export async function buildAndLogMultisigTransaction(tx: Transaction): Promise<void> {
-  tx.setSender(MULTISIG_CONFIG.address);
+export async function buildAndLogMultisigTransaction(tx: Transaction, sender = MULTISIG_CONFIG.address): Promise<void> {
+  tx.setSender(sender);
 
   const transactionBytes = await tx.build({ client: provider });
   const base64TxBytes = toBase64(transactionBytes);
diff --git a/examples/multisig/initialize-multisig-config.ts b/examples/multisig/initialize-multisig-config.ts
@@ -3,6 +3,11 @@ import { DEEPTRADE_CORE_PACKAGE_ID, MULTISIG_CONFIG_OBJECT_ID, MULTISIG_ADMIN_CA
 import { buildAndLogMultisigTransaction } from "../multisig/buildAndLogMultisigTransaction";
 import { MULTISIG_CONFIG } from "../multisig/multisig";
 
+const ADMIN_CAP_HOLDER_ADDRESS = process.env.MULTISIG_ADMIN_CAP_HOLDER_ADDRESS;
+if (!ADMIN_CAP_HOLDER_ADDRESS) {
+  throw new Error("MULTISIG_ADMIN_CAP_HOLDER_ADDRESS environment variable is required.");
+}
+
 // Usage: npx tsx examples/multisig/initialize-multisig-config.ts > initialize-multisig-config.log 2>&1
 (async () => {
   const { publicKeysSuiBytes, weights, threshold, address } = MULTISIG_CONFIG;
@@ -12,6 +17,7 @@ import { MULTISIG_CONFIG } from "../multisig/multisig";
   console.warn(`- Signers: ${publicKeysSuiBytes.length}`);
   console.warn(`- Weights: ${JSON.stringify(weights)}`);
   console.warn(`- Threshold: ${threshold}`);
+  console.warn(`- Admin cap holder (sender): ${ADMIN_CAP_HOLDER_ADDRESS}`);
 
   const tx = new Transaction();
 
@@ -26,5 +32,5 @@ import { MULTISIG_CONFIG } from "../multisig/multisig";
     ],
   });
 
-  await buildAndLogMultisigTransaction(tx);
+  await buildAndLogMultisigTransaction(tx, ADMIN_CAP_HOLDER_ADDRESS);
 })();
diff --git a/examples/multisig/update-multisig-config.ts b/examples/multisig/update-multisig-config.ts
@@ -7,6 +7,11 @@ import { SIGNATURE_FLAG_TO_SCHEME } from "@mysten/sui/cryptography";
 // --- NEW multisig config comes from standard MULTISIG_* env vars (loaded by multisig.ts) ---
 const { publicKeysSuiBytes, publicKeys, weights, threshold, address } = MULTISIG_CONFIG;
 
+const ADMIN_CAP_HOLDER_ADDRESS = process.env.MULTISIG_ADMIN_CAP_HOLDER_ADDRESS;
+if (!ADMIN_CAP_HOLDER_ADDRESS) {
+  throw new Error("MULTISIG_ADMIN_CAP_HOLDER_ADDRESS environment variable is required.");
+}
+
 // Usage: npx tsx examples/multisig/update-multisig-config.ts > update-multisig-config.log 2>&1
 (async () => {
   console.warn(`Building transaction to update multisig config`);
@@ -19,6 +24,7 @@ const { publicKeysSuiBytes, publicKeys, weights, threshold, address } = MULTISIG
     const scheme = SIGNATURE_FLAG_TO_SCHEME[pk.flag() as keyof typeof SIGNATURE_FLAG_TO_SCHEME];
     console.warn(`  - Signer ${i + 1}: ${pk.toSuiAddress()} (${scheme}, weight: ${weights[i]})`);
   });
+  console.warn(`- Admin cap holder (sender): ${ADMIN_CAP_HOLDER_ADDRESS}`);
 
   const tx = new Transaction();
 
@@ -33,5 +39,5 @@ const { publicKeysSuiBytes, publicKeys, weights, threshold, address } = MULTISIG
     ],
   });
 
-  await buildAndLogMultisigTransaction(tx);
+  await buildAndLogMultisigTransaction(tx, ADMIN_CAP_HOLDER_ADDRESS);
 })();
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
