chore: add AWS deployment release workflow

.github/actions/oidc/action.yaml

@@ -0,0 +1,45 @@
+---
+name: AWS OIDC Credentials via Role Assume Chaining
+description: Retrieve AWS credentials by chaining role assumes
+inputs:
+  role-for-oidc:
+    description: The role that should be used for GitHub OIDC authentication
+    required: true
+  role-to-assume:
+    description: The role that should be finally assumed
+    required: true
+  role-session-name:
+    description: The session name that should be used when assuming roles
+    required: true
+    default: github-actions
+  role-duration-seconds:
+    description: duration of the credentials validity
+    required: true
+    default: 3600
+  aws-region:
+    description: The AWS region
+    required: false
+    default: us-east-1
+
+runs:
+  using: composite
+  steps:
+    - name: assume oidc role
+      uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722  # v4.1.0
+      with:
+        aws-region: us-east-1
+        role-to-assume: ${{ inputs.role-for-oidc }}
+        role-session-name: ${{ inputs.role-session-name }}
+        role-duration-seconds: 900
+    - name: assume target role
+      uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722  # v4.1.0
+      id: assume-target-role
+      with:
+        aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
+        aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
+        aws-region: ${{ inputs.aws-region }}
+        role-chaining: true
+        role-to-assume: ${{ inputs.role-to-assume }}
+        role-session-name: ${{ inputs.role-session-name }}
+        role-duration-seconds: ${{ inputs.role-duration-seconds }}

.github/actions/prepare/action.yml

@@ -17,9 +17,29 @@ runs:
       uses: dtolnay/[email protected]  # v1.86.0
       with:
         components: ${{ (inputs.components != '') && format('{0}, rustfmt, clippy', inputs.components) || 'rustfmt, clippy' }}
+
     - name: Install libsodium
       run: sudo apt-get update && sudo apt-get install -y libsodium-dev
       shell: bash
+
     - name: Restore cargo dependencies from cache
       uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3  # v2.7.7
       id: cache
+
+    - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+      with:
+        run_install: false
+        version: 10
+
+    - name: Use node@22
+      uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+      with:
+        node-version: 22.18.0
+
+    - name: Build launchtube plugin example
+      run: |
+        cd examples/launchtube-plugin-example/launchtube
+        pnpm install
+        pnpm run build
+        cd ../..
+      shell: bash

Dockerfile.production

@@ -18,10 +18,25 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 FROM --platform=${BUILDPLATFORM} cgr.dev/chainguard/wolfi-base
 
 WORKDIR /app
+COPY --chown=nonroot:nonroot ./config /app/config
+# COPY --chown=nonroot:nonroot ./examples/launchtube-plugin-example/launchtube /app/plugins/launchtube
+COPY --chown=nonroot:nonroot ./config/networks /app/config/networks
 COPY --from=base --chown=nonroot:nonroot /usr/app/bin/openzeppelin-relayer /app/openzeppelin-relayer
 COPY --from=base /usr/lib/libssl.so.3 /usr/lib/libssl.so.3
 COPY --from=base /usr/lib/libcrypto.so.3 /usr/lib/libcrypto.so.3
 
+ARG INCLUDE_LAUNCHTUBE=false
+
+RUN --mount=type=bind,source=examples/launchtube-plugin-example/launchtube,target=/mnt/launchtube,ro \
+    set -eux; \
+    if [ "${INCLUDE_LAUNCHTUBE}" = "true" ] && [ -d /mnt/launchtube ]; then \
+      mkdir -p /app/plugins/launchtube; \
+      cp -a /mnt/launchtube/. /app/plugins/launchtube/; \
+      echo "✅ Launchtube copied"; \
+    else \
+      echo "⏭ Skipping launchtube"; \
+    fi
+
 # Install plugin dependencies
 ARG TARGETARCH
 ARG NODE_VERSION=20.19
@@ -43,6 +58,27 @@ USER nonroot
 WORKDIR /app/plugins
 RUN pnpm install --frozen-lockfile
 
+# # Optional baking of config/networks/launchtube from the source tree
+# ARG BAKE_CONFIGS=false
+
+# # Paths inside the build stage (we copied the whole repo to /usr/app in the base stage)
+# # Adjust if your tree differs.
+# RUN set -eux; \
+#   if [ "${BAKE_CONFIGS}" = "true" ]; then \
+#     if [ -d /usr/app/examples/launchtube-plugin-example/config ]; then \
+#       mkdir -p /app/config; \
+#       cp -a /usr/app/examples/launchtube-plugin-example/config/. /app/config/; \
+#     fi; \
+#     if [ -d /usr/app/config/networks ]; then \
+#       mkdir -p /app/config/networks; \
+#       cp -a /usr/app/config/networks/. /app/config/networks/; \
+#     fi; \
+#     if [ -d /usr/app/examples/launchtube-plugin-example/launchtube ]; then \
+#       mkdir -p /app/plugins/launchtube; \
+#       cp -a /usr/app/examples/launchtube-plugin-example/launchtube/. /app/plugins/launchtube/; \
+#     fi; \
+#   fi
+
 # Return to app root
 WORKDIR /app