Block data migration

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(docker): "
     labels:
@@ -20,7 +20,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(actions): "
     labels:
@@ -33,7 +33,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     versioning-strategy: "auto"
     commit-message:
       prefix: "dependabot(npm): "
@@ -47,7 +47,7 @@ updates:
       day: "tuesday"
       time: "14:30"
       timezone: "America/New_York"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "dependabot(gomod): "
     labels:

.github/workflows/contracts-celo.yaml

@@ -0,0 +1,99 @@
+name: Alfajores-Holesky Deploy Celo4 L1 Contracts
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_contracts:
+        required: false
+        type: boolean
+        default: true
+      contracts_tag:
+        required: false
+        type: string
+        default: 'celo4'
+      deployment_context:
+        required: false
+        type: string
+        default: 'test-celo4'
+      l2_chain_id:
+        required: false
+        default: '42069'
+
+jobs:
+  deploy-contracts:
+    runs-on: ubuntu-latest
+    permissions: # Must change the job token permissions to use Akeyless JWT auth
+      id-token: write
+      contents: read
+    if: ${{ ! startsWith(github.triggering_actor, 'akeyless') }}
+    env:
+      DEPLOY_CONTRACTS: ${{ github.event_name == 'push' && 'true' || inputs.deploy_contracts }}
+      CONTRACTS_TAG: ${{ github.event_name == 'push' && 'op-contracts/v1.3.0' || inputs.contracts_tag }}
+      DEPLOYMENT_CONTEXT: ${{ github.event_name == 'push' && 'test' || inputs.deployment_context }}
+      L2_CHAIN_ID: ${{ github.event_name == 'push' && '42069' || inputs.l2_chain_id }}
+      L1_CHAIN_ID: '17000' # Holesky
+      L1_RPC_URL: 'https://ethereum-holesky-rpc.publicnode.com'
+      GS_ADMIN_ADDRESS: '0xb2397dF29AFB4B4661559436180019bEb7912985'
+      GS_BATCHER_ADDRESS: '0x7fDBe8F4D22ab511340667d7Ce5675568d09eBB4'
+      GS_PROPOSER_ADDRESS: '0xdCf30236Fa0aBE2ca0BEc2eE0a2F40b16A144DB3'
+      GS_SEQUENCER_ADDRESS: '0x3e2Df8efB6fA1d6E6021572a99BB67BA9ab2C59D'
+    steps:
+
+      - name: "Get GitHub Token from Akeyless"
+        id: get_auth_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/optimism/contents=write,pull_requests=write":"PAT"}'
+
+      # "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/HOLESKY_QUICKNODE_URL":"L1_RPC_URL",
+      - name: Akeyless get secrets
+        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          static-secrets: '{
+            "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/GS_ADMIN_PRIVATE_KEY":"GS_ADMIN_PRIVATE_KEY"
+            }'
+
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Generate config JSON
+        run: |
+          cd packages/contracts-bedrock
+          ./scripts/getting-started/config-vars-celo.sh
+
+      - name: Deploy L1 contracts
+        if: ${{ env.DEPLOY_CONTRACTS != 'false' }}
+        run: |
+          export IMPL_SALT=$(openssl rand -hex 32)
+          cd packages/contracts-bedrock
+          echo "Broadcasting ..."
+          forge script scripts/Deploy.s.sol:Deploy --private-key $GS_ADMIN_PRIVATE_KEY --broadcast --rpc-url $L1_RPC_URL --legacy
+
+      - name: Generate genesis files
+        run: |
+          mkdir -p l2-config-files/$DEPLOYMENT_CONTEXT
+          cd op-node
+          go run cmd/main.go genesis l2 \
+            --deploy-config ../packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json \
+            --l1-deployments ../packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy \
+            --outfile.l2 ../l2-config-files/$DEPLOYMENT_CONTEXT/genesis-$(date +%s).json \
+            --outfile.rollup ../l2-config-files/$DEPLOYMENT_CONTEXT/rollup-$(date +%s).json \
+            --l1-rpc $L1_RPC_URL
+
+      - name: "Commit genesis files"
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '[Automatic] - Commit genesis files'
+          branch: alvarof2/contracts
+          file_pattern: 'l2-config-files packages/contracts-bedrock/**'

.github/workflows/contracts-op-stack.yaml

@@ -0,0 +1,117 @@
+name: Alfajores-Holesky Deploy OP-Stack L1 Contracts
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_contracts:
+        required: false
+        type: boolean
+        default: true
+      contracts_tag:
+        required: false
+        type: string
+        default: 'op-contracts/v1.3.0'
+      deployment_context:
+        required: false
+        type: string
+        default: 'test-alvaro'
+      l2_chain_id:
+        required: false
+        default: '42069'
+
+jobs:
+  deploy-contracts:
+    runs-on: ubuntu-latest
+    permissions: # Must change the job token permissions to use Akeyless JWT auth
+      id-token: write
+      contents: read
+    if: ${{ ! startsWith(github.triggering_actor, 'akeyless') }}
+    env:
+      DEPLOY_CONTRACTS: ${{ github.event_name == 'push' && 'true' || inputs.deploy_contracts }}
+      CONTRACTS_TAG: ${{ github.event_name == 'push' && 'op-contracts/v1.3.0' || inputs.contracts_tag }}
+      DEPLOYMENT_CONTEXT: ${{ github.event_name == 'push' && 'test' || inputs.deployment_context }}
+      L2_CHAIN_ID: ${{ github.event_name == 'push' && '42069' || inputs.l2_chain_id }}
+      L1_CHAIN_ID: '17000' # Holesky
+      L1_RPC_URL: 'https://ethereum-holesky-rpc.publicnode.com'
+      GS_ADMIN_ADDRESS: '0xb2397dF29AFB4B4661559436180019bEb7912985'
+      GS_BATCHER_ADDRESS: '0x7fDBe8F4D22ab511340667d7Ce5675568d09eBB4'
+      GS_PROPOSER_ADDRESS: '0xdCf30236Fa0aBE2ca0BEc2eE0a2F40b16A144DB3'
+      GS_SEQUENCER_ADDRESS: '0x3e2Df8efB6fA1d6E6021572a99BB67BA9ab2C59D'
+    steps:
+
+      - name: "Get GitHub Token from Akeyless"
+        id: get_auth_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/optimism/contents=write,pull_requests=write":"PAT"}'
+
+      # "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/HOLESKY_QUICKNODE_URL":"L1_RPC_URL",
+      - name: Akeyless get secrets
+        uses: docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          static-secrets: '{
+            "/static-secrets/devops-circle/alfajores/op-testnet-alfajores/GS_ADMIN_PRIVATE_KEY":"GS_ADMIN_PRIVATE_KEY"
+            }'
+
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: "Checkout OP Repo"
+        uses: actions/checkout@v4
+        with:
+          repository: 'ethereum-optimism/optimism'
+          ref: '${{ env.CONTRACTS_TAG }}'
+          path: ethereum-optimism
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Generate config JSON
+        run: |
+          cd packages/contracts-bedrock
+          ./scripts/getting-started/config-vars-op-stack.sh
+          cp deploy-config/$DEPLOYMENT_CONTEXT.json /home/runner/work/optimism/optimism/ethereum-optimism/packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json
+
+      - name: Deploy L1 contracts
+        if: ${{ env.DEPLOY_CONTRACTS != 'false' }}
+        run: |
+          export IMPL_SALT=$(openssl rand -hex 32)
+          cd ethereum-optimism/packages/contracts-bedrock
+          echo "Broadcasting ..."
+          forge script scripts/Deploy.s.sol:Deploy --private-key $GS_ADMIN_PRIVATE_KEY --broadcast --rpc-url $L1_RPC_URL --legacy
+          mkdir -p /home/runner/work/optimism/optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT
+          cp deployments/$DEPLOYMENT_CONTEXT/.deploy /home/runner/work/optimism/optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy
+
+      - name: Copy old .deploy file if contracts not deployed
+        if: ${{ env.DEPLOY_CONTRACTS == 'false' }}
+        run: |
+          mkdir -p ethereum-optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT
+          cp packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy ethereum-optimism/packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy
+
+      - name: Generate genesis files
+        run: |
+          mkdir -p l2-config-files/$DEPLOYMENT_CONTEXT
+          cd ethereum-optimism/op-node
+          go run cmd/main.go genesis l2 \
+            --deploy-config ../packages/contracts-bedrock/deploy-config/$DEPLOYMENT_CONTEXT.json \
+            --l1-deployments ../packages/contracts-bedrock/deployments/$DEPLOYMENT_CONTEXT/.deploy \
+            --outfile.l2 ../../l2-config-files/$DEPLOYMENT_CONTEXT/genesis-$(date +%s).json \
+            --outfile.rollup ../../l2-config-files/$DEPLOYMENT_CONTEXT/rollup-$(date +%s).json \
+            --l1-rpc $L1_RPC_URL
+
+      - name: "Commit genesis files"
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '[Automatic] - Commit genesis files'
+          branch: alvarof2/contracts
+          file_pattern: 'l2-config-files packages/contracts-bedrock/**'

.github/workflows/docker-build-scan.yaml

@@ -0,0 +1,50 @@
+name: Docker Build Scan
+on:
+  pull_request:
+    branches:
+      - "master"
+      - "celo*"
+  workflow_dispatch:
+
+jobs:
+  detect-files-changed:
+    runs-on: ubuntu-latest
+    outputs:
+      files-changed: ${{ steps.detect-files-changed.outputs.all_changed_files }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Detect files changed
+        id: detect-files-changed
+        uses: tj-actions/changed-files@v44
+        with:
+          separator: ','
+
+  build-cel2-migration-tool:
+    runs-on: ubuntu-latest
+    needs: detect-files-changed
+    if: |
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/cmd/celo-dbmigrate') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/cmd/celo-migrate') ||
+      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/Dockerfile')
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Login at GCP Artifact Registry
+        uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@v2.0
+        with:
+          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos'
+          service-account: 'celo-optimism-gh@devopsre.iam.gserviceaccount.com'
+          docker-gcp-registries: us-west1-docker.pkg.dev
+      - name: Build and push container
+        uses: celo-org/reusable-workflows/.github/actions/build-container@v2.0
+        with:
+          platforms: linux/amd64
+          registry: us-west1-docker.pkg.dev/devopsre/dev-images/cel2-migration-tool
+          tags: ${{ github.sha }}
+          context: ./
+          dockerfile: ./op-chain-ops/Dockerfile
+          push: true
+          trivy: false

.github/workflows/docker-op-ufm-build-push.yaml

@@ -0,0 +1,41 @@
+---
+name: Build op-ufm container and push to cLabs registry
+on:
+    push:
+      branches:
+        - cel4
+      paths:
+        # Run if any of the following files are changed
+        - 'op-ufm/**'
+    workflow_dispatch:
+
+jobs:
+    build:
+      runs-on: ['self-hosted', 'org', '8-cpu']
+      permissions: # Required for workload identity auth and push the trivy results to GitHub
+        contents: read
+        id-token: write
+        security-events: write
+      steps:
+
+        - name: Checkout
+          uses: actions/checkout@v4
+
+        - name: Authenticate to Google Cloud
+          uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@main
+          with:
+            workload-id-provider: projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos
+            service-account: celo-optimism-gh@devopsre.iam.gserviceaccount.com
+            access-token-lifetime: "60m"
+            docker-gcp-registries: us-west1-docker.pkg.dev
+
+        - name: Build, push and scan the container
+          uses: celo-org/reusable-workflows/.github/actions/build-container@main
+          with:
+            platforms: linux/amd64
+            registry: us-west1-docker.pkg.dev/devopsre/dev-images/op-ufm
+            tags: test
+            context: .
+            dockerfile: op-ufm/Dockerfile
+            push: true
+            trivy: false

.github/workflows/pages.yml

@@ -0,0 +1,33 @@
+name: Build and publish forkdiff github-pages
+permissions:
+  contents: write
+on:
+  push:
+    branches:
+      - celo[0-9]+
+jobs:
+  deploy:
+    concurrency: ci-${{ github.ref }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1000  # make sure to fetch the old commit we diff against
+
+      - name: Build forkdiff
+        uses: "docker://protolambda/forkdiff:0.1.0"
+        with:
+          args: -repo=/github/workspace -fork=/github/workspace/fork.yaml -out=/github/workspace/index.html
+
+      - name: Build pages
+        run: |
+          mkdir -p tmp/pages
+          mv index.html tmp/pages/index.html
+          touch tmp/pages/.nojekyll
+
+      - name: Deploy
+        uses: JamesIves/github-pages-deploy-action@v4
+        with:
+          folder: tmp/pages
+          clean: true

.gitignore

@@ -47,3 +47,6 @@ __pycache__
 
 # Ignore echidna artifacts
 crytic-export
+
+# vscode
+.vscode/