Origin Automated Actions

.github/workflows/contracts-automaton-prod-image.yml

@@ -0,0 +1,42 @@
+name: Contracts Actions Image
+
+on:
+  push:
+    branches:
+      - origin-automaton-production
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare image metadata
+        id: prep
+        run: |
+          IMAGE_NAME="ghcr.io/${{ github.repository_owner }}/contracts-automaton-prod"
+          IMAGE_NAME="$(echo "${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')"
+          echo "image_name=${IMAGE_NAME}" >> "${GITHUB_OUTPUT}"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./contracts
+          file: ./contracts/dockerfile-actions
+          push: true
+          tags: |
+            ${{ steps.prep.outputs.image_name }}:latest
+            ${{ steps.prep.outputs.image_name }}:${{ github.sha }}

.github/workflows/defi.yml

@@ -1,12 +1,12 @@
 name: DeFi
-on: 
+on:
   pull_request:
     types: [opened, reopened, synchronize]
   push:
     branches:
-      - 'master'
-      - 'staging'
-      - 'stable'
+      - "master"
+      - "staging"
+      - "stable"
   workflow_dispatch:
 
 concurrency:
@@ -32,7 +32,7 @@ jobs:
           node-version: "20.x"
           cache: "pnpm"
           cache-dependency-path: contracts/pnpm-lock.yaml
-      
+
       - name: Configure Git to use HTTPS for GitHub
         run: git config --global url."https://github.com/".insteadOf "git@github.com:"
 
@@ -63,14 +63,14 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: "20.x"
           cache: "pnpm"
           cache-dependency-path: contracts/pnpm-lock.yaml
-      
+
       - name: Configure Git to use HTTPS for GitHub
         run: git config --global url."https://github.com/".insteadOf "git@github.com:"
 
@@ -85,7 +85,7 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: unit-test-coverage-${{ github.sha }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
@@ -101,7 +101,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -125,7 +125,7 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: base-unit-test-coverage-${{ github.sha }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
@@ -141,7 +141,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -165,17 +165,67 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: sonic-unit-test-coverage-${{ github.sha }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
 
+  contracts-nonce-queue-test:
+    name: "Nonce Queue Integration"
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: nonce_test
+          POSTGRES_USER: test
+          POSTGRES_PASSWORD: test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U test -d nonce_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+          cache: "pnpm"
+          cache-dependency-path: contracts/pnpm-lock.yaml
+
+      - name: Configure Git to use HTTPS for GitHub
+        run: git config --global url."https://github.com/".insteadOf "git@github.com:"
+
+      - name: Install deps
+        working-directory: ./contracts
+        run: pnpm install --frozen-lockfile
+
+      - name: Run nonce queue integration test
+        env:
+          DATABASE_URL: postgresql://test:test@localhost:5432/nonce_test
+        working-directory: ./contracts
+        run: |
+          pnpm exec ts-node tasks/lib/nonceQueue.test.ts
+          pnpm exec ts-node tasks/lib/nonceQueueTxLifecycle.test.ts
+          pnpm exec ts-node tasks/lib/nonceQueueTxHistory.test.ts
+          pnpm exec ts-node cron/api.test.ts
+
   contracts-forktest:
     name: "Mainnet Fork Tests ${{ matrix.chunk_id }}"
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        chunk_id: [0,1,2,3]
+        chunk_id: [0, 1, 2, 3]
     continue-on-error: true
     env:
       HARDHAT_CACHE_DIR: ./cache
@@ -192,7 +242,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -221,7 +271,7 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: fork-test-coverage-${{ github.sha }}-runner${{ matrix.chunk_id }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
@@ -242,7 +292,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -271,7 +321,7 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: fork-test-arb-coverage-${{ github.sha }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
@@ -292,7 +342,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -321,11 +371,11 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: fork-test-base-coverage-${{ github.sha }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
-  
+
   contracts-sonic-forktest:
     name: "Sonic Fork Tests"
     runs-on: ubuntu-latest
@@ -342,7 +392,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -371,11 +421,11 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: fork-test-sonic-coverage-${{ github.sha }}
-          path: | 
+          path: |
             ./contracts/coverage.json
             ./contracts/coverage/**/*
           retention-days: 1
-  
+
   contracts-plume-forktest:
     name: "Plume Fork Tests"
     runs-on: ubuntu-latest
@@ -392,7 +442,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -501,7 +551,7 @@ jobs:
           key: ${{ runner.os }}-hardhat-${{ hashFiles('contracts/cache/*.json') }}
           restore-keys: |
             ${{ runner.os }}-hardhat-cache
-      
+
       - name: Download all reports
         uses: actions/download-artifact@v4
 
@@ -519,7 +569,7 @@ jobs:
       - name: Set up Python 3.10
         uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: "3.10"
 
       - name: Install dependencies
         run: |
@@ -534,7 +584,7 @@ jobs:
         with:
           version: 10
           run_install: false
-          
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -564,4 +614,4 @@ jobs:
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
-          args: --severity-threshold=high  --all-projects
+          args: --severity-threshold=high  --all-projects

contracts/.eslintrc.js

@@ -24,4 +24,25 @@ module.exports = {
     "no-only-tests/no-only-tests": "error",
     "no-unused-vars": [2, { vars: "all", args: "after-used" }],
   },
+  overrides: [
+    {
+      files: ["**/*.ts"],
+      parser: "@typescript-eslint/parser",
+      parserOptions: {
+        project: "./tsconfig.json",
+        sourceType: "module",
+      },
+      plugins: ["@typescript-eslint"],
+      extends: ["eslint:recommended", "plugin:@typescript-eslint/recommended"],
+      rules: {
+        "no-unused-vars": "off",
+        "@typescript-eslint/no-unused-vars": [
+          2,
+          { vars: "all", args: "after-used" },
+        ],
+        "@typescript-eslint/no-explicit-any": "off",
+        "@typescript-eslint/no-require-imports": "off",
+      },
+    },
+  ],
 };

contracts/README.md

@@ -246,8 +246,9 @@ If enabled, the gas usage will be output in a table after the tests have execute
 When using Hardhat tasks, there are a few options for specifying the wallet to send transactions from.
 
 1. Primary key
-2. Impersonate
-3. Defender Relayer
+2. AWS KMS signer
+3. Impersonate
+4. Defender Relayer
 
 ### Primary Key
 
@@ -262,6 +263,24 @@ unset DEPLOYER_PK
 unset GOVERNOR_PK
 ```
 
+### AWS KMS Signer
+
+Hardhat tasks can sign transactions with AWS KMS when both `AWS_ACCESS_KEY_ID` and
+`AWS_SECRET_ACCESS_KEY` are set.
+
+The default `relayer-id` is `origin-relayer-production-evm`. Some tasks can be mapped
+to different defaults in code, and a user-provided task parameter always wins:
+
+```
+npx hardhat <task> --network <network> --relayer-id <kms-key-id-or-alias>
+```
+
+The relayer resolution precedence is:
+
+1. `--relayer-id`
+2. task-name based override map
+3. global default (`origin-relayer-production-evm`)
+
 ### Impersonate
 
 If using a fork test or node, you can impersonate any externally owned account or contract. Export `IMPERSONATE` with the address of the account you want to impersonate. The account will be funded with some Ether. For example

contracts/cron/.gitignore

@@ -0,0 +1 @@
+cronjob