chore: Berghain apt CI ❤️‍🔥

.github/aptly_mainnet_s3.json

@@ -0,0 +1,18 @@
+{
+    "chainflip-prod": {
+      "region": "eu-central-1",
+      "bucket": "pkgs.chainflip.io",
+      "endpoint": "",
+      "awsAccessKeyID": "",
+      "awsSecretAccessKey": "",
+      "awsSessionToken": "",
+      "prefix": "",
+      "acl": "public-read",
+      "storageClass": "",
+      "encryptionMethod": "",
+      "plusWorkaround": false,
+      "disableMultiDel": false,
+      "forceSigV2": false,
+      "debug": false
+    }
+  }

.github/workflows/_30_publish.yml

@@ -6,6 +6,10 @@ on:
         description: Release version
         required: true
         type: string
+      network:
+        description: mainnet or testnet
+        required: true
+        type: string
       environment:
         description: prod or dev repo
         required: true
@@ -50,19 +54,29 @@ jobs:
           sudo dpkg -i /tmp/aptly_${APTLY_VERSION}_amd64.deb
 
       - name: Configure AWS credentials using OIDC
+        if: inputs.network != 'mainnet'
         uses: aws-actions/configure-aws-credentials@v2
         with:
           aws-region: eu-central-1
           role-to-assume: arn:aws:iam::962042992619:role/chainflip-github-bot
 
-      - name: Configure aptly
-        run: |
-          aptly config show
-          jq --argjson S3PublishEndpoints "$(<.github/aptly_${{ inputs.environment }}_s3.json)" '.S3PublishEndpoints += $S3PublishEndpoints' ~/.aptly.conf | sponge ~/.aptly.conf
+      - name: Configure Mainnet AWS credentials using OIDC
+        if: inputs.network == 'mainnet'
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-region: eu-central-1
+          role-to-assume: arn:aws:iam::875562862093:role/chainflip-github-bot
 
-      - name: Import prod GPG package signing key
+      - name: Import mainnet GPG package signing key
         id: import_gpg_prod
-        if: inputs.environment == 'prod'
+        if: inputs.network == 'mainnet'
+        uses: crazy-max/ghaction-import-gpg@v5
+        with:
+          gpg_private_key: ${{ secrets.CF_MAINNET_PGP_KEY }}
+
+      - name: Import prod GPG package signing key
+        id: import_gpg_mainnet
+        if: inputs.environment == 'prod' && inputs.network != 'mainnet'
         uses: crazy-max/ghaction-import-gpg@v5
         with:
           gpg_private_key: ${{ secrets.CF_PROD_PGP_KEY }}
@@ -76,18 +90,31 @@ jobs:
 
       - name: Set environment
         run: |
-          if [[ '${{ inputs.environment }}' == 'prod' ]]; then
+          if [[ '${{ inputs.environment }}' == 'prod' && '${{ inputs.network }}' == 'mainnet' ]]; then
+            echo "REPO_BUCKET=pkgs.chainflip.io" >> $GITHUB_ENV
+            echo "USER_PASS_PREFIX=" >> $GITHUB_ENV
+            echo "REPO_BASIC_AUTH=" >> $GITHUB_ENV
+            echo "GPG_KEY_ID=${{ steps.import_gpg_mainnet.outputs.keyid }}" >> $GITHUB_ENV
+            echo "APTLY_CONFIG_FILE=aptly_mainnet_s3.json" >> $GITHUB_ENV
+          elif [[ '${{ inputs.environment }}' == 'prod' && '${{ inputs.network }}' != 'mainnet' ]]; then
             echo "REPO_BUCKET=repo.chainflip.io" >> $GITHUB_ENV
             echo "USER_PASS_PREFIX=" >> $GITHUB_ENV
             echo "REPO_BASIC_AUTH=" >> $GITHUB_ENV
             echo "GPG_KEY_ID=${{ steps.import_gpg_prod.outputs.keyid }}" >> $GITHUB_ENV
+            echo "APTLY_CONFIG_FILE=aptly_prod_s3.json" >> $GITHUB_ENV
           else
             echo "REPO_BUCKET=apt.aws.chainflip.xyz" >> $GITHUB_ENV
             echo "USER_PASS_PREFIX={user}:{pass}@" >> $GITHUB_ENV
             echo "REPO_BASIC_AUTH=flip:${{ secrets.CF_APT_REPO_BASIC_AUTH_PASSWORD }}" >> $GITHUB_ENV
             echo "GPG_KEY_ID=${{ steps.import_gpg_dev.outputs.keyid }}" >> $GITHUB_ENV
+            echo "APTLY_CONFIG_FILE=aptly_dev_s3.json" >> $GITHUB_ENV
           fi
 
+      - name: Configure aptly
+        run: |
+          aptly config show
+          jq --argjson S3PublishEndpoints "$(<.github/${APTLY_CONFIG_FILE})" '.S3PublishEndpoints += $S3PublishEndpoints' ~/.aptly.conf | sponge ~/.aptly.conf
+
       - name: List keys
         run: gpg -K
 

.github/workflows/ci-development.yml

@@ -47,6 +47,7 @@ jobs:
     with:
       version: ci/${{ github.sha }}/
       environment: dev
+      network: development
     secrets: inherit
   merge-commit-summary:
     needs: [publish]

.github/workflows/ci-main.yml

@@ -44,4 +44,5 @@ jobs:
     with:
       version: ci/${{ github.sha }}/
       environment: dev
+      network: development
     secrets: inherit

.github/workflows/ci-nightly.yml

@@ -43,4 +43,5 @@ jobs:
     with:
       version: nightly/
       environment: dev
+      network: development
     secrets: inherit

.github/workflows/release-berghain.yml

@@ -0,0 +1,38 @@
+name: Release Chainflip Mainnet
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.ref }}-release-mainnet
+  cancel-in-progress: true
+
+jobs:
+  check-versions:
+    uses: ./.github/workflows/_03_check_versions.yml
+  bins:
+    needs: [check-versions]
+    uses: ./.github/workflows/_02_retrieve-bins.yml
+    secrets: inherit
+  docker:
+    needs: [bins]
+    uses: ./.github/workflows/_24_docker.yml
+    with:
+      network: berghain
+      environment: prod
+      publish_public_images: true
+    secrets: inherit
+  package:
+    needs: [bins]
+    uses: ./.github/workflows/_25_package.yml
+    with:
+      network: "berghain"
+      environment: prod
+    secrets: inherit
+  publish:
+    needs: [package]
+    uses: ./.github/workflows/_30_publish.yml
+    with:
+      version: "mainnet/"
+      environment: prod
+      network: berghain
+    secrets: inherit

.github/workflows/release-kitkat.yml

@@ -34,4 +34,5 @@ jobs:
     with:
       version: "kitkat/"
       environment: prod
-    secrets: inherit
+      network: kitkat
+    secrets: inherit

.github/workflows/release-partnernet.yml

@@ -45,4 +45,5 @@ jobs:
     with:
       version: "partnernet/"
       environment: prod
-    secrets: inherit
+      network: partnernet
+    secrets: inherit

.github/workflows/release-perseverance.yml

@@ -35,10 +35,11 @@ jobs:
     with:
       version: "perseverance/"
       environment: prod
+      network: perseverance
     secrets: inherit
   release:
     needs: [publish]
     uses: ./.github/workflows/_50_release.yml
     secrets: inherit
     with:
-      network: perseverance
+      network: perseverance

.github/workflows/release-sisyphos.yml

@@ -45,4 +45,5 @@ jobs:
     with:
       version: "sisyphos/"
       environment: dev
+      network: sisyphos
     secrets: inherit