Skip to content

Commit 45d8b88

Browse files
toniocodosparrowDom
toniocodo
and
sparrowDom
authored
chore: update references from @talos/client to @oplabs/talos-client, … (#2946)
* chore: update references from @talos/client to @oplabs/talos-client, add .npmrc for GitHub package registry configuration WIP 🚧 * chore: move @oplabs/talos-client to peerDependencies and mark as optional * chore: add pnpm lockfile and workspace configuration, update AWS deployment workflows to use package token * load up the client library only in proper environment * fix: autoInstallPeers false so optional talos-client doesn't break install - contracts/pnpm-workspace.yaml: autoInstallPeers false + exclude @oplabs/talos-client from the release-age gate (matches arm-oeth) - remove accidental root pnpm-workspace.yaml + pnpm-lock.yaml * fix: set autoInstallPeers false in contracts/pnpm-workspace.yaml The real fix for the red install — the deletions-only commit before this missed the file. autoInstallPeers false makes pnpm skip the optional @oplabs/talos-client peer (no 404 without a token); matches arm-oeth. * fix: record autoInstallPeers false in the contracts lockfile settings Matches contracts/pnpm-workspace.yaml so frozen-lockfile installs (CI + Docker) don't hit ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Settings-only change; a full regen is blocked by an unrelated pre-existing vitest catalog ref. * chore: bump @oplabs/talos-client to 0.0.28 * chore: revert pre-commit hook * fix: dynamically set @oplabs/talos-client version in Dockerfile installation * fix: align runner Dockerfile with arm-oeth (syntax 1.10 + pnpm add) - # syntax=docker/dockerfile:1.10 so the env= secret mount is supported - pnpm add --save-prod (pnpm rejects the no-save option on add) * chore: upgrade @lodestar 1.41->1.44; retire spec-test-util packageExtension 1.44 drops @lodestar/config's spurious @lodestar/spec-test-util dependency, which shipped a broken 'vitest: catalog:' that broke any workspace re-resolution (e.g. the runner image's pnpm add step). Also removes the now -dead spec-test-util packageExtension; lockfile shrinks ~600 lines. --------- Co-authored-by: Domen Grabec <grabec@gmail.com>
1 parent 07a7fcb commit 45d8b88

13 files changed

Lines changed: 196 additions & 930 deletions

‎.github/workflows/aws-deployment.yml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ name: AWS — build runner image
77
#
88
# Triggers on `master`.
99
#
10-
# Requires the TALOS_DEPLOY_KEY repo secret for the @talos/client
11-
# git-install (SSH deploy key against oplabs/talos).
10+
# Requires the TALOS_PACKAGE_TOKEN repo secret: a PAT with read:packages
11+
# access to the private @oplabs/talos-client GitHub package.
1212
#
1313
# Build context is `contracts/` because the dockerfile and runner code
1414
# live there.
@@ -36,11 +36,6 @@ jobs:
3636
with:
3737
persist-credentials: false
3838

39-
- name: Set up SSH agent for @talos/client deploy key
40-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
41-
with:
42-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
43-
4439
- name: Configure AWS credentials
4540
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
4641
with:
@@ -75,7 +70,8 @@ jobs:
7570
context: ./contracts
7671
file: ./contracts/dockerfile-actions
7772
push: true
78-
ssh: default
73+
secrets: |
74+
talos_package_token=${{ secrets.TALOS_PACKAGE_TOKEN }}
7975
build-args: |
8076
GIT_COMMIT_SHA=${{ github.sha }}
8177
tags: |

‎.github/workflows/defi.yml‎

Lines changed: 22 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -40,18 +40,8 @@ jobs:
4040
cache: "pnpm"
4141
cache-dependency-path: contracts/pnpm-lock.yaml
4242

43-
- name: Set up SSH agent for @talos/client deploy key
44-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
45-
with:
46-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
47-
48-
- name: Configure Git auth for git dependencies
49-
run: |
50-
# Public git deps (e.g. prompts) clone over HTTPS.
51-
git config --global url."https://github.com/".insteadOf "git@github.com:"
52-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
53-
# authenticates it — the longer prefix takes precedence over the rule above.
54-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
43+
- name: Configure Git for public dependencies
44+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
5545

5646
- name: Install deps
5747
working-directory: ./contracts
@@ -90,18 +80,8 @@ jobs:
9080
cache: "pnpm"
9181
cache-dependency-path: contracts/pnpm-lock.yaml
9282

93-
- name: Set up SSH agent for @talos/client deploy key
94-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
95-
with:
96-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
97-
98-
- name: Configure Git auth for git dependencies
99-
run: |
100-
# Public git deps (e.g. prompts) clone over HTTPS.
101-
git config --global url."https://github.com/".insteadOf "git@github.com:"
102-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
103-
# authenticates it — the longer prefix takes precedence over the rule above.
104-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
83+
- name: Configure Git for public dependencies
84+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
10585

10686
- name: Install deps
10787
working-directory: ./contracts
@@ -140,18 +120,8 @@ jobs:
140120
cache: "pnpm"
141121
cache-dependency-path: contracts/pnpm-lock.yaml
142122

143-
- name: Set up SSH agent for @talos/client deploy key
144-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
145-
with:
146-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
147-
148-
- name: Configure Git auth for git dependencies
149-
run: |
150-
# Public git deps (e.g. prompts) clone over HTTPS.
151-
git config --global url."https://github.com/".insteadOf "git@github.com:"
152-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
153-
# authenticates it — the longer prefix takes precedence over the rule above.
154-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
123+
- name: Configure Git for public dependencies
124+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
155125

156126
- name: Install deps
157127
working-directory: ./contracts
@@ -192,18 +162,8 @@ jobs:
192162
cache: "pnpm"
193163
cache-dependency-path: contracts/pnpm-lock.yaml
194164

195-
- name: Set up SSH agent for @talos/client deploy key
196-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
197-
with:
198-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
199-
200-
- name: Configure Git auth for git dependencies
201-
run: |
202-
# Public git deps (e.g. prompts) clone over HTTPS.
203-
git config --global url."https://github.com/".insteadOf "git@github.com:"
204-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
205-
# authenticates it — the longer prefix takes precedence over the rule above.
206-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
165+
- name: Configure Git for public dependencies
166+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
207167

208168
- name: Install deps
209169
working-directory: ./contracts
@@ -263,18 +223,8 @@ jobs:
263223
restore-keys: |
264224
${{ runner.os }}-hardhat-cache
265225
266-
- name: Set up SSH agent for @talos/client deploy key
267-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
268-
with:
269-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
270-
271-
- name: Configure Git auth for git dependencies
272-
run: |
273-
# Public git deps (e.g. prompts) clone over HTTPS.
274-
git config --global url."https://github.com/".insteadOf "git@github.com:"
275-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
276-
# authenticates it — the longer prefix takes precedence over the rule above.
277-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
226+
- name: Configure Git for public dependencies
227+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
278228

279229
- name: Install deps
280230
working-directory: ./contracts
@@ -325,18 +275,8 @@ jobs:
325275
restore-keys: |
326276
${{ runner.os }}-hardhat-cache
327277
328-
- name: Set up SSH agent for @talos/client deploy key
329-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
330-
with:
331-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
332-
333-
- name: Configure Git auth for git dependencies
334-
run: |
335-
# Public git deps (e.g. prompts) clone over HTTPS.
336-
git config --global url."https://github.com/".insteadOf "git@github.com:"
337-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
338-
# authenticates it — the longer prefix takes precedence over the rule above.
339-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
278+
- name: Configure Git for public dependencies
279+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
340280

341281
- name: Install deps
342282
working-directory: ./contracts
@@ -387,18 +327,8 @@ jobs:
387327
restore-keys: |
388328
${{ runner.os }}-hardhat-cache
389329
390-
- name: Set up SSH agent for @talos/client deploy key
391-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
392-
with:
393-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
394-
395-
- name: Configure Git auth for git dependencies
396-
run: |
397-
# Public git deps (e.g. prompts) clone over HTTPS.
398-
git config --global url."https://github.com/".insteadOf "git@github.com:"
399-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
400-
# authenticates it — the longer prefix takes precedence over the rule above.
401-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
330+
- name: Configure Git for public dependencies
331+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
402332

403333
- name: Install deps
404334
working-directory: ./contracts
@@ -449,18 +379,8 @@ jobs:
449379
restore-keys: |
450380
${{ runner.os }}-hardhat-cache
451381
452-
- name: Set up SSH agent for @talos/client deploy key
453-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
454-
with:
455-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
456-
457-
- name: Configure Git auth for git dependencies
458-
run: |
459-
# Public git deps (e.g. prompts) clone over HTTPS.
460-
git config --global url."https://github.com/".insteadOf "git@github.com:"
461-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
462-
# authenticates it — the longer prefix takes precedence over the rule above.
463-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
382+
- name: Configure Git for public dependencies
383+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
464384

465385
- name: Install deps
466386
working-directory: ./contracts
@@ -511,18 +431,8 @@ jobs:
511431
restore-keys: |
512432
${{ runner.os }}-hardhat-cache
513433
514-
- name: Set up SSH agent for @talos/client deploy key
515-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
516-
with:
517-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
518-
519-
- name: Configure Git auth for git dependencies
520-
run: |
521-
# Public git deps (e.g. prompts) clone over HTTPS.
522-
git config --global url."https://github.com/".insteadOf "git@github.com:"
523-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
524-
# authenticates it — the longer prefix takes precedence over the rule above.
525-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
434+
- name: Configure Git for public dependencies
435+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
526436

527437
- name: Install deps
528438
working-directory: ./contracts
@@ -573,18 +483,8 @@ jobs:
573483
restore-keys: |
574484
${{ runner.os }}-hardhat-cache
575485
576-
- name: Set up SSH agent for @talos/client deploy key
577-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
578-
with:
579-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
580-
581-
- name: Configure Git auth for git dependencies
582-
run: |
583-
# Public git deps (e.g. prompts) clone over HTTPS.
584-
git config --global url."https://github.com/".insteadOf "git@github.com:"
585-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
586-
# authenticates it — the longer prefix takes precedence over the rule above.
587-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
486+
- name: Configure Git for public dependencies
487+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
588488

589489
- name: Install deps
590490
working-directory: ./contracts
@@ -671,18 +571,8 @@ jobs:
671571
cache: "pnpm"
672572
cache-dependency-path: contracts/pnpm-lock.yaml
673573

674-
- name: Set up SSH agent for @talos/client deploy key
675-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
676-
with:
677-
ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}
678-
679-
- name: Configure Git auth for git dependencies
680-
run: |
681-
# Public git deps (e.g. prompts) clone over HTTPS.
682-
git config --global url."https://github.com/".insteadOf "git@github.com:"
683-
# Keep the private @talos/client (oplabs/talos) on SSH so the deploy key
684-
# authenticates it — the longer prefix takes precedence over the rule above.
685-
git config --global url."git@github.com:oplabs/talos".insteadOf "git@github.com:oplabs/talos"
574+
- name: Configure Git for public dependencies
575+
run: git config --global url."https://github.com/".insteadOf "git@github.com:"
686576

687577
- name: Install deps
688578
working-directory: ./contracts

‎contracts/.npmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@oplabs:registry=https://npm.pkg.github.com

‎contracts/README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ pnpm prettier
2424
```
2525

2626
## Linter
27-
27+
2828
[solhit](https://protofire.github.io/solhint/) is used to lint Solidity code. The configuration for solhint is in [.solhint.json](./.solhint.json). [.solhintignore](./.solhintignore) is used to ignore Solidity files from being linted.
2929

3030
[eslint](https://eslint.org/) is used to lint JavaScript code. The configuration for eslint is in [.eslintrc.js](./.eslintrc.js).
@@ -296,7 +296,7 @@ unset IMPERSONATE
296296

297297
### Automated Actions (Talos)
298298

299-
The hardhat action tasks under `contracts/tasks/actions/` are driven in production by a container that imports [`@talos/client`](https://github.com/oplabs/talos):
299+
The hardhat action tasks under `contracts/tasks/actions/` are driven in production by a container that imports [`@oplabs/talos-client`](https://github.com/oplabs/talos):
300300

301301
- **`contracts/runner.ts`** calls `runContainer({ product: "origin-dollar", workdir: "/app" })`. The library reads enabled rows from the shared Talos Postgres, fires them via croner, and spawns each schedule's command as `pnpm hardhat <name> --network <chain>`.
302302
- **`contracts/migrations/seed_schedules.sql`** seeds the `schedules` table, mirroring the old `contracts/cron/cron-jobs.ts`.
@@ -313,6 +313,10 @@ pnpm hardhat healthcheck --network mainnet
313313

314314
**No Postgres required for local runs.** The library's nonce queue is gated by `process.env.DATABASE_URL`: if unset, the action uses a raw ethers signer with ethers' own nonce handling. The gate is a single `if (!process.env.DATABASE_URL) return null` check at the top of the handler — no DB connection is opened. If you want to opt in locally (e.g., via `docker compose up`), set `DATABASE_URL` and the queue engages; `unset DATABASE_URL` to go back.
315315

316+
Building the runner image installs the optional `@oplabs/talos-client` peer
317+
dependency from GitHub Packages. Set `TALOS_PACKAGE_TOKEN` to a PAT with
318+
`read:packages` access before running `docker compose build`.
319+
316320
Signer construction (KMS via `utils/signersNoHardhat.js`, `DEPLOYER_PK` /
317321
`GOVERNOR_PK` fallbacks, and `IMPERSONATE`) stays exactly as described in the
318322
sections above. The library only handles the nonce wrap; it does not construct

‎contracts/docker-compose.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ services:
1717
build:
1818
context: .
1919
dockerfile: dockerfile-actions
20+
secrets:
21+
- talos_package_token
2022
depends_on:
2123
postgres:
2224
condition: service_healthy
@@ -55,3 +57,7 @@ services:
5557

5658
volumes:
5759
pgdata:
60+
61+
secrets:
62+
talos_package_token:
63+
environment: TALOS_PACKAGE_TOKEN

‎contracts/dockerfile-actions‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# syntax=docker/dockerfile:1.7
1+
# syntax=docker/dockerfile:1.10
22
FROM oven/bun:1
33

44
ENV DEBIAN_FRONTEND=noninteractive \
@@ -12,7 +12,6 @@ RUN apt-get update \
1212
ca-certificates \
1313
curl \
1414
git \
15-
openssh-client \
1615
build-essential \
1716
python3 \
1817
bsdutils \
@@ -25,19 +24,25 @@ RUN apt-get update \
2524
# chown /app and switch USER just before CMD.
2625
RUN groupadd -r runner && useradd -r -g runner -m -d /home/runner runner
2726

28-
# Preload GitHub host key for SSH-based dependencies.
29-
RUN mkdir -p /root/.ssh \
30-
&& ssh-keyscan -t ed25519,rsa github.com >> /root/.ssh/known_hosts
31-
3227
WORKDIR /app
3328

34-
# Install dependencies first for better caching. Requires BuildKit SSH
35-
# forwarding (e.g. Railway deploy key) to resolve @automaton/client.
29+
# Install dependencies first for better caching. The Talos client is an
30+
# optional peer dependency, so install it explicitly for the runner image.
31+
# talos_package_token must be a PAT with read:packages access to oplabs packages.
3632
COPY pnpm-lock.yaml package.json pnpm-workspace.yaml ./
37-
RUN --mount=type=ssh \
33+
RUN --mount=type=secret,id=talos_package_token,env=NODE_AUTH_TOKEN,required=true \
3834
--mount=type=cache,id=origin-dollar-contracts-pnpm-store,target=/root/.local/share/pnpm/store \
3935
npm install -g pnpm@10.33.4 \
40-
&& pnpm install --frozen-lockfile
36+
&& printf '%s\n' \
37+
'@oplabs:registry=https://npm.pkg.github.com' \
38+
'//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}' \
39+
> /tmp/talos.npmrc \
40+
&& git config --global url."https://github.com/".insteadOf "git@github.com:" \
41+
&& NPM_CONFIG_USERCONFIG=/tmp/talos.npmrc pnpm install --frozen-lockfile \
42+
&& TALOS_CLIENT_VERSION="$(node -p 'require("./package.json").peerDependencies["@oplabs/talos-client"]')" \
43+
&& NPM_CONFIG_USERCONFIG=/tmp/talos.npmrc \
44+
pnpm add --save-prod "@oplabs/talos-client@${TALOS_CLIENT_VERSION}" \
45+
&& rm /tmp/talos.npmrc
4146

4247
# Copy the rest of the contracts workspace.
4348
COPY . .
@@ -70,7 +75,7 @@ ENV MAINNET_PROVIDER_URL="" \
7075
HARDHAT_NETWORK=""
7176

7277
# Git commit this image was built from. CI passes
73-
# --build-arg GIT_COMMIT_SHA=<github.sha>; empty for local builds. @talos/client's
78+
# --build-arg GIT_COMMIT_SHA=<github.sha>; empty for local builds. @oplabs/talos-client's
7479
# runContainer reports it as the runner's `version`, letting the admin announce
7580
# redeploys to Discord.
7681
ARG GIT_COMMIT_SHA=""

‎contracts/docs/ACTIONS.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Talos scheduled actions
22

3-
Hardhat tasks the Talos runner (`contracts/runner.ts` → `@talos/client`) runs on
3+
Hardhat tasks the Talos runner (`contracts/runner.ts` → `@oplabs/talos-client`) runs on
44
a cron schedule, or on demand via the "Run now" button in the Talos admin UI.
55
Each action is defined in [`tasks/actions/<name>.ts`](../tasks/actions); the
66
canonical schedule — cron, enabled state, and per-row operational notes — lives

‎contracts/dump-actions-catalog.cjs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
* stays in Node-land here; the bundled JSON is shipped into the image
1010
* and read by `runner.ts` at boot.
1111
*
12-
* Output shape matches `ActionParam[]` from `@talos/client/actions-catalog`.
13-
* Self-contained on purpose — no @talos/client import (the bundle is ESM
12+
* Output shape matches `ActionParam[]` from `@oplabs/talos-client/actions-catalog`.
13+
* Self-contained on purpose — no @oplabs/talos-client import (the bundle is ESM
1414
* and this script runs under Node CJS).
1515
*/
1616

0 commit comments

Comments
 (0)