(feat) (openai/gpt-5.5, reviewed T, tested T) make RIK deploy through upgradeable proxy

paoloanzn · paoloanzn · commit 49d8dbd58015 · 2026-06-16T09:17:33.000+02:00
diff --git a/.gitmodules b/.gitmodules
@@ -4,3 +4,9 @@
 [submodule "contracts/lib/forge-std"]
 	path = contracts/lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
+[submodule "contracts/lib/openzeppelin-contracts-upgradeable"]
+	path = contracts/lib/openzeppelin-contracts-upgradeable
+	url = https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable
+[submodule "contracts/lib/openzeppelin-foundry-upgrades"]
+	path = contracts/lib/openzeppelin-foundry-upgrades
+	url = https://github.com/OpenZeppelin/openzeppelin-foundry-upgrades
diff --git a/cli/src/abi/RIK.json b/cli/src/abi/RIK.json
@@ -1,13 +1,7 @@
 [
   {
     "type": "constructor",
-    "inputs": [
-      {
-        "name": "initialOwner",
-        "type": "address",
-        "internalType": "address"
-      }
-    ],
+    "inputs": [],
     "stateMutability": "nonpayable"
   },
   {
@@ -102,6 +96,19 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "initialize",
+    "inputs": [
+      {
+        "name": "initialOwner",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "isApprovedForAll",
@@ -495,6 +502,19 @@
     ],
     "anonymous": false
   },
+  {
+    "type": "event",
+    "name": "Initialized",
+    "inputs": [
+      {
+        "name": "version",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      }
+    ],
+    "anonymous": false
+  },
   {
     "type": "event",
     "name": "KeyAdded",
@@ -737,6 +757,16 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "InvalidInitialization",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "NotInitializing",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "OwnableInvalidOwner",
diff --git a/contracts/deploy-sepolia.sh b/contracts/deploy-sepolia.sh
@@ -13,6 +13,7 @@ ARGS=(
   script/Deploy.s.sol
   --rpc-url "$SEPOLIA_RPC_URL"
   --broadcast
+  --force
 )
 
 if [[ "$VERIFY" == "true" ]]; then
diff --git a/contracts/foundry.lock b/contracts/foundry.lock
@@ -10,5 +10,17 @@
       "name": "v5.6.1",
       "rev": "5fd1781b1454fd1ef8e722282f86f9293cacf256"
     }
+  },
+  "lib/openzeppelin-contracts-upgradeable": {
+    "tag": {
+      "name": "v5.6.1",
+      "rev": "7bf4727aacdbfaa0f36cbd664654d0c9e1dc52bf"
+    }
+  },
+  "lib/openzeppelin-foundry-upgrades": {
+    "tag": {
+      "name": "v0.4.1",
+      "rev": "258e12e727bfe7f0ec30c51995d01ec88b82efc1"
+    }
   }
 }
diff --git a/contracts/foundry.toml b/contracts/foundry.toml
@@ -3,5 +3,8 @@ src = "src"
 out = "out"
 libs = ["lib"]
 ffi = true
+ast = true
+build_info = true
+extra_output = ["storageLayout"]
 
 # See more config options https://github.com/foundry-rs/foundry/blob/master/crates/config/README.md#all-options
diff --git a/contracts/lib/openzeppelin-contracts-upgradeable b/contracts/lib/openzeppelin-contracts-upgradeable
@@ -0,0 +1 @@
+Subproject commit 7bf4727aacdbfaa0f36cbd664654d0c9e1dc52bf
diff --git a/contracts/lib/openzeppelin-foundry-upgrades b/contracts/lib/openzeppelin-foundry-upgrades
@@ -0,0 +1 @@
+Subproject commit 258e12e727bfe7f0ec30c51995d01ec88b82efc1
diff --git a/contracts/remappings.txt b/contracts/remappings.txt
@@ -1,2 +1,4 @@
-@openzeppelin/=lib/openzeppelin-contracts/
+@openzeppelin/contracts/=lib/openzeppelin-contracts-upgradeable/lib/openzeppelin-contracts/contracts/
+@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts/
+openzeppelin-foundry-upgrades/=lib/openzeppelin-foundry-upgrades/src/
 forge-std/=lib/forge-std/src/
diff --git a/contracts/script/Deploy.s.sol b/contracts/script/Deploy.s.sol
@@ -4,6 +4,7 @@
 pragma solidity ^0.8.24;
 
 import {Script} from "forge-std/Script.sol";
+import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
 import {RIK} from "../src/RIK.sol";
 
 contract Deploy is Script {
@@ -12,7 +13,8 @@ contract Deploy is Script {
         address owner = vm.addr(deployerPrivateKey);
 
         vm.startBroadcast(deployerPrivateKey);
-        rik = new RIK(owner);
+        address proxy = Upgrades.deployTransparentProxy("RIK.sol", owner, abi.encodeCall(RIK.initialize, (owner)));
+        rik = RIK(proxy);
         vm.stopBroadcast();
     }
 }
diff --git a/contracts/src/RIK.sol b/contracts/src/RIK.sol
@@ -2,14 +2,15 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.24;
 
-import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
-import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
+import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import {ERC721Upgradeable} from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
+import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 import {RSA} from "@openzeppelin/contracts/utils/cryptography/RSA.sol";
 import {Base64} from "@openzeppelin/contracts/utils/Base64.sol";
 import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
 import {JsonClaim} from "./JsonClaim.sol";
 
-contract RIK is ERC721, Ownable {
+contract RIK is Initializable, ERC721Upgradeable, OwnableUpgradeable {
     using RSA for bytes32;
 
     struct RSAKey {
@@ -45,7 +46,15 @@ contract RIK is ERC721, Ownable {
     // NOTE: make it so contract owner can update this
     string public constant EXPECTED_ISS = "https://token.actions.githubusercontent.com";
 
-    constructor(address initialOwner) ERC721("Repository Identity Key", "RIK") Ownable(initialOwner) {}
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
+    function initialize(address initialOwner) public initializer {
+        __ERC721_init("Repository Identity Key", "RIK");
+        __Ownable_init(initialOwner);
+    }
 
     function register(
         bytes32 kid,
diff --git a/contracts/test/RIK.t.sol b/contracts/test/RIK.t.sol
@@ -3,6 +3,7 @@
 pragma solidity ^0.8.24;
 
 import {Test} from "forge-std/Test.sol";
+import {UnsafeUpgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
 import {RIK} from "../src/RIK.sol";
 import {JsonClaim} from "../src/JsonClaim.sol";
 
@@ -25,7 +26,10 @@ contract RIK_T is Test {
     }
 
     function setUp() public {
-        rik = new RIK(deployer);
+        address implementation = address(new RIK());
+        address proxy =
+            UnsafeUpgrades.deployTransparentProxy(implementation, deployer, abi.encodeCall(RIK.initialize, (deployer)));
+        rik = RIK(proxy);
     }
 
     function _loadFixture(string memory name) internal returns (Fixture memory f) {
diff --git a/local-rpc.sh b/local-rpc.sh
@@ -110,18 +110,30 @@ printf 'Foundry root: %s\n' "$FOUNDRY_ROOT"
 printf 'Deployer private key: %s\n' "$PRIVATE_KEY"
 printf 'Owner address: %s\n' "$OWNER_ADDRESS"
 
-if ! DEPLOY_OUTPUT="$(forge create \
-  --root "$FOUNDRY_ROOT" \
-  --broadcast \
-  --rpc-url "$RPC_URL" \
-  --private-key "$PRIVATE_KEY" \
-  "$CONTRACT_PATH_IDENTIFIER" \
-  --constructor-args "$OWNER_ADDRESS" 2>&1)"; then
-  printf '%s\n' "$DEPLOY_OUTPUT" >&2
-  exit 1
+if [[ "$CONTRACT_PATH_IDENTIFIER" == "src/RIK.sol:RIK" ]]; then
+  if ! DEPLOY_OUTPUT="$(PRIVATE_KEY="$PRIVATE_KEY" forge script \
+    --root "$FOUNDRY_ROOT" \
+    script/Deploy.s.sol \
+    --broadcast \
+    --rpc-url "$RPC_URL" \
+    --force 2>&1)"; then
+    printf '%s\n' "$DEPLOY_OUTPUT" >&2
+    exit 1
+  fi
+else
+  if ! DEPLOY_OUTPUT="$(forge create \
+    --root "$FOUNDRY_ROOT" \
+    --broadcast \
+    --rpc-url "$RPC_URL" \
+    --private-key "$PRIVATE_KEY" \
+    "$CONTRACT_PATH_IDENTIFIER" \
+    --constructor-args "$OWNER_ADDRESS" 2>&1)"; then
+    printf '%s\n' "$DEPLOY_OUTPUT" >&2
+    exit 1
+  fi
 fi
 
-CONTRACT_ADDRESS="$(printf '%s\n' "$DEPLOY_OUTPUT" | awk '/Deployed to:/ {print $3; exit} /Contract Address:/ {print $3; exit}')"
+CONTRACT_ADDRESS="$(printf '%s\n' "$DEPLOY_OUTPUT" | awk '/rik: contract RIK/ {print $4; exit} /Deployed to:/ {print $3; exit} /Contract Address:/ {print $3; exit}')"
 
 printf '%s\n' "$DEPLOY_OUTPUT"
 

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@ ARGS=(`
`13`	`13`	`script/Deploy.s.sol`
`14`	`14`	`--rpc-url "$SEPOLIA_RPC_URL"`
`15`	`15`	`--broadcast`
	`16`	`+ --force`
`16`	`17`	`)`
`17`	`18`
`18`	`19`	`if [[ "$VERIFY" == "true" ]]; then`
Original file line number	Diff line number	Diff line change
`@@ -10,5 +10,17 @@`
`10`	`10`	`"name": "v5.6.1",`
`11`	`11`	`"rev": "5fd1781b1454fd1ef8e722282f86f9293cacf256"`
`12`	`12`	`}`
	`13`	`+ },`
	`14`	`+ "lib/openzeppelin-contracts-upgradeable": {`
	`15`	`+ "tag": {`
	`16`	`+ "name": "v5.6.1",`
	`17`	`+ "rev": "7bf4727aacdbfaa0f36cbd664654d0c9e1dc52bf"`
	`18`	`+ }`
	`19`	`+ },`
	`20`	`+ "lib/openzeppelin-foundry-upgrades": {`
	`21`	`+ "tag": {`
	`22`	`+ "name": "v0.4.1",`
	`23`	`+ "rev": "258e12e727bfe7f0ec30c51995d01ec88b82efc1"`
	`24`	`+ }`
`13`	`25`	`}`
`14`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,7 @@`
`4`	`4`	`pragma solidity ^0.8.24;`
`5`	`5`
`6`	`6`	`import {Script} from "forge-std/Script.sol";`
	`7`	`+import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";`
`7`	`8`	`import {RIK} from "../src/RIK.sol";`
`8`	`9`
`9`	`10`	`contract Deploy is Script {`
`@@ -12,7 +13,8 @@ contract Deploy is Script {`
`12`	`13`	`address owner = vm.addr(deployerPrivateKey);`
`13`	`14`
`14`	`15`	`vm.startBroadcast(deployerPrivateKey);`
`15`		`- rik = new RIK(owner);`
	`16`	`+ address proxy = Upgrades.deployTransparentProxy("RIK.sol", owner, abi.encodeCall(RIK.initialize, (owner)));`
	`17`	`+ rik = RIK(proxy);`
`16`	`18`	`vm.stopBroadcast();`
`17`	`19`	`}`
`18`	`20`	`}`