feat: add guarded Base Sepolia encore
This commit is contained in:
golem
Executable
+188
@@ -0,0 +1,188 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
repository_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
|
||||
guard="$repository_root/tools/require-base-config.sh"
|
||||
terminal_url=https://terminal.invalid/rpc
|
||||
public_url=https://public.invalid/rpc
|
||||
account=demo-account
|
||||
sender=0x1111111111111111111111111111111111111111
|
||||
recipient=0x2222222222222222222222222222222222222222
|
||||
|
||||
run_guard() {
|
||||
local mode=${1-deploy}
|
||||
shift || true
|
||||
env -i PATH="$PATH" \
|
||||
BASE_SEPOLIA_RPC_URL="$terminal_url" \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL="$public_url" \
|
||||
BASE_SEPOLIA_ACCOUNT="$account" \
|
||||
BASE_SEPOLIA_SENDER="$sender" \
|
||||
BASE_SEPOLIA_RECIPIENT="$recipient" \
|
||||
"$@" bash "$guard" "$mode"
|
||||
}
|
||||
|
||||
assert_no_config_values() {
|
||||
local output=$1
|
||||
shift
|
||||
local value
|
||||
for value in "$terminal_url" "$public_url" "$account" "$sender" "$recipient" "$@"; do
|
||||
[[ -n $value ]] || continue
|
||||
if [[ $output == *"$value"* ]]; then
|
||||
echo "configuration guard leaked a configured value" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
expect_rejected() {
|
||||
local assignment=$1
|
||||
local output
|
||||
if output=$(run_guard deploy "$assignment" 2>&1); then
|
||||
echo "configuration guard accepted invalid fixture: ${assignment%%=*}" >&2
|
||||
exit 1
|
||||
fi
|
||||
assert_no_config_values "$output" "${assignment#*=}"
|
||||
}
|
||||
|
||||
for mode in deploy upgrade transfer; do
|
||||
output=$(run_guard "$mode" 2>&1)
|
||||
[[ -z $output ]] || { echo "configuration guard produced output for valid fixtures" >&2; exit 1; }
|
||||
done
|
||||
|
||||
for assignment in \
|
||||
BASE_SEPOLIA_RPC_URL= \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL= \
|
||||
BASE_SEPOLIA_ACCOUNT= \
|
||||
BASE_SEPOLIA_SENDER= \
|
||||
BASE_SEPOLIA_RECIPIENT= \
|
||||
BASE_SEPOLIA_ACCOUNT='bad account' \
|
||||
BASE_SEPOLIA_SENDER=0x1234 \
|
||||
BASE_SEPOLIA_RECIPIENT=0x0000000000000000000000000000000000000000 \
|
||||
BASE_SEPOLIA_RECIPIENT="$sender" \
|
||||
BASE_SEPOLIA_RPC_URL=http://terminal.invalid \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL=http://public.invalid \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL=https://user@public.invalid \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL='https://public.invalid/?api_key=fixture' \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL='https://public.invalid/?token=fixture'; do
|
||||
expect_rejected "$assignment"
|
||||
done
|
||||
|
||||
private_key_name=PRIVATE_$(printf KEY)
|
||||
mnemonic_name=MNEM$(printf ONIC)
|
||||
fake_key=0x$(printf 'a%.0s' {1..64})
|
||||
output=$(
|
||||
env -i PATH="$PATH" "$private_key_name=$fake_key" "$mnemonic_name=fixture words only" \
|
||||
bash "$guard" deploy 2>&1 || true
|
||||
)
|
||||
if [[ $output != *BASE_SEPOLIA_RPC_URL* ]]; then
|
||||
echo "configuration guard unexpectedly accepted a raw-key or mnemonic fallback" >&2
|
||||
exit 1
|
||||
fi
|
||||
assert_no_config_values "$output"
|
||||
|
||||
dry_run=$(
|
||||
make -n -C "$repository_root" deploy-base-sepolia \
|
||||
BASE_SEPOLIA_RPC_URL=https://terminal.invalid \
|
||||
BASE_SEPOLIA_PUBLIC_RPC_URL=https://public.invalid \
|
||||
BASE_SEPOLIA_ACCOUNT=demo \
|
||||
BASE_SEPOLIA_SENDER=0x1111111111111111111111111111111111111111 \
|
||||
BASE_SEPOLIA_RECIPIENT=0x2222222222222222222222222222222222222222
|
||||
)
|
||||
[[ $dry_run == *'--account "demo"'* ]] || { echo "Base dry run omitted --account" >&2; exit 1; }
|
||||
[[ $dry_run == *'--sender "0x1111111111111111111111111111111111111111"'* ]] || \
|
||||
{ echo "Base dry run omitted --sender" >&2; exit 1; }
|
||||
[[ $dry_run == *'--slow'* ]] || { echo "Base dry run omitted --slow" >&2; exit 1; }
|
||||
if [[ ${dry_run,,} == *private-key* || ${dry_run,,} == *mnemonic* ]]; then
|
||||
echo "Base dry run exposed a raw signing option" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
node --input-type=module - "$repository_root" <<'NODE'
|
||||
import assert from "node:assert/strict";
|
||||
import { access, mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { pathToFileURL } from "node:url";
|
||||
|
||||
const repositoryRoot = process.argv[2];
|
||||
const { archiveManifest, selectManifest } = await import(pathToFileURL(join(repositoryRoot, "tools/select-manifest.mjs")));
|
||||
const { publishManifest } = await import(pathToFileURL(join(repositoryRoot, "tools/publish-web-manifest.mjs")));
|
||||
const root = await mkdtemp(join(tmpdir(), "uups-base-config-"));
|
||||
const deployments = join(root, "deployments");
|
||||
const webManifest = join(root, "web/public/deployment.json");
|
||||
const owner = "0x1111111111111111111111111111111111111111";
|
||||
const recipient = "0x2222222222222222222222222222222222222222";
|
||||
const base = {
|
||||
schemaVersion: 1,
|
||||
network: "baseSepolia",
|
||||
chainId: 84532,
|
||||
deploymentBlock: 99,
|
||||
rpcUrl: "https://public.invalid/rpc",
|
||||
explorerBaseUrl: "https://sepolia.basescan.org",
|
||||
token: "0x3333333333333333333333333333333333333333",
|
||||
proxy: "0x4444444444444444444444444444444444444444",
|
||||
implementation: "0x5555555555555555555555555555555555555555",
|
||||
owner,
|
||||
actors: [
|
||||
{ label: "Presenter", address: owner },
|
||||
{ label: "Recipient", address: recipient },
|
||||
],
|
||||
};
|
||||
const anvil = {
|
||||
...base,
|
||||
network: "anvil",
|
||||
chainId: 31337,
|
||||
rpcUrl: "http://127.0.0.1:8545",
|
||||
explorerBaseUrl: undefined,
|
||||
actors: [
|
||||
{ label: "owner", address: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266" },
|
||||
{ label: "Alice", address: "0x70997970C51812dc3A010C7d01b50e0d17dc79C8" },
|
||||
{ label: "Bob", address: "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC" },
|
||||
],
|
||||
owner: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
|
||||
};
|
||||
delete anvil.explorerBaseUrl;
|
||||
|
||||
try {
|
||||
await mkdir(deployments, { recursive: true });
|
||||
await writeFile(join(deployments, "base-sepolia.json"), `${JSON.stringify(base)}\n`);
|
||||
await writeFile(join(deployments, "anvil.json"), `${JSON.stringify(anvil)}\n`);
|
||||
await selectManifest({ root, network: "baseSepolia" });
|
||||
const activeBefore = await readFile(join(deployments, "active.json"));
|
||||
const anvilBefore = await readFile(join(deployments, "anvil.json"));
|
||||
const published = await publishManifest({
|
||||
activePath: join(deployments, "active.json"),
|
||||
outputPath: webManifest,
|
||||
});
|
||||
assert.equal(published.rpcUrl, "https://public.invalid/rpc");
|
||||
assert.equal(published.explorerBaseUrl, "https://sepolia.basescan.org");
|
||||
assert.equal((await readFile(webManifest, "utf8")).includes("terminal.invalid"), false);
|
||||
for (const invalid of [
|
||||
{ ...base, rpcUrl: "http://public.invalid/rpc" },
|
||||
{ ...base, explorerBaseUrl: "https://example.invalid" },
|
||||
]) {
|
||||
await writeFile(join(deployments, "active.json"), `${JSON.stringify(invalid)}\n`);
|
||||
await assert.rejects(
|
||||
() => publishManifest({ activePath: join(deployments, "active.json"), outputPath: webManifest }),
|
||||
/HTTPS|BaseScan/,
|
||||
);
|
||||
}
|
||||
await writeFile(join(deployments, "active.json"), activeBefore);
|
||||
|
||||
const archived = await archiveManifest({
|
||||
root,
|
||||
network: "baseSepolia",
|
||||
now: new Date("2026-08-21T12:34:56.789Z"),
|
||||
});
|
||||
assert.equal(archived.path, join(deployments, "base-sepolia.20260821T123456789Z.json"));
|
||||
await access(archived.path);
|
||||
await assert.rejects(() => access(join(deployments, "base-sepolia.json")));
|
||||
assert.deepEqual(await readFile(join(deployments, "active.json")), activeBefore);
|
||||
assert.deepEqual(await readFile(join(deployments, "anvil.json")), anvilBefore);
|
||||
await assert.rejects(() => archiveManifest({ root, network: "anvil" }), /baseSepolia/);
|
||||
} finally {
|
||||
await rm(root, { recursive: true, force: true });
|
||||
}
|
||||
NODE
|
||||
|
||||
echo "Base configuration and manifest filesystem tests passed"
|
||||
Reference in New Issue
Block a user