Setup OIDC authentication for GH Actions

.github/workflows/aws-prod.yaml

@@ -5,6 +5,10 @@ on:
 
 name: Deploy to AWS Production (K8s)
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy:
     name: Deploy
@@ -16,13 +20,13 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v2
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ secrets.EKS_AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.EKS_AWS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.GA_OIDC_EKS_PROD }}
+        role-session-name: chainlog-prod
         aws-region: ${{ env.AWS_REGION }}
 
     - name: Login to Amazon ECR

.github/workflows/aws-staging.yaml

@@ -5,6 +5,10 @@ on:
 
 name: Deploy to AWS Staging (K8s)
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy:
     name: Deploy
@@ -16,13 +20,13 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v2
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ secrets.EKS_AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.EKS_AWS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.GA_OIDC_EKS_STAGING }}
+        role-session-name: chainlog-staging
         aws-region: ${{ env.AWS_REGION }}
 
     - name: Login to Amazon ECR

api/goerli/active.json

@@ -387,5 +387,6 @@
   "RWA015_A_INPUT_CONDUIT_URN_PAX": "0xd70d035F723fE739EaDD9D529987D0Aaa291a8FF",
   "RWA015_A_OUTPUT_CONDUIT": "0xEff59711CbB16BCAdA3AA8B8f2Bbd26F5B38a8cA",
   "FLAPPER_MOM": "0x7316C080BFd1c8857605627a251A2F0ae511E4A1",
-  "RWA015_A_INPUT_CONDUIT_URN_GUSD": "0x850e4E039B8ab0682045aCe945Ebc94E9f5A63DD"
+  "RWA015_A_INPUT_CONDUIT_URN_GUSD": "0x850e4E039B8ab0682045aCe945Ebc94E9f5A63DD",
+  "RWA009_A_INPUT_CONDUIT_URN_USDC": "0xddd021b7e3Bfbad19c7D455EB7976DCe51180141"
 }

api/index.json

@@ -1,6 +1,9 @@
 {
   "mainnet": {
     "all": [
+      "1.17.4",
+      "1.17.3",
+      "1.17.2",
       "1.17.0",
       "1.14.5",
       "1.14.4",
@@ -66,10 +69,11 @@
       "1.0.1",
       "1.0.0"
     ],
-    "active": "1.17.0"
+    "active": "1.17.4"
   },
   "goerli": {
     "all": [
+      "1.17.2",
       "1.14.5",
       "1.14.4",
       "1.14.3",
@@ -94,7 +98,7 @@
       "1.9.6",
       "1.9.5"
     ],
-    "active": "1.14.5"
+    "active": "1.17.2"
   },
   "kovan": {
     "all": [

api/mainnet/active.json

@@ -404,11 +404,19 @@
   "CRON_SEQUENCER": "0x238b4E35dAed6100C6162fAE4510261f88996EC9",
   "CRON_AUTOLINE_JOB": "0x67AD4000e73579B9725eE3A149F85C4Af0A61361",
   "CRON_LERP_JOB": "0x8F8f2FC1F0380B9Ff4fE5c3142d0811aC89E32fB",
-  "CRON_D3M_JOB": "0x1Bb799509b0B039345f910dfFb71eEfAc7022323",
+  "CRON_D3M_JOB": "0x2Ea4aDE144485895B923466B4521F5ebC03a0AeF",
   "CRON_CLIPPER_MOM_JOB": "0xc3A76B34CFBdA7A3a5215629a0B937CBDEC7C71a",
   "CRON_ORACLE_JOB": "0xe717Ec34b2707fc8c226b34be5eae8482d06ED03",
   "FLAPPER_MOM": "0xee2058A11612587Ef6F5470e7776ceB0E4736078",
   "PIP_MKR": "0xdbBe5e9B1dAa91430cF0772fCEbe53F6c6f137DF",
   "CRON_FLAP_JOB": "0xc32506E9bB590971671b649d9B8e18CB6260559F",
-  "RWA015_A_INPUT_CONDUIT_URN_GUSD": "0xAB80C37cB5b21238D975c2Cea46e0F12b3d84B06"
+  "RWA015_A_INPUT_CONDUIT_URN_GUSD": "0xAB80C37cB5b21238D975c2Cea46e0F12b3d84B06",
+  "MCD_PSM_GUSD_A_JAR": "0xf2E7a5B83525c3017383dEEd19Bb05Fe34a62C27",
+  "MCD_PSM_GUSD_A_INPUT_CONDUIT_JAR": "0x6934218d8B3E9ffCABEE8cd80F4c1C4167Afa638",
+  "MCD_PSM_PAX_A_JAR": "0x8bF8b5C58bb57Ee9C97D0FEA773eeE042B10a787",
+  "MCD_PSM_PAX_A_INPUT_CONDUIT_JAR": "0xDa276Ab5F1505965e0B6cD1B6da2A18CcBB29515",
+  "RWA009_A_INPUT_CONDUIT_URN_USDC": "0x08012Ec53A7fAbf6F33318dfb93C1289886eBBE1",
+  "DIRECT_SPARK_MORPHO_DAI_POOL": "0x9C259F14E5d9F35A0434cD3C4abbbcaA2f1f7f7E",
+  "DIRECT_SPARK_MORPHO_DAI_PLAN": "0x374b5f915aaED790CBdd341E6f406910d648fD39",
+  "DIRECT_SPARK_MORPHO_DAI_ORACLE": "0xA5AA14DEE8c8204e424A55776E53bfff413b02Af"
 }

logger.py

@@ -105,7 +105,7 @@ def update(chain):
 
 g = Github(os.environ["GITHUB_TOKEN"])
 repo = g.get_repo(os.environ["CHAINLOG_REPO"])
-chains = ["mainnet", "goerli"]
+chains = ["mainnet"]
 while True:
     for chain in chains:
         update(chain)