build-contract-verifier-template.yml

name: Build contract verifier
on:
  workflow_call:
    secrets:
      DOCKERHUB_USER:
        description: "DOCKERHUB_USER"
        required: true
      DOCKERHUB_TOKEN:
        description: "DOCKERHUB_TOKEN"
        required: true
    inputs:
      image_tag_suffix:
        description: "Optional suffix to override tag name generation"
        type: string
        required: false
      compilers:
        description: 'JSON of required compilers and their versions'
        type: string
        required: false
        default: '[{ "zksolc": ["1.3.14", "1.3.16", "1.3.17", "1.3.1", "1.3.7", "1.3.18", "1.3.19", "1.3.21"] } , { "zkvyper": ["1.3.13"] }]'
      action:
        type: string
        default: non-push
        required: false

jobs:
  prepare-contracts:
    name: Prepare contracts
    runs-on: matterlabs-ci-runner-high-performance
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          submodules: "recursive"

      - name: Prepare ENV
        shell: bash
        run: |
          echo ZKSYNC_HOME=$(pwd) >> $GITHUB_ENV
          echo CI=1 >> $GITHUB_ENV
          echo $(pwd)/bin >> $GITHUB_PATH
          echo $HOME/.local/bin >> $GITHUB_PATH
          echo CI=1 >> .env
          echo IN_DOCKER=1 >> .env

      - name: Download contracts
        shell: bash
        run: |
          commit_sha=$(git submodule status contracts | awk '{print $1}' | tr -d '-')
          page=1
          filtered_tag=""
          while [ true ]; do
            echo "Page: $page"
            tags=$(run_retried curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" -H "Accept: application/vnd.github+json" \
              "https://api.github.com/repos/matter-labs/era-contracts/tags?per_page=100&page=${page}" | jq .)
            if [ $(jq length <<<"$tags") -eq 0 ]; then
              echo "No tag found on all pages."
              echo "BUILD_CONTRACTS=true" >> "$GITHUB_ENV"
              exit 0
            fi
            filtered_tag=$(jq -r --arg commit_sha "$commit_sha" 'map(select(.commit.sha == $commit_sha)) | .[].name' <<<"$tags")
            if [[ ! -z "$filtered_tag" ]]; then
              echo "BUILD_CONTRACTS=false" >> "$GITHUB_ENV"
              break
            fi
            ((page++))
          done
          echo "Contracts tag is: ${filtered_tag}"
          mkdir -p ./contracts
          run_retried curl -s -LO https://github.com/matter-labs/era-contracts/releases/download/${filtered_tag}/l1-contracts.tar.gz
          run_retried curl -s -LO https://github.com/matter-labs/era-contracts/releases/download/${filtered_tag}/l2-contracts.tar.gz
          run_retried curl -s -LO https://github.com/matter-labs/era-contracts/releases/download/${filtered_tag}/system-contracts.tar.gz
          tar -C ./contracts -zxf l1-contracts.tar.gz
          tar -C ./contracts -zxf l2-contracts.tar.gz
          tar -C ./contracts -zxf system-contracts.tar.gz

      - name: Install Apt dependencies
        if: env.BUILD_CONTRACTS == 'true'
        shell: bash
        run: |
          sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config

      - name: Install Node
        if: env.BUILD_CONTRACTS == 'true'
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Yarn
        if: env.BUILD_CONTRACTS == 'true'
        run: npm install -g yarn

      - name: Setup rust
        if: env.BUILD_CONTRACTS == 'true'
        uses: actions-rust-lang/setup-rust-toolchain@1fbea72663f6d4c03efaab13560c8a24cfd2a7cc # v1.9.0
        with:
          toolchain: nightly-2024-08-01

      - name: Install foundry-zksync
        if: env.BUILD_CONTRACTS == 'true'
        run: |
          mkdir ./foundry-zksync
          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
          tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
          chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
          echo "$PWD/foundry-zksync" >> $GITHUB_PATH

      - name: Pre-download compilers
        if: env.BUILD_CONTRACTS == 'true'
        shell: bash
        run: |
          # Download needed versions of vyper compiler
          # Not sanitized due to unconventional path and tags
          mkdir -p ./hardhat-nodejs/compilers-v2/vyper/linux
          wget -nv -O ./hardhat-nodejs/compilers-v2/vyper/linux/0.3.10 https://github.com/vyperlang/vyper/releases/download/v0.3.10/vyper.0.3.10+commit.91361694.linux
          wget -nv -O ./hardhat-nodejs/compilers-v2/vyper/linux/0.3.3 https://github.com/vyperlang/vyper/releases/download/v0.3.3/vyper.0.3.3+commit.48e326f0.linux
          chmod +x  ./hardhat-nodejs/compilers-v2/vyper/linux/0.3.10
          chmod +x  ./hardhat-nodejs/compilers-v2/vyper/linux/0.3.3

          COMPILERS_JSON='${{ inputs.compilers }}'
          echo "$COMPILERS_JSON" | jq -r '.[] | to_entries[] | .key as $compiler | .value[] | "\(.),\($compiler)"' | while IFS=, read -r version compiler; do
            mkdir -p "./hardhat-nodejs/compilers-v2/$compiler"
            wget -nv -O "./hardhat-nodejs/compilers-v2/$compiler/${compiler}-v${version}" "https://github.com/matter-labs/${compiler}-bin/releases/download/v${version}/${compiler}-linux-amd64-musl-v${version}"
            chmod +x "./hardhat-nodejs/compilers-v2/$compiler/${compiler}-v${version}"
          done

      - name: Install zkstack
        if: env.BUILD_CONTRACTS == 'true'
        run: |
          ./zkstack_cli/zkstackup/install --path ./zkstack_cli/zkstackup/zkstackup
          zkstackup --local || true

      - name: build contracts
        if: env.BUILD_CONTRACTS == 'true'
        shell: bash
        run: |
          cp etc/tokens/{test,localhost}.json
          zkstack dev contracts

      - name: Upload contracts
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        with:
          name: contacts-verifier
          path: |
            ./contracts

  build-images:
    name: Build and Push Docker Images
    needs: prepare-contracts
    permissions:
      packages: write
      contents: read
    runs-on: ${{ fromJSON('["matterlabs-ci-runner-high-performance", "matterlabs-ci-runner-arm"]')[contains(matrix.platforms, 'arm')] }}
    strategy:
      matrix:
        components:
          - contract-verifier
          - verified-sources-fetcher
        platforms:
          - linux/amd64

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          submodules: "recursive"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1

      - name: Setup env
        shell: bash
        run: |
          echo ZKSYNC_HOME=$(pwd) >> $GITHUB_ENV
          echo CI=1 >> $GITHUB_ENV
          echo $(pwd)/bin >> $GITHUB_PATH
          echo CI=1 >> .env
          echo IN_DOCKER=1 >> .env

      - name: Download setup key
        shell: bash
        run: |
          if [ -f "/setup_2^26.key" ]; then
            cp '/setup_2^26.key' './setup_2^26.key'
          else
            run_retried curl -LO https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2\^26.key
          fi

      - name: Set env vars
        shell: bash
        run: |
          echo PLATFORM=$(echo ${{ matrix.platforms }} | tr '/' '-') >> $GITHUB_ENV
          echo IMAGE_TAG_SHA=$(git rev-parse --short HEAD) >> $GITHUB_ENV
          # Support for custom tag suffix
          if [ -n "${{ inputs.image_tag_suffix }}" ]; then
            echo IMAGE_TAG_SHA_TS="${{ inputs.image_tag_suffix }}" >> $GITHUB_ENV
          else
            echo IMAGE_TAG_SHA_TS=$(git rev-parse --short HEAD)-$(date +%s) >> $GITHUB_ENV
          fi

      - name: Download contracts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: contacts-verifier
          path: |
            ./contracts

      - name: login to Docker registries
        if: ${{ inputs.action == 'push' }}
        shell: bash
        run: |
          docker login -u ${{ secrets.DOCKERHUB_USER }} -p ${{ secrets.DOCKERHUB_TOKEN }}
          gcloud auth configure-docker us-docker.pkg.dev -q

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        if: ${{ inputs.action == 'push' }}
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
        with:
          context: .
          load: true
          platforms: ${{ matrix.platforms }}
          file: docker/${{ matrix.components }}/Dockerfile
          build-args: |
            SCCACHE_GCS_BUCKET=matterlabs-infra-sccache-storage
            SCCACHE_GCS_SERVICE_ACCOUNT=gha-ci-runners@matterlabs-infra.iam.gserviceaccount.com
            SCCACHE_GCS_RW_MODE=READ_WRITE
            RUSTC_WRAPPER=sccache
          tags: |
            us-docker.pkg.dev/matterlabs-infra/matterlabs-docker/${{ matrix.components }}:${{ env.IMAGE_TAG_SHA_TS }}-${{ env.PLATFORM }}
            matterlabs/${{ matrix.components }}:${{ env.IMAGE_TAG_SHA_TS }}-${{ env.PLATFORM }}
            ghcr.io/${{ github.repository_owner }}/${{ matrix.components }}:${{ env.IMAGE_TAG_SHA_TS }}-${{ env.PLATFORM }}

      - name: Push docker image
        if: ${{ inputs.action == 'push' }}
        run: |
          docker push us-docker.pkg.dev/matterlabs-infra/matterlabs-docker/${{ matrix.components }}:${{ env.IMAGE_TAG_SHA_TS }}-${{ env.PLATFORM }}
          docker push matterlabs/${{ matrix.components }}:${{ env.IMAGE_TAG_SHA_TS }}-${{ env.PLATFORM }}
          docker push ghcr.io/${{ github.repository_owner }}/${{ matrix.components }}:${{ env.IMAGE_TAG_SHA_TS }}-${{ env.PLATFORM }}

  create_manifest:
    name: Create release manifest
    runs-on: matterlabs-ci-runner
    needs: build-images
    if: ${{ inputs.action == 'push' }}
    strategy:
      matrix:
        component:
          - name: contract-verifier
            platform: linux/amd64
          - name: verified-sources-fetcher
            platform: linux/amd64
    env:
      IMAGE_TAG_SUFFIX: ${{ inputs.image_tag_suffix }}
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4

      - name: login to Docker registries
        run: |
          docker login -u ${{ secrets.DOCKERHUB_USER }} -p ${{ secrets.DOCKERHUB_TOKEN }}
          gcloud auth configure-docker us-docker.pkg.dev -q

      - name: Create Docker manifest
        run: |
          docker_repositories=("matterlabs/${{ matrix.component.name }}" "us-docker.pkg.dev/matterlabs-infra/matterlabs-docker/${{ matrix.component.name }}")
          platforms=${{ matrix.component.platform }}
          for repo in "${docker_repositories[@]}"; do
            platform_tags=""
            for platform in ${platforms//,/ }; do
              platform=$(echo $platform | tr '/' '-')
              platform_tags+=" --amend ${repo}:${IMAGE_TAG_SUFFIX}-${platform}"
            done
            for manifest in "${repo}:${IMAGE_TAG_SUFFIX}" "${repo}:2.0-${IMAGE_TAG_SUFFIX}" "${repo}:latest" "${repo}:latest2.0"; do
              docker manifest create ${manifest} ${platform_tags}
              docker manifest push ${manifest}
            done
          done