You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This repository provides GitHub Actions for managing Solana program deployments and verification. The build action figures out the solana and anchor version and builds the program. If it is an anchor program it can also upload the IDL automatically. And it can also verify the program source code on chain.
3
+
This repository provides GitHub Actions for managing Solana program deployments and verification.
4
+
It is highly recommended to use the squads integration for program deployments.
5
+
6
+
### Features
7
+
8
+
- ✅ Automated program builds
9
+
- ✅ Program verification against source code
10
+
- ✅ IDL buffer creation and uploads
11
+
- ✅ Squads multisig integration
12
+
- ✅ Program deploys for both devnet and mainnet
13
+
- ✅ Compute budget optimization
14
+
- ✅ Retry mechanisms for RPC failures
4
15
5
16
### How to use
6
17
7
-
Copy the .github folder and the scripts folder and the tsconfig.json (These are containing the squads SDK integration) into the root of your repository. After you commit these you will be able to use the actions from the github ui.
8
-
The build at test flow will run the tests automatically every time the program changes.
9
-
Then you can use the build action with all the options you need.
18
+
The easiest way to use the github actions is using one of the [reusable workflows](https://github.com/solana-developers/github-workflows).
Some of the options of the build workflow require you to add secrets to your repository:
27
+
Some of the actions of the build workflow require you to add secrets to your repository:
14
28
15
29
```bash
16
30
# Network RPC URLs
@@ -21,131 +35,82 @@ MAINNET_SOLANA_DEPLOY_URL= # Your mainnet RPC URL - Recommended to use a payed
21
35
DEVNET_DEPLOYER_KEYPAIR= # Base58 encoded keypair for devnet
22
36
MAINNET_DEPLOYER_KEYPAIR= # Base58 encoded keypair for mainnet
23
37
24
-
PROGRAM_ADDRESS_KEYPAIR= # Keypair of the program address - Needed for initial deploy and for native programs to find the program address
38
+
PROGRAM_ADDRESS_KEYPAIR= # Keypair of the program address - Needed for initial deploy and for native programs to find the program address. Can also be overwritten in the workflow if you dont have the keypair.
You can easily extend or change your workflow. For example run the build workflow automatically on every push to a development branch.
36
-
37
-
```bash
38
-
push:
39
-
branches:
40
-
- develop
41
-
- dev
42
-
- development
43
-
paths:
44
-
- 'programs/**'
45
-
- 'Anchor.toml'
46
-
- 'Cargo.toml'
47
-
- 'Cargo.lock'
48
-
```
49
-
50
-
Or run a new release to mainnet on every tag push for example.
51
-
52
-
```bash
53
-
push:
54
-
tags:
55
-
- 'v*'
56
-
```
57
-
58
45
Customize the workflow to your needs!
59
46
60
-
### Running the actions locally
61
-
62
-
If you for some reason want to run the actions locally you can do so with the following commands using the act command.
63
-
64
-
Follow the instructions [here](https://nektosact.com/installation/index.html) to install act.
65
-
66
-
1. Build
67
-
68
-
Just pick the parameters you want. This is using act to run the workflow locally. Good for testing or if you dont want to install anything because this is running in docker and outputs the build artifacts as well.
69
-
70
-
```bash
71
-
act -W .github/workflows/build.yaml \
72
-
--container-architecture linux/amd64 \
73
-
--secret-file .secrets \
74
-
workflow_dispatch \
75
-
--input program=transaction-example \
76
-
--input network=devnet \
77
-
--input deploy=true \
78
-
--input upload_idl=true \
79
-
--input verify=true \
80
-
--input use-squads=true
81
-
```
82
-
83
-
2. Run anchor tests
84
-
85
-
Note: The anchor tests use solana-test-validator which does not work in act docker container on mac because of AVX dependency. Wither run them in github, locally without docker or open PR to fix it. I couldnt find a nice way to fix it.
86
-
You can adjust the workflow to run your specific tests as well.
87
-
88
-
```bash
89
-
act -W .github/workflows/test.yaml \
90
-
--container-architecture linux/amd64 \
91
-
--secret-file .secrets \
92
-
workflow_dispatch \
93
-
--input program=transaction-example
94
-
```
95
-
96
-
### Features
97
-
98
-
- ✅ Automated program builds
99
-
- ✅ Program verification against source code
100
-
- ✅ IDL buffer creation and uploads
101
-
- ✅ Squads multisig integration
102
-
- ✅ Support for both devnet and mainnet
103
-
- ✅ Compute budget optimization
104
-
- ✅ Retry mechanisms for RPC failures
105
-
106
-
## How to setup Squads integration:
107
-
108
-
In general its recommended to use the [Squads Multisig](https://docs.squads.so/squads-cli/overview) to manage your programs.
109
-
It makes your program deployments more secure and is considered good practice.
110
-
111
-
1. Setup a new squad in [Squads](https://v4.squads.so/squads/) then transfer your program authority to the squad.
112
-
113
-
2. Add your local keypair to the squad as a member (At least needs to be a voter) so that you can propose transactions. And also add that keypair as a github secret.
114
-
To run it locally add the following to your .secrets file:
115
-
116
-
117
-
118
-
```bash
119
-
DEVNET_DEPLOYER_KEYPAIR=
120
-
MAINNET_DEPLOYER_KEYPAIR=
121
-
```
122
-
123
-
2. Add the following to your .secrets file if you want to run it locally or add them to your github secrets if you want to run it in github actions:
124
-
125
-
```bash
126
-
DEVNET_MULTISIG=
127
-
DEVNET_MULTISIG_VAULT=
128
-
MAINNET_MULTISIG=
129
-
MAINNET_MULTISIG_VAULT=
130
-
```
131
-
132
-
Where Multisig vault is the address you can find on the top left corner in the [Squads Dachboard](https://v4.squads.so/squads/)
133
-
The MULTISIG is the address of the multisig you want to use this one you can find the the settings. Its a bit more hidden so that people dont accidentally use it as program upgrade authority.
134
-
135
-
What this will do is write a program and an IDL buffer for your program and then propose a transaction that you can approve in the Squads UI.
136
-
137
-
4. Now you can run the workflow with the following command:
- Detects Anchor version from Anchor.toml or Cargo.lock
67
+
- Provides fallback versions if not found
68
+
- Outputs:
69
+
-`solana_version`: Detected Solana version
70
+
-`anchor_version`: Detected Anchor version
71
+
72
+
### Build & Verification
73
+
74
+
-`build-verified`: Builds program with verification support
75
+
- Uses solana-verify for reproducible builds
76
+
- Supports both native and Anchor programs
77
+
- Handles feature flags and conditional compilation
78
+
- Inputs:
79
+
-`program`: Program name to build
80
+
-`features`: Optional Cargo features to enable
81
+
82
+
### Deployment
83
+
84
+
-`write-program-buffer`: Writes a buffer that will then later be set either from the provided keypair or from the squads multisig
85
+
86
+
- Creates buffer for program deployment
87
+
- Set the buffer authority either to the provided keypair or to the squads multisig
88
+
- Supports priority fees for faster transactions
89
+
- Inputs:
90
+
-`program-id`: Target program ID
91
+
-`program`: Program name
92
+
-`rpc-url`: Solana RPC endpoint
93
+
-`keypair`: Deployer keypair
94
+
-`buffer-authority-address`: Authority for the buffer
95
+
-`priority-fee`: Transaction priority fee
96
+
97
+
-`write-idl-buffer`: Writes an Anchor IDL buffer that will then later be set either from the provided keypair or from the squads multisig
98
+
- Creates IDL buffer
99
+
- Sets up IDL authority
100
+
- Prepares for IDL updates
101
+
- Inputs:
102
+
-`program-id`: Program ID
103
+
-`program`: Program name
104
+
-`rpc-url`: Solana RPC endpoint
105
+
-`keypair`: Deployer keypair
106
+
-`idl-authority`: Authority for IDL updates
107
+
108
+
### Additional Actions
109
+
110
+
-`build-anchor`: Specialized Anchor program builder
111
+
-`program-upgrade`: Handles the exteding of the program account in case the program is getting bigger and either sets the buffer or skips that in case of squads deploy
112
+
-`idl-upload`: Either sets the IDL buffer or skips that in case of squads deploy
113
+
-`verify-build`: Verifies on-chain programs match source using solana-verify andthe osec api
- When using Squads, the workflow will create a proposal that needs to be approved in the Squads UI
201
-
- For first deployments, program IDL authority errors can be ignored
202
-
- If you run into any problems please open an issue and/or help fix it please :)
203
-
204
-
#### additional notes
205
-
206
-
- IDL must be upgraded before program upgrade instruction other wise it will fail
207
-
- Buffer authority and program upgrade cannot be in the same transaction for some reason (at least using squads) thats why its set during the workflow and not in the squads scripts
0 commit comments