From 19150cf2d57a10b600d35ac14b2fbd8e5121904a Mon Sep 17 00:00:00 2001 From: meloboy001 Date: Sat, 29 Aug 2026 03:20:32 +0100 Subject: [PATCH 1/3] fix(ci): update deploy workflow to use amondnet/vercel-action@v25 --- .github/workflows/deploy.yml | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index cc19748d..8d7f5af3 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,13 +17,22 @@ jobs: deployments: write steps: - - uses: actions/checkout@v4 + - uses: amondnet/vercel-action@v25 + with: + vercel-token: ${{ secrets.VERCEL_TOKEN }} + vercel-org-id: ${{ secrets.VERCEL_ORG_ID }} + vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }} + vercel-args: "--prod" + env: + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} + VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} - name: Use Node.js uses: actions/setup-node@v7 with: - node-version: '18.x' - cache: 'npm' + node-version: "18.x" + cache: "npm" - name: Install dependencies run: npm ci @@ -59,7 +68,7 @@ jobs: vercel-token: ${{ secrets.VERCEL_TOKEN }} vercel-org-id: ${{ secrets.VERCEL_ORG_ID }} vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }} - vercel-args: '--prod' + vercel-args: "--prod" if: | env.VERCEL_TOKEN != '' && env.VERCEL_ORG_ID != '' && @@ -151,7 +160,7 @@ jobs: - name: Set up cosign uses: sigstore/cosign-installer@v3 with: - cosign-release: 'v2.4.3' + cosign-release: "v2.4.3" - name: Download WASM artifacts uses: actions/download-artifact@v8 @@ -248,7 +257,7 @@ jobs: - name: Verify signatures uses: sigstore/cosign-installer@v3 with: - cosign-release: 'v2.4.3' + cosign-release: "v2.4.3" - name: Verify checksums run: | @@ -298,8 +307,8 @@ jobs: - name: Use Node.js uses: actions/setup-node@v7 with: - node-version: '18.x' - cache: 'npm' + node-version: "18.x" + cache: "npm" - name: Enable Corepack run: corepack enable From 6f445ff802c4e3e035804e76c883db8761ff667b Mon Sep 17 00:00:00 2001 From: meloboy001 Date: Sat, 29 Aug 2026 03:55:01 +0100 Subject: [PATCH 2/3] fix(ci): place vercel deploy step at end of frontend job and remove duplicate --- .github/workflows/deploy.yml | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 8d7f5af3..932bad1e 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,16 +17,7 @@ jobs: deployments: write steps: - - uses: amondnet/vercel-action@v25 - with: - vercel-token: ${{ secrets.VERCEL_TOKEN }} - vercel-org-id: ${{ secrets.VERCEL_ORG_ID }} - vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }} - vercel-args: "--prod" - env: - VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} - VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} - VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} + - uses: actions/checkout@v4 - name: Use Node.js uses: actions/setup-node@v7 @@ -63,7 +54,7 @@ jobs: retention-days: 30 - name: Deploy to Vercel - uses: vercel/action@v5 + uses: amondnet/vercel-action@v25 with: vercel-token: ${{ secrets.VERCEL_TOKEN }} vercel-org-id: ${{ secrets.VERCEL_ORG_ID }} @@ -77,7 +68,6 @@ jobs: VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} - contract-build: runs-on: ubuntu-latest permissions: From 6edc2e8274801b559355fdbcf05290b3a47ccccd Mon Sep 17 00:00:00 2001 From: meloboy001 Date: Mon, 31 Aug 2026 09:06:53 +0100 Subject: [PATCH 3/3] fix(ci): resolve merge conflicts with main and keep amondnet/vercel-action --- .github/workflows/deploy.yml | 164 ++++++++++++++++------------------- 1 file changed, 74 insertions(+), 90 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 932bad1e..3e9c0a9a 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,19 +17,22 @@ jobs: deployments: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 + + - name: Enable Corepack + run: corepack enable - name: Use Node.js uses: actions/setup-node@v7 with: - node-version: "18.x" - cache: "npm" + node-version: '22' + cache: yarn - name: Install dependencies - run: npm ci + run: yarn install --immutable - name: Build frontend - run: npm run build + run: yarn build env: CI: true @@ -50,7 +53,9 @@ jobs: uses: actions/upload-artifact@v7 with: name: frontend-checksums-${{ github.sha }} - path: frontend-checksums.txt + path: | + frontend-checksums.txt + frontend-checksums.txt.sha256 retention-days: 30 - name: Deploy to Vercel @@ -59,15 +64,12 @@ jobs: vercel-token: ${{ secrets.VERCEL_TOKEN }} vercel-org-id: ${{ secrets.VERCEL_ORG_ID }} vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }} - vercel-args: "--prod" - if: | - env.VERCEL_TOKEN != '' && - env.VERCEL_ORG_ID != '' && - env.VERCEL_PROJECT_ID != '' + vercel-args: '--prod' env: VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} + contract-build: runs-on: ubuntu-latest permissions: @@ -76,7 +78,7 @@ jobs: attestations: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -133,7 +135,9 @@ jobs: uses: actions/upload-artifact@v7 with: name: wasm-checksums-${{ github.sha }} - path: wasm-checksums.txt + path: | + wasm-checksums.txt + wasm-checksums.txt.sha256 retention-days: 30 sign-artifacts: @@ -145,7 +149,7 @@ jobs: attestations: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up cosign uses: sigstore/cosign-installer@v3 @@ -198,7 +202,7 @@ jobs: done - name: Generate SLSA provenance attestation - uses: actions/attest-build-provenance@v2 + uses: actions/attest-build-provenance@v4 with: subject-path: | ./artifacts/wasm/*.wasm @@ -216,98 +220,32 @@ jobs: ./artifacts/wasm/*.wasm.sig retention-days: 90 - create-release: - needs: [sign-artifacts, contract-build, generate-sbom] - runs-on: ubuntu-latest - permissions: - contents: write - attestations: read - - steps: - - uses: actions/checkout@v4 - - - name: Download signed artifacts - uses: actions/download-artifact@v8 - with: - name: signed-release-${{ github.sha }} - path: ./signed-release - - - name: Download provenance attestation - uses: actions/download-artifact@v8 - with: - name: signed-release-${{ github.sha }} - path: ./release-artifacts - - - name: Download SBOM - uses: actions/download-artifact@v8 - with: - name: sbom-${{ github.sha }} - path: ./sbom - - - name: Verify signatures - uses: sigstore/cosign-installer@v3 - with: - cosign-release: "v2.4.3" - - - name: Verify checksums - run: | - cd ./release-artifacts - sha256sum -c release-checksums.txt.sha256 - echo "Checksum verification passed" - - - name: Create Release - uses: softprops/action-gh-release@v3 - with: - files: | - ./release-artifacts/release-checksums.txt - ./release-artifacts/release-checksums.txt.sha256 - ./release-artifacts/release-checksums.txt.sig - ./release-artifacts/*.wasm - ./release-artifacts/*.wasm.sig - ./sbom/*.json - tag_name: v${{ github.run_number }} - body: | - ## Release v${{ github.run_number }} - - **Commit:** ${{ github.sha }} - **Build date:** ${{ github.event.head_commit.timestamp }} - - ### Artifacts - - **WASM Contract**: Soroban contract binary for deployment - - **Checksum manifest**: `release-checksums.txt` (SHA256) - - **Signatures**: Cosign `.sig` bundles for each artifact - - **Provenance**: SLSA build provenance attestation (via `actions/attest-build-provenance`) - - **SBOM**: Software Bill of Materials (CycloneDX format) for frontend and contract dependencies - - ### Verification - See [artifact-verification.md](./docs/artifact-verification.md) for instructions on verifying artifact integrity and provenance. - draft: false - prerelease: false - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - generate-sbom: runs-on: ubuntu-latest permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 + + - name: Enable Corepack + run: corepack enable - name: Use Node.js uses: actions/setup-node@v7 with: - node-version: "18.x" - cache: "npm" + node-version: '22' + cache: yarn - - name: Enable Corepack - run: corepack enable + - name: Install dependencies + run: yarn install --immutable - name: Install CycloneDX tooling run: npm install -g @cyclonedx/cyclonedx-npm - name: Generate frontend SBOM (CycloneDX) run: | + mkdir -p sbom cyclonedx-npm --output-format JSON --output-file sbom/frontend-sbom.json - name: Install Rust toolchain @@ -320,16 +258,19 @@ jobs: - name: Generate contract SBOM (CycloneDX) run: | + mkdir -p sbom cd contracts cargo cyclonedx --output ../sbom/contract-sbom.json 2>/dev/null || echo "{\"warning\":\"cargo-cyclonedx not available for contract crate\",\"generatedAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ../sbom/contract-sbom.json - name: Generate server SBOM run: | + mkdir -p sbom cd server npx -y @cyclonedx/cyclonedx-npm --output-format JSON --output-file ../sbom/server-sbom.json 2>/dev/null || echo "{\"warning\":\"cyclonedx-npm not available for server\",\"generatedAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ../sbom/server-sbom.json - name: Create SBOM manifest run: | + mkdir -p sbom jq -n \ --arg sha "${{ github.sha }}" \ --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ @@ -344,3 +285,46 @@ jobs: name: sbom-${{ github.sha }} path: sbom/ retention-days: 90 + + create-release: + needs: [sign-artifacts, contract-build, generate-sbom] + runs-on: ubuntu-latest + permissions: + contents: write + attestations: read + + steps: + - uses: actions/checkout@v7 + + - name: Download signed artifacts + uses: actions/download-artifact@v8 + with: + name: signed-release-${{ github.sha }} + path: ./signed-release + + - name: Download SBOM + uses: actions/download-artifact@v8 + with: + name: sbom-${{ github.sha }} + path: ./sbom + + - name: Create GitHub Release + uses: softprops/action-gh-release@v2 + with: + tag_name: deploy-${{ github.sha }} + name: Deploy ${{ github.sha }} + body: | + Automated release from **Deploy - Frontend to Vercel and Artifacts**. + + - Frontend deployed to Vercel production + - Signed WASM + checksum artifacts + - SBOM attached when available + + See [artifact-verification.md](./docs/artifact-verification.md). + draft: false + prerelease: false + files: | + signed-release/** + sbom/** + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file