From c8ab97225962f13924715777063f4fe87cbfe279 Mon Sep 17 00:00:00 2001 From: jonthia-drift Date: Fri, 12 Jun 2026 12:06:50 +1000 Subject: [PATCH 1/4] chore(ci): Velocity ECR publish role via OIDC, drop kubectl rollout (master.yml) --- .github/workflows/master.yml | 28 +--------------------------- 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 8ac1cc6..eb77693 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -49,7 +49,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: - role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_NONPROD }} + role-to-assume: ${{ vars.VELOCITY_NON_PROD_ECR_PUBLISH_ROLE }} role-session-name: gha-${{ github.run_id }} aws-region: ${{ secrets.EKS_NON_PROD_REGION }} @@ -76,29 +76,3 @@ jobs: tags: | ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}-${{ env.BRANCH_NAME }} ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest-${{ env.BRANCH_NAME }} - - deploy: - runs-on: ubicloud - needs: [build] - steps: - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 - with: - role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_NONPROD }} - role-session-name: gha-${{ github.run_id }} - aws-region: ${{ secrets.EKS_NON_PROD_REGION }} - - - name: Install kubectl - uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2 - with: - version: "v1.30.0" - - - name: Configure AWS EKS Credentials - run: aws eks update-kubeconfig --name ${{ secrets.EKS_NON_PROD_CLUSTER_NAME }} --region ${{ secrets.EKS_NON_PROD_REGION }} --role-arn ${{ secrets.EKS_NON_PROD_DEPLOY_ROLE }} - - - name: Restart deployment - env: - BRANCH_NAME: ${{ github.ref_name }} - run: | - kubectl rollout restart -n $BRANCH_NAME deployment/rust-filler-bot - kubectl rollout restart -n $BRANCH_NAME deployment/rust-liquidator-bot From af71415cd7b5c0ff0e114726312d177842523fe2 Mon Sep 17 00:00:00 2001 From: jonthia-drift Date: Fri, 12 Jun 2026 12:06:53 +1000 Subject: [PATCH 2/4] chore(ci): Velocity ECR publish role via OIDC, drop kubectl rollout (mainnet-beta.yml) --- .github/workflows/mainnet-beta.yml | 28 +--------------------------- 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/.github/workflows/mainnet-beta.yml b/.github/workflows/mainnet-beta.yml index 7a85509..ee0f3b5 100644 --- a/.github/workflows/mainnet-beta.yml +++ b/.github/workflows/mainnet-beta.yml @@ -49,7 +49,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: - role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_PROD }} + role-to-assume: ${{ vars.VELOCITY_PROD_ECR_PUBLISH_ROLE }} role-session-name: gha-${{ github.run_id }} aws-region: ${{ secrets.EKS_PROD_REGION }} @@ -76,29 +76,3 @@ jobs: tags: | ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}-${{ env.BRANCH_NAME }} ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest-${{ env.BRANCH_NAME }} - - deploy: - runs-on: ubicloud - needs: [build] - steps: - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 - with: - role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_PROD }} - role-session-name: gha-${{ github.run_id }} - aws-region: ${{ secrets.EKS_PROD_REGION }} - - - name: Install kubectl - uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2 - with: - version: "v1.30.0" - - - name: Configure AWS EKS Credentials - run: aws eks update-kubeconfig --name ${{ secrets.EKS_PROD_CLUSTER_NAME }} --region ${{ secrets.EKS_PROD_REGION }} --role-arn ${{ secrets.EKS_PROD_DEPLOY_ROLE }} - - - name: Restart deployment - env: - BRANCH_NAME: ${{ github.ref_name }} - run: | - kubectl rollout restart -n $BRANCH_NAME deployment/rust-filler-bot - kubectl rollout restart -n $BRANCH_NAME deployment/rust-liquidator-bot From b41d395b4fe0bc93c47f076844fa87d337b3698a Mon Sep 17 00:00:00 2001 From: Noah Prince Date: Fri, 12 Jun 2026 09:44:07 -0700 Subject: [PATCH 3/4] chore(ci): tag-driven Velocity ECR publish; restore branch workflows - master.yml / mainnet-beta.yml restored to the old drift deploy flow (old infra keeps deploying until decommission) - new velocity-publish.yml: pushing a vX.Y.Z tag publishes that exact, immutable version to Velocity ECR (prod copy gated until the prod account exists). Deploy = bump the gitops pin in infrastructure-v3. Co-Authored-By: Claude Fable 5 --- .github/workflows/mainnet-beta.yml | 28 +++++- .github/workflows/master.yml | 28 +++++- .github/workflows/velocity-publish.yml | 117 +++++++++++++++++++++++++ 3 files changed, 171 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/velocity-publish.yml diff --git a/.github/workflows/mainnet-beta.yml b/.github/workflows/mainnet-beta.yml index ee0f3b5..7a85509 100644 --- a/.github/workflows/mainnet-beta.yml +++ b/.github/workflows/mainnet-beta.yml @@ -49,7 +49,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: - role-to-assume: ${{ vars.VELOCITY_PROD_ECR_PUBLISH_ROLE }} + role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_PROD }} role-session-name: gha-${{ github.run_id }} aws-region: ${{ secrets.EKS_PROD_REGION }} @@ -76,3 +76,29 @@ jobs: tags: | ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}-${{ env.BRANCH_NAME }} ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest-${{ env.BRANCH_NAME }} + + deploy: + runs-on: ubicloud + needs: [build] + steps: + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + with: + role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_PROD }} + role-session-name: gha-${{ github.run_id }} + aws-region: ${{ secrets.EKS_PROD_REGION }} + + - name: Install kubectl + uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2 + with: + version: "v1.30.0" + + - name: Configure AWS EKS Credentials + run: aws eks update-kubeconfig --name ${{ secrets.EKS_PROD_CLUSTER_NAME }} --region ${{ secrets.EKS_PROD_REGION }} --role-arn ${{ secrets.EKS_PROD_DEPLOY_ROLE }} + + - name: Restart deployment + env: + BRANCH_NAME: ${{ github.ref_name }} + run: | + kubectl rollout restart -n $BRANCH_NAME deployment/rust-filler-bot + kubectl rollout restart -n $BRANCH_NAME deployment/rust-liquidator-bot diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index eb77693..8ac1cc6 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -49,7 +49,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: - role-to-assume: ${{ vars.VELOCITY_NON_PROD_ECR_PUBLISH_ROLE }} + role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_NONPROD }} role-session-name: gha-${{ github.run_id }} aws-region: ${{ secrets.EKS_NON_PROD_REGION }} @@ -76,3 +76,29 @@ jobs: tags: | ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}-${{ env.BRANCH_NAME }} ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest-${{ env.BRANCH_NAME }} + + deploy: + runs-on: ubicloud + needs: [build] + steps: + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + with: + role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_NONPROD }} + role-session-name: gha-${{ github.run_id }} + aws-region: ${{ secrets.EKS_NON_PROD_REGION }} + + - name: Install kubectl + uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2 + with: + version: "v1.30.0" + + - name: Configure AWS EKS Credentials + run: aws eks update-kubeconfig --name ${{ secrets.EKS_NON_PROD_CLUSTER_NAME }} --region ${{ secrets.EKS_NON_PROD_REGION }} --role-arn ${{ secrets.EKS_NON_PROD_DEPLOY_ROLE }} + + - name: Restart deployment + env: + BRANCH_NAME: ${{ github.ref_name }} + run: | + kubectl rollout restart -n $BRANCH_NAME deployment/rust-filler-bot + kubectl rollout restart -n $BRANCH_NAME deployment/rust-liquidator-bot diff --git a/.github/workflows/velocity-publish.yml b/.github/workflows/velocity-publish.yml new file mode 100644 index 0000000..981fdc9 --- /dev/null +++ b/.github/workflows/velocity-publish.yml @@ -0,0 +1,117 @@ +# Velocity ECR publishing — tag-driven. Push a vX.Y.Z tag and this builds +# the tagged commit and pushes keep-rs:vX.Y.Z to Velocity ECR. Tags there +# are IMMUTABLE: a published version can never be overwritten — +# re-releasing means a new tag. Deploying a version is a separate PR in +# drift-labs/infrastructure-v3 bumping the gitops image pin. +# +# NOTE: the drift-rs / protocol-v2-shadow sibling checkouts track floating +# refs (next / master), so rebuilding the same tag later may not be +# bit-identical — but immutability means a published version is never +# rebuilt anyway. +# +# Every version lands in non-prod ECR and is copied to prod ECR once the +# prod account exists (steps gated on VELOCITY_PROD_ECR_PUBLISH_ROLE). +# The branch-push workflows (master.yml / mainnet-beta.yml) still deploy +# the OLD drift infra and are untouched; this is the only Velocity path. +name: Publish Velocity ECR (release tag) + +on: + push: + tags: ['v*'] + +env: + # drift-rs + protocol-v2-shadow (the `drift` crate) are path-dep siblings of + # keep-rs; the docker build context is the parent dir holding all three. + DRIFT_RS_REF: next + SHADOW_REF: master + +permissions: + id-token: write + contents: read + +jobs: + publish: + runs-on: ubicloud + steps: + - name: Checkout keep-rs + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + path: keep-rs + + - name: Checkout drift-rs + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + repository: drift-labs/drift-rs + ref: ${{ env.DRIFT_RS_REF }} + path: drift-rs + + - name: Generate protocol-v2-shadow read token + id: shadow-token + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1 + with: + app-id: ${{ vars.VELOCITY_SDK_READER_APP_ID }} + private-key: ${{ secrets.VELOCITY_SDK_READER_PRIVATE_KEY }} + owner: drift-labs + repositories: protocol-v2-shadow + + - name: Checkout protocol-v2-shadow + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + repository: drift-labs/protocol-v2-shadow + ref: ${{ env.SHADOW_REF }} + token: ${{ steps.shadow-token.outputs.token }} + path: protocol-v2-shadow + + - name: Configure AWS credentials (non-prod) + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + with: + role-to-assume: ${{ vars.VELOCITY_NON_PROD_ECR_PUBLISH_ROLE }} + role-session-name: gha-${{ github.run_id }} + aws-region: eu-west-1 + + - name: Log in to Amazon ECR (non-prod) + id: login-ecr + uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7 # v2.1.4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + with: + version: v0.10.0 + + - name: Docker build + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + env: + ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + ECR_REPOSITORY: keep-rs + IMAGE_TAG: ${{ github.ref_name }} + with: + context: . + file: keep-rs/Dockerfile + push: true + tags: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }} + + # Prod copy — no-ops until the prod account + publish role exist. + - name: Configure AWS credentials (prod) + if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + with: + role-to-assume: ${{ vars.VELOCITY_PROD_ECR_PUBLISH_ROLE }} + role-session-name: gha-${{ github.run_id }} + aws-region: eu-west-1 + + - name: Log in to Amazon ECR (prod) + if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' + id: login-ecr-prod + uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7 # v2.1.4 + + - name: Copy image to prod ECR + if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' + env: + NONPROD_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + PROD_REGISTRY: ${{ steps.login-ecr-prod.outputs.registry }} + ECR_REPOSITORY: keep-rs + IMAGE_TAG: ${{ github.ref_name }} + run: | + docker buildx imagetools create \ + -t "$PROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" \ + "$NONPROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" From 1d040dd685ca45174e0ca52e509f27ef6c92a925 Mon Sep 17 00:00:00 2001 From: Noah Prince Date: Fri, 12 Jun 2026 10:20:26 -0700 Subject: [PATCH 4/4] chore(ci): comment out prod ECR copy until prod account exists Co-Authored-By: Claude Fable 5 --- .github/workflows/velocity-publish.yml | 51 +++++++++++++------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/.github/workflows/velocity-publish.yml b/.github/workflows/velocity-publish.yml index 981fdc9..bac0ccd 100644 --- a/.github/workflows/velocity-publish.yml +++ b/.github/workflows/velocity-publish.yml @@ -9,8 +9,8 @@ # bit-identical — but immutability means a published version is never # rebuilt anyway. # -# Every version lands in non-prod ECR and is copied to prod ECR once the -# prod account exists (steps gated on VELOCITY_PROD_ECR_PUBLISH_ROLE). +# Every version lands in non-prod ECR; the prod-copy steps below are +# commented out until the prod account exists. # The branch-push workflows (master.yml / mainnet-beta.yml) still deploy # the OLD drift infra and are untouched; this is the only Velocity path. name: Publish Velocity ECR (release tag) @@ -90,28 +90,29 @@ jobs: push: true tags: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }} - # Prod copy — no-ops until the prod account + publish role exist. - - name: Configure AWS credentials (prod) - if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 - with: - role-to-assume: ${{ vars.VELOCITY_PROD_ECR_PUBLISH_ROLE }} - role-session-name: gha-${{ github.run_id }} - aws-region: eu-west-1 + # Prod copy — disabled until the prod account + publish role exist; + # uncomment when VELOCITY_PROD_ECR_PUBLISH_ROLE is set. + # - name: Configure AWS credentials (prod) + # if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' + # uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + # with: + # role-to-assume: ${{ vars.VELOCITY_PROD_ECR_PUBLISH_ROLE }} + # role-session-name: gha-${{ github.run_id }} + # aws-region: eu-west-1 - - name: Log in to Amazon ECR (prod) - if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' - id: login-ecr-prod - uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7 # v2.1.4 + # - name: Log in to Amazon ECR (prod) + # if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' + # id: login-ecr-prod + # uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7 # v2.1.4 - - name: Copy image to prod ECR - if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' - env: - NONPROD_REGISTRY: ${{ steps.login-ecr.outputs.registry }} - PROD_REGISTRY: ${{ steps.login-ecr-prod.outputs.registry }} - ECR_REPOSITORY: keep-rs - IMAGE_TAG: ${{ github.ref_name }} - run: | - docker buildx imagetools create \ - -t "$PROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" \ - "$NONPROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" + # - name: Copy image to prod ECR + # if: vars.VELOCITY_PROD_ECR_PUBLISH_ROLE != '' + # env: + # NONPROD_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + # PROD_REGISTRY: ${{ steps.login-ecr-prod.outputs.registry }} + # ECR_REPOSITORY: keep-rs + # IMAGE_TAG: ${{ github.ref_name }} + # run: | + # docker buildx imagetools create \ + # -t "$PROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" \ + # "$NONPROD_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"