dapp-deploy.yml

name: deploy-dapp

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        type: choice
        options:
          # dev environments
          - bellecour-dev
          - arbitrum-sepolia-dev
          # prod environments (requires a tag starting with dapp-v)
          - bellecour-prod
          - arbitrum-sepolia-prod
          - arbitrum-prod

jobs:
  extract-tag:
    runs-on: ubuntu-latest
    outputs:
      clean_tag: ${{ steps.tag.outputs.clean_tag }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        #   ref should be a tag beginning with dapp-v if not exit error
        #   use unique clean-tag: <tag>-<timestamp>
        # else
        #   use rolling clean-tag: dev
      - name: Check and extract tag
        id: tag
        run: |
          if [[ "${{ github.event.inputs.environment }}" == *-prod ]]; then
            if [[ "${GITHUB_REF}" != refs/tags/dapp-v* ]]; then
              echo "Error: The ref must be a tag starting with 'dapp-v' for production deployments."
              exit 1
            fi
            TAG=${GITHUB_REF#refs/tags/dapp-v}-$(date +%s)
            echo "clean_tag=${TAG}" | tee -a $GITHUB_OUTPUT
          else
            echo "clean_tag=dev" | tee -a $GITHUB_OUTPUT
          fi
  docker-publish:
    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v3.3.0
    needs: [extract-tag]
    with:
      image-name: 'iexechub/web3telegram-dapp'
      registry: 'docker.io'
      dockerfile: 'dapp/Dockerfile'
      context: 'dapp'
      security-scan: false
      hadolint: true
      push: true
      image-tag: ${{ needs.extract-tag.outputs.clean_tag }}
    secrets:
      dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
      dockerhub-password: ${{ secrets.DOCKERHUB_PAT }}
      username: ${{ secrets.DOCKERHUB_USERNAME }}
      password: ${{ secrets.DOCKERHUB_PAT }}

  sconify:
    if: startsWith(github.event.inputs.environment, 'bellecour-')
    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/sconify.yml@sconify-v2.0.0
    needs: [docker-publish, extract-tag]
    with:
      image-name: 'iexechub/web3telegram-dapp'
      image-tag: ${{ needs.extract-tag.outputs.clean_tag }}
      sconify-debug: false
      sconify-prod: true
      docker-registry: docker.io
      sconify-version: ${{ vars.SCONIFY_VERSION }}
      binary: /usr/local/bin/node
      command: node
      host-path: |
        /etc/hosts
        /etc/resolv.conf
      binary-fs: true
      fs-dir: /app
      heap: 1G
      dlopen: 1
      mprotect: 0
    secrets:
      docker-username: ${{ secrets.DOCKERHUB_USERNAME }}
      docker-password: ${{ secrets.DOCKERHUB_PAT }}
      scontain-username: ${{ secrets.SCONTAIN_REGISTRY_USERNAME }}
      scontain-password: ${{ secrets.SCONTAIN_REGISTRY_PAT }}
      scone-signing-key: ${{ secrets.SCONIFY_SIGNING_PRIVATE_KEY }}

  deploy-tdx-dapp:
    if: startsWith(github.event.inputs.environment, 'arbitrum-')
    needs: [extract-tag, docker-publish]
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20.19.0'
          cache: 'npm'

      - name: Install dependencies
        run: |
          npm ci
          cd node_modules/whitelist-smart-contract
          npm install --save-dev ts-node
          cd ../../deployment-dapp
          npm ci

      - name: Deploy TDX dapp contract
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          DOCKER_IMAGE_TAG: ${{ needs.extract-tag.outputs.clean_tag }}
          CHECKSUM: ${{ needs.docker-publish.outputs.checksum }}
          RPC_URL: ${{ secrets.RPC_URL }}
        run: |
          cd deployment-dapp
          npm run deploy-dapp

      - name: Push dapp secret
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          RPC_URL: ${{ secrets.RPC_URL }}
        run: |
          cd deployment-dapp
          npm run push-dapp-secret

      - name: Publish free sell order
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          PRICE: ${{ vars.SELL_ORDER_PRICE }}
          VOLUME: ${{ vars.SELL_ORDER_VOLUME }}
          RPC_URL: ${{ secrets.RPC_URL }}
          TEE_FRAMEWORK: ${{ vars.TEE_FRAMEWORK }}
        run: |
          cd deployment-dapp
          npm run publish-sell-order

      - name: Add resource to whitelist
        env:
          CONTRACT_ADDRESS: ${{ vars.WEB3TELEGRAM_WHITELIST_CONTRACT_ADDRESS }}
          PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          RPC_URL: ${{ secrets.RPC_URL }}
        run: |
          cd node_modules/whitelist-smart-contract
          export ADDRESS_TO_ADD=$(cat ../../deployment-dapp/.app-address)
          npm run addResourceToWhitelist -- --network ${{ vars.WHITELIST_NETWORK_NAME }}

  deploy-scone-dapp:
    if: startsWith(github.event.inputs.environment, 'bellecour-')
    needs: [extract-tag, sconify]
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: |
          npm ci
          cd node_modules/whitelist-smart-contract
          npm install --save-dev ts-node
          cd ../../deployment-dapp
          npm ci

      - name: Deploy SCONE dapp contract
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          DOCKER_IMAGE_TAG: ${{ needs.sconify.outputs.prod-image-tag }}
          CHECKSUM: ${{  needs.sconify.outputs.prod-checksum }}
          FINGERPRINT: ${{ needs.sconify.outputs.prod-mrenclave }}
          RPC_URL: ${{ secrets.RPC_URL }}
          SCONIFY_VERSION: ${{ vars.SCONIFY_VERSION }}
        run: |
          cd deployment-dapp
          npm run deploy-dapp

      - name: Push dapp secret
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          RPC_URL: ${{ secrets.RPC_URL }}
        run: |
          cd deployment-dapp
          npm run push-dapp-secret

      - name: Publish free sell order
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          PRICE: ${{ vars.SELL_ORDER_PRICE }}
          VOLUME: ${{ vars.SELL_ORDER_VOLUME }}
          RPC_URL: ${{ secrets.RPC_URL }}
          TEE_FRAMEWORK: ${{ vars.TEE_FRAMEWORK }}
        run: |
          cd deployment-dapp
          npm run publish-sell-order

      - name: Add resource to whitelist
        env:
          CONTRACT_ADDRESS: ${{ vars.WEB3TELEGRAM_WHITELIST_CONTRACT_ADDRESS }}
          PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          RPC_URL: ${{ secrets.RPC_URL }}
        run: |
          cd node_modules/whitelist-smart-contract
          export ADDRESS_TO_ADD=$(cat ../../deployment-dapp/.app-address)
          npm run addResourceToWhitelist -- --network ${{ vars.WHITELIST_NETWORK_NAME }}

      - name: Configure ENS
        if: ${{ vars.DAPP_ENS_NAME }}
        env:
          WALLET_PRIVATE_KEY: ${{ secrets.WEB3TELEGRAM_APP_OWNER_PRIVATEKEY }}
          DAPP_ENS_NAME: ${{ vars.DAPP_ENS_NAME }}
        run: |
          cd deployment-dapp
          npm run configure-ens