run-solution.yaml

name: Chainlink (all in one) - run solution

on:
  workflow_dispatch:
    inputs:
      target:
        description: 'Target'
        required: true
        default: 'develop'
        type: choice
        options:
          - develop
          - stage
          - testnet
          - mainnet

concurrency:
  group: ${{ github.workflow }}-${{ inputs.target }}
  cancel-in-progress: false

env:
  TARGET: ${{ inputs.target }}
  SPCTL_CONFIG_FILE: ./config.json
  CONFIGURATION_FILE: ./configuration.json

jobs:
  deploy:
    name: Run solution "Chainlink (all in one)"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Import secrets from Vault
        id: import-secrets
        uses: hashicorp/vault-action@v2
        with:
          url: ${{ secrets.VAULT_ADDR }}
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            github/data/${{ env.TARGET }}/chainlink configuration_json         | CONFIGURATION_JSON ;
            github/data/${{ env.TARGET }}/spctl     offers_config_json         | OFFERS_SPCTL_CONFIG_JSON ;
            github/data/${{ env.TARGET }}/chainlink solution_offer             | SOLUTION_OFFER ;
            github/data/${{ env.TARGET }}/chainlink tee_offers                 | TEE ;
            github/data/${{ env.TARGET }}/chainlink spctl_version              | SPCTL_VERSION ;
            github/data/${{ env.TARGET }}/chainlink spctl_repository           | SPCTL_REPOSITORY ;
            github/data/${{ env.TARGET }}/chainlink config_private_key_base64  | CONFIG_PRIVATE_KEY_BASE64

      - name: Mask private key
        if: ${{ steps.import-secrets.outputs.CONFIG_PRIVATE_KEY_BASE64 != '' }}
        run: |
          echo "::add-mask::${{ steps.import-secrets.outputs.CONFIG_PRIVATE_KEY_BASE64 }}"

      - name: Display configuration
        shell: bash
        run: |
          echo "🔧 Configuration:"
          echo "  - Target: ${{ env.TARGET }}"
          echo "  - SPCTL version: ${{ steps.import-secrets.outputs.SPCTL_VERSION }}"
          echo "  - SPCTL repository: ${{ steps.import-secrets.outputs.SPCTL_REPOSITORY }}"
          echo "  - Solution offer: ${{ steps.import-secrets.outputs.SOLUTION_OFFER }}"

      - name: Download and install SPCTL
        uses: Super-Protocol/sp-build-tools/actions/download-spctl@v1
        with:
          version: ${{ steps.import-secrets.outputs.SPCTL_VERSION }}
          repository: ${{ steps.import-secrets.outputs.SPCTL_REPOSITORY }}
          gh_token: ${{ secrets.GHFG_TOKEN_SPCTL_RELEASES_DOWNLOAD }}

      - name: Prepare SPCTL config and configuration
        shell: bash
        run: |
          printf '%s' '${{ toJSON(steps.import-secrets.outputs.OFFERS_SPCTL_CONFIG_JSON) }}' | jq -r . > "${{ env.SPCTL_CONFIG_FILE }}"
          printf '%s' '${{ toJSON(steps.import-secrets.outputs.CONFIGURATION_JSON) }}' | jq -r . > "${{ env.CONFIGURATION_FILE }}"

      - name: Setup Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Sign configuration file
        if: ${{ steps.import-secrets.outputs.CONFIG_PRIVATE_KEY_BASE64 != '' }}
        shell: bash
        run: |
          cd configuration-signer
          npm ci
          npm run sign $(realpath ../$CONFIGURATION_FILE) "${{ steps.import-secrets.outputs.CONFIG_PRIVATE_KEY_BASE64 }}"

          # Print signature value from configuration file
          SIG=$(jq -r '.signature // empty' "../${{ env.CONFIGURATION_FILE }}")
          if [ -z "$SIG" ]; then
            echo "🔍 signature key not found in ${{ env.CONFIGURATION_FILE }}"
            exit 1
          else
            echo "CONFIG_SIGNATURE=$SIG"
          fi

      - name: Compute repository variable key
        id: var-key
        shell: bash
        run: |
          set -euo pipefail
          raw="CHAINLINK_${{ env.TARGET }}_SOLUTION_ORDER"
          safe=$(echo "$raw" | tr '[:lower:]' '[:upper:]' | sed -E 's/[^A-Z0-9_]/_/g')
          if echo "$safe" | grep -qE '^[0-9]'; then
            safe="_$safe"
          fi
          echo "varname=$safe" >> "$GITHUB_OUTPUT"

      - name: Create workflow
        id: run-solution
        uses: Super-Protocol/sp-build-tools/actions/create-workflows@v1
        with:
          spctl_config_file: ${{ env.SPCTL_CONFIG_FILE }}
          tee_offers: ${{ steps.import-secrets.outputs.TEE }}
          solution: ${{ steps.import-secrets.outputs.SOLUTION_OFFER }}
          previous_orders: ${{ vars[steps.var-key.outputs.varname] }}
          solution_configuration: ${{ env.CONFIGURATION_FILE }}

      - name: Create or update repository variable
        uses: Super-Protocol/sp-build-tools/actions/create-or-update-repo-variable@v1
        # Persist new order ids for this solution only (keyed by TARGET + solution_id)
        if: ${{ steps.run-solution.outputs.order_ids != '' }}
        with:
          gh_token: ${{ secrets.TOKEN_GITHUB_REPO_RW }}
          variable_name: ${{ steps.var-key.outputs.varname }}
          data: ${{ steps.run-solution.outputs.order_ids }}