Ideas: Phase 8.5 — Sepolia CI pipeline design

[web3guru888]

Phase 8.5 planning — Sepolia CI pipeline

With Phase 8.4 (Docker/Helm) delivering containerisation, Phase 8.5 closes out Phase 8 by wiring the Sepolia testnet contracts into a live CI/CD pipeline.

---

What Phase 8.5 delivers

Deliverable	Details
forge deploy CI step	Re-deploys RingsBridge + Groth16Verifier + bASI on Sepolia in GitHub Actions
Bridge health check	Post-deploy smoke test: deposit 1 bASI → verify event emitted → withdraw
Prometheus alert rule	Alert if bridge contract not reachable for > 5 min
Contract address pinning	Addresses written to config/sepolia.json; read by ExplainAPI at startup
Fuzz test job	forge test --fuzz-runs 1000 on RingsBridge in CI

---

Deployed contract addresses (current Sepolia)

Contract	Address
RingsBridge	0xE034d479EDc2530d9917dDa4547b59bF0964A2Ca
Groth16Verifier	0x9186fc5e27c15aEDbA2512687F2eF2E5aC7C0e59
BridgedToken bASI	0x257dDA1fa34eb847060EcB743E808B65099FB497

Phase 8.5 will add a redeployment workflow that updates these addresses in config/sepolia.json on every tagged release.

---

Proposed CI workflow (.github/workflows/sepolia.yml)

name: Sepolia CI
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

jobs:
  deploy-contracts:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: foundry-rs/foundry-toolchain@v1
      - name: Deploy contracts
        env:
          SEPOLIA_RPC: ${{ secrets.SEPOLIA_RPC }}
          DEPLOYER_PK: ${{ secrets.DEPLOYER_PK }}
        run: |
          cd contracts/
          forge script script/Deploy.s.sol --rpc-url $SEPOLIA_RPC \
            --private-key $DEPLOYER_PK --broadcast
          # Extract addresses and write to config/sepolia.json
          python scripts/extract_addresses.py deployments/sepolia/ > ../config/sepolia.json

  bridge-health:
    needs: deploy-contracts
    runs-on: ubuntu-latest
    steps:
      - name: Smoke test bridge
        run: |
          python scripts/bridge_smoke_test.py \
            --rpc ${{ secrets.SEPOLIA_RPC }} \
            --config config/sepolia.json

  fuzz-contracts:
    runs-on: ubuntu-latest
    steps:
      - uses: foundry-rs/foundry-toolchain@v1
      - name: Fuzz test
        run: forge test --fuzz-runs 1000 -vvv

---

Prometheus alert rule for bridge health

# config/alerts/sepolia.yml
groups:
  - name: sepolia
    rules:
      - alert: SepoliaBridgeUnreachable
        expr: absent(up{job="sepolia_bridge"} == 1)
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Sepolia RingsBridge not reachable"
          description: "No successful scrape from sepolia_bridge job for > 5m"

---

Open questions for Phase 8.5

1. Redeployment vs upgrade: Should Phase 8.5 redeploy fresh contracts on each tagged release, or use a proxy/upgrade pattern (OpenZeppelin Upgradeable)?
2. Fuzz depth: --fuzz-runs 1000 is fast (~30s); should we bump to 10,000 on a nightly schedule?
3. Bridge smoke test: Deposit + withdraw requires actual Sepolia ETH in the CI wallet — how do we fund the deployer address automatically?
4. Config pinning strategy: config/sepolia.json committed to the repo risks stale addresses if someone deploys manually. Should it live in a GitHub Actions variable instead?

---

Phase 8 — full sub-phase tracker

Sub-phase	Issue	Status
8.1 DecisionTracer	#276	✅ spec complete
8.2 CausalGraph	#280	✅ spec complete
8.3 ExplainAPI	#283	✅ spec complete
8.4 Docker/Helm	#291	🟡 in progress
8.5 Sepolia CI	TBD	📋 planning stage