Q&A: Phase 8.5 — Sepolia CI configuration and deployment questions

[web3guru888]

Phase 8.5 — Sepolia CI: Q&A

Common configuration and deployment questions for Phase 8.5 (Sepolia CI pipeline, bridge health monitoring, and on-chain fuzz testing).

---

Q1: Which secrets does the sepolia.yml workflow need, and how are they scoped?

Three secrets are required:

Secret	Used by	Scope
SEPOLIA_RPC	deploy-contracts, bridge-health, exporter	Repository secret
DEPLOYER_PK	deploy-contracts only	Repository secret (never exposed in bridge-health)
GH_BOT_TOKEN	update-config (commits sepolia.json)	Repository secret with contents: write

DEPLOYER_PK is only injected into the deploy-contracts job — the smoke test job receives config/sepolia.json as an artifact, not the private key.

---

Q2: How much Sepolia ETH does the deployer account need?

Rough estimates based on Sepolia gas prices (~20 gwei):

Operation	Gas units	Cost (20 gwei)
Deploy RingsBridge	~800,000	~0.016 ETH
Deploy Groth16Verifier	~400,000	~0.008 ETH
Deploy BridgedToken	~600,000	~0.012 ETH
Smoke test (2 txns)	~200,000	~0.004 ETH
Total per release	~2,000,000	~0.04 ETH

Sepolia ETH is free from the Alchemy or Infura faucets. Keep at least 0.1 ETH in the deployer account.

---

Q3: How do I tune the fuzz test run count?

The default is --fuzz-runs 1000 (about 30 s on ubuntu-latest). Adjust in foundry.toml:

[fuzz]
runs = 1000       # PR checks — fast feedback
seed  = 0         # deterministic seed for reproducibility

For nightly / release runs, increase to --fuzz-runs 10000 by passing the flag explicitly:

- run: forge test --fuzz-runs 10000 -vvv

Monitor CI runtime — if fuzz jobs exceed 10 min, reduce runs or split into separate test files.

---

Q4: How does extract_addresses.py handle partial redeployments?

If only one contract is redeployed (e.g., RingsBridge is upgraded but BridgedToken stays), extract_addresses.py reads only the new broadcast files. To avoid wiping existing addresses, it merges with the existing config/sepolia.json:

existing = json.loads(Path("config/sepolia.json").read_text()) if Path("config/sepolia.json").exists() else {}
merged = {**existing, **new_addresses, "deployed_at": now()}

This preserves contract addresses for contracts not redeployed in this run.

---

Q5: What happens when the Sepolia RPC is rate-limited during CI?

bridge_smoke_test.py uses exponential back-off with jitter:

for attempt in range(5):
    try:
        return fn()
    except Exception:
        time.sleep((2 ** attempt) + random.uniform(0, 1))
raise RuntimeError("RPC unreachable after 5 attempts")

The exporter handles RPC timeouts by skipping the scrape cycle and incrementing an internal error counter (not exposed as a Prometheus metric — use up{job="sepolia_bridge"} instead).

---

Q6: How does the SepoliaBridgeDepositStalled alert avoid false positives on testnets?

Testnet traffic is sparse — no deposits for 30 min is normal during low-activity periods. Options:

Option	Trade-off
Increase for: 30m to for: 6h	Fewer false positives; slower detection
Add unless on(instance) up{job="sepolia_bridge"} == 0	Suppresses alert when exporter is down
Route to warning channel only	Operators see it but PagerDuty not triggered

Default config routes SepoliaBridgeDepositStalled to severity: warning (Slack/email, not PagerDuty).

---

Q7: How do I run Phase 8.5 locally without spending Sepolia ETH?

Use Foundry's anvil with a Sepolia fork:

# Start local fork
anvil --fork-url $SEPOLIA_RPC --chain-id 11155111 &

# Run smoke test against local fork
python scripts/bridge_smoke_test.py   --rpc http://127.0.0.1:8545   --config config/sepolia.json

# Run fuzz tests against local fork
forge test --fuzz-runs 1000 --fork-url http://127.0.0.1:8545 -vvv

The anvil fork inherits all existing contract state from Sepolia, so you interact with the real deployed contracts without spending real (testnet) ETH — vm.deal funds test accounts from nowhere.