INF-503 adds contract-bedrock docker image & deploy script

.circleci/config.yml

@@ -1832,6 +1832,16 @@ workflows:
           context:
             - oplabs-gcr
             - slack
+      - docker-build:
+          name: contracts-bedrock-docker-publish
+          docker_name: contracts-bedrock
+          docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
+          resource_class: xlarge
+          requires: [ 'chain-mon-docker-publish' ] # use the cached base image
+          publish: true
+          context:
+            - oplabs-gcr
+            - slack
       - docker-build:
           name: ufm-metamask-docker-publish
           docker_name: ufm-metamask

Makefile

@@ -39,6 +39,15 @@ golang-docker:
 			op-node op-batcher op-proposer op-challenger
 .PHONY: golang-docker
 
+contracts-bedrock-docker:
+	IMAGE_TAGS=$$(git rev-parse HEAD),latest \
+	docker buildx bake \
+			--progress plain \
+			--load \
+			-f docker-bake.hcl \
+		  contracts-bedrock
+.PHONY: contracts-bedrock-docker
+
 submodules:
 	git submodule update --init --recursive
 .PHONY: submodules

docker-bake.hcl

@@ -180,4 +180,10 @@ target "ci-builder" {
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/ci-builder:${tag}"]
 }
 
-
+target "contracts-bedrock" {
+  dockerfile = "./ops/docker/Dockerfile.packages"
+  context = "."
+  target = "contracts-bedrock"
+  platforms = split(",", PLATFORMS)
+  tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/contracts-bedrock:${tag}"]
+}

ops/docker/Dockerfile.packages

@@ -57,6 +57,10 @@ RUN apt-get update && apt-get install -y \
   libudev-dev \
   --no-install-recommends
 
+COPY /ops/docker/oplabs.crt /usr/local/share/ca-certificates/oplabs.crt
+RUN chmod 644 /usr/local/share/ca-certificates/oplabs.crt \
+  && update-ca-certificates
+
 RUN npm install pnpm --global
 
 COPY --from=foundry /usr/local/bin/forge /usr/local/bin/forge
@@ -114,4 +118,6 @@ FROM base as wd-mon
 WORKDIR /opt/optimism/packages/chain-mon
 CMD ["start:wd-mon"]
 
-
+FROM base as contracts-bedrock
+WORKDIR /opt/optimism/packages/contracts-bedrock
+CMD ["deploy"]

ops/docker/oplabs.crt

+-----BEGIN CERTIFICATE-----
+MIICEDCCAZagAwIBAgIUALLKhe49OFLAGb5Zt+DZlvpKScswCgYIKoZIzj0EAwMw
+KTEQMA4GA1UEChMHT1AgTGFiczEVMBMGA1UEAxMMb3BsYWJzLmNsb3VkMB4XDTIy
+MTIxOTE3MDQwNFoXDTMyMTIxNjE3MDQwM1owKTEQMA4GA1UEChMHT1AgTGFiczEV
+MBMGA1UEAxMMb3BsYWJzLmNsb3VkMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEyCco
+PpvE5IRv5S0zqmpE2VsbhVzB+hiQjbQO3J6j5L+pAvWjXGvjZblGvNi5PIVBCxvm
+5UofdFrOCAiOdRfevhadv3zLzGUmoJ52iXCTPL01dlkQt5KUsoT+AU7GPW4Ko38w
+fTAOBgNVHQ8BAf8EBAMCAaYwEgYDVR0TAQH/BAgwBgEB/wIBCjAdBgNVHQ4EFgQU
+2AVLbBUBZcBOPkg8QCAOvSMrdj0wHwYDVR0jBBgwFoAU2AVLbBUBZcBOPkg8QCAO
+vSMrdj0wFwYDVR0RBBAwDoIMb3BsYWJzLmNsb3VkMAoGCCqGSM49BAMDA2gAMGUC
+MBuERHbRkWDwXm97jqKEGANU4VDBqgmRicdF7FspDqA5Zcpj+r+rQVaDlH0qvtxH
+SQIxAL3fjNoC1Kon4kKmPQdp5KNhvGzOaoQiqbb5JuL3+j6f3x0ucLVD1yWP/V/+
+zZ/vlQ==
+-----END CERTIFICATE-----

packages/contracts-bedrock/package.json

@@ -20,6 +20,7 @@
     "test": "pnpm build:go-ffi && forge test",
     "coverage": "pnpm build:go-ffi && forge coverage",
     "coverage:lcov": "pnpm build:go-ffi && forge coverage --report lcov",
+    "deploy": "./scripts/deploy.sh",
     "gas-snapshot:no-build": "forge snapshot --no-match-test 'testDiff|testFuzz|invariant|generateArtifact'",
     "gas-snapshot": "pnpm build:go-ffi && pnpm gas-snapshot:no-build",
     "storage-snapshot": "./scripts/storage-snapshot.sh",
@@ -49,4 +50,4 @@
     "tsx": "^4.1.1",
     "typescript": "^5.2.2"
   }
-}
+}
\ No newline at end of file

packages/contracts-bedrock/scripts/deploy.sh

+#!/usr/bin/env bash
+set -euo pipefail
+
+verify_flag=""
+if [ -n "${DEPLOY_VERIFY:-}" ]; then
+  verify_flag="--verify"
+fi
+
+echo "> Deploying contracts"
+forge script -vvv scripts/Deploy.s.sol:Deploy --rpc-url "$DEPLOY_ETH_RPC_URL" --broadcast --private-key "$DEPLOY_PRIVATE_KEY" $verify_flag
+
+if [ -n "${DEPLOY_GENERATE_HARDHAT_ARTIFACTS:-}" ]; then
+  echo "> Generating hardhat artifacts"
+  forge script -vvv scripts/Deploy.s.sol:Deploy --sig 'sync()' --rpc-url "$DEPLOY_ETH_RPC_URL" --broadcast --private-key "$DEPLOY_PRIVATE_KEY"
+fi