Skip to content

Fix Base mainnet deployment preflight secrets #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moonrager13 merged 2 commits into from
Sep 5, 2026
Merged

Fix Base mainnet deployment preflight secrets #17

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c1dba80
fix(deploy): harden Base mainnet secret preflight
moonrager13 Sep 5, 2026
12a4ff5
fix(deploy): tighten Base mainnet secret scoping
moonrager13 Sep 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions .github/workflows/base-mainnet-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,19 +30,26 @@ jobs:
- name: Install dependencies
run: npm ci

- name: Preflight Base mainnet signer and RPC
- name: Preflight Base mainnet signer, RPC, and verification
env:
BASE_RPC_URL: ${{ secrets.BASE_RPC_URL }}
BASE_RPC_URL: ${{ secrets.BASE_RPC_URL || 'https://mainnet.base.org' }}
PRIVATE_KEY: ${{ secrets.DEPLOYER_PRIVATE_KEY || secrets.PRIVATE_KEY }}
BASESCAN_API_KEY: ${{ secrets.BASESCAN_API_KEY }}
run: |
node <<'NODE'
const { JsonRpcProvider, Wallet, formatEther } = require('ethers');

async function main() {
const rpc = process.env.BASE_RPC_URL;
const key = process.env.PRIVATE_KEY;
if (!rpc) throw new Error('BASE_RPC_URL secret is required');
if (!key) throw new Error('DEPLOYER_PRIVATE_KEY or PRIVATE_KEY secret is required');
const verifyKey = process.env.BASESCAN_API_KEY;

if (!key) {
throw new Error('DEPLOYER_PRIVATE_KEY or PRIVATE_KEY GitHub Actions secret is required');
}
if (!verifyKey) {
throw new Error('BASESCAN_API_KEY GitHub Actions secret is required before broadcast');
}

const provider = new JsonRpcProvider(rpc);
const network = await provider.getNetwork();
Expand All @@ -55,6 +62,7 @@ jobs:
console.log(`Base mainnet chainId verified: ${network.chainId}`);
console.log(`Deployer address: ${wallet.address}`);
console.log(`Deployer balance: ${formatEther(balance)} ETH`);
console.log('BaseScan verification credential: configured');
if (balance === 0n) throw new Error('Deployer has no ETH for gas');
}

Expand All @@ -72,7 +80,7 @@ jobs:

- name: Deploy AgentExecutor to Base mainnet
env:
BASE_RPC_URL: ${{ secrets.BASE_RPC_URL }}
BASE_RPC_URL: ${{ secrets.BASE_RPC_URL || 'https://mainnet.base.org' }}
PRIVATE_KEY: ${{ secrets.DEPLOYER_PRIVATE_KEY || secrets.PRIVATE_KEY }}
DESTINATION_ADDRESS: ${{ secrets.DESTINATION_ADDRESS }}
run: npm run deploy:base
Expand All @@ -87,7 +95,7 @@ jobs:

- name: Verify on BaseScan
env:
BASE_RPC_URL: ${{ secrets.BASE_RPC_URL }}
BASE_RPC_URL: ${{ secrets.BASE_RPC_URL || 'https://mainnet.base.org' }}
ETHERSCAN_API_KEY: ${{ secrets.BASESCAN_API_KEY }}
run: npx hardhat verify --network base "$CONTRACT_ADDRESS"

Expand Down
Loading