leanSpec/.github/workflows/generate-keys.yml at main · tcoratger/leanSpec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: Generate Keys

on:
  workflow_dispatch:
  workflow_call:
    secrets:
      LEANSIG_TEST_KEYS_REPO_TOKEN:
        required: true

# This workflow does not need any write permission to leanSpec repo
permissions:
  contents: read

# Cancels any ongoing key generation when a new key generation is triggered (likely with newer changes)
concurrency:
  group: generate-keys
  cancel-in-progress: true

jobs:
  generate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout leanSpec
        uses: actions/checkout@v4

      - name: Set up Python 3.14
        uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true
          cache-dependency-glob: "pyproject.toml"

      - name: Sync dependencies
        run: uv sync --no-progress

      - name: Generate test scheme keys
        run: uv run keys --scheme test

      - name: Generate prod scheme keys
        run: LEAN_ENV=prod uv run keys --scheme prod

      - name: Publish to leansig-test-keys
        run: |
          cd packages/testing/src/consensus_testing/test_keys
          tar czf /tmp/test_scheme.tar.gz test_scheme
          tar czf /tmp/prod_scheme.tar.gz prod_scheme
          gh release delete latest --repo leanEthereum/leansig-test-keys --yes || true
          gh release create latest /tmp/test_scheme.tar.gz /tmp/prod_scheme.tar.gz \
            --repo leanEthereum/leansig-test-keys \
            --title "Latest keys from leanSpec" \
            --notes "Auto-generated from leanSpec@${{ github.sha }}"
        env:
          GH_TOKEN: ${{ secrets.LEANSIG_TEST_KEYS_REPO_TOKEN }}

      - name: Save test key cache
        uses: actions/cache/save@v4
        with:
          path: packages/testing/src/consensus_testing/test_keys/test_scheme
          key: test-keys-${{ hashFiles('src/lean_spec/subspecs/xmss/**', 'src/lean_spec/subspecs/poseidon2/**') }}

      - name: Save prod key cache
        uses: actions/cache/save@v4
        with:
          path: packages/testing/src/consensus_testing/test_keys/prod_scheme
          key: prod-keys-${{ hashFiles('src/lean_spec/subspecs/xmss/**', 'src/lean_spec/subspecs/poseidon2/**') }}