Checkmate-Escrow/.github/workflows/backup.yml at main · StellarCheckMate/Checkmate-Escrow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: Scheduled Contract Backup

on:
  # Run daily at 02:00 UTC
  schedule:
    - cron: "0 2 * * *"
  # Allow manual trigger for on-demand backups or testing
  workflow_dispatch:
    inputs:
      network:
        description: "Network to back up (testnet or mainnet)"
        required: true
        default: testnet
        type: choice
        options:
          - testnet
          - mainnet

env:
  CARGO_TERM_COLOR: always
  STELLAR_CLI_VERSION: "21.5.0"

jobs:
  backup-testnet:
    name: Backup Testnet State
    runs-on: ubuntu-24.04
    # Only run on schedule or when explicitly targeting testnet
    if: >
      github.event_name == 'schedule' ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.network == 'testnet')
    steps:
      - uses: actions/checkout@v5

      - name: Cache Stellar CLI binary
        id: cache-stellar-cli
        uses: actions/cache@v5
        with:
          path: /usr/local/bin/stellar
          key: stellar-cli-${{ env.STELLAR_CLI_VERSION }}-x86_64-unknown-linux-gnu

      - name: Install Stellar CLI
        if: steps.cache-stellar-cli.outputs.cache-hit != 'true'
        run: |
          curl -sSL --fail \
            "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_CLI_VERSION}/stellar-cli-${STELLAR_CLI_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
            | tar -xz -C /usr/local/bin stellar
          chmod +x /usr/local/bin/stellar

      - name: Verify Stellar CLI
        run: stellar --version

      - name: Install jq
        run: sudo apt-get install -y --no-install-recommends jq

      - name: Run backup (testnet)
        env:
          STELLAR_NETWORK: testnet
          CONTRACT_ESCROW: ${{ secrets.TESTNET_CONTRACT_ESCROW }}
          DEPLOYER_KEYPAIR: ${{ secrets.TESTNET_DEPLOYER_KEYPAIR }}
          BACKUP_DIR: backups
          BACKUP_RETENTION_DAYS: "30"
          # Set S3_BUCKET to enable automatic S3 upload
          S3_BUCKET: ${{ secrets.BACKUP_S3_BUCKET }}
        run: |
          # Skip gracefully if the contract address is not configured yet
          if [[ -z "$CONTRACT_ESCROW" ]]; then
            echo "⚠️  TESTNET_CONTRACT_ESCROW secret not set — skipping backup."
            exit 0
          fi
          bash scripts/backup_state.sh testnet backups

      - name: Configure AWS credentials (for S3 upload)
        if: ${{ env.S3_BUCKET != '' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION || 'us-east-1' }}
        env:
          S3_BUCKET: ${{ secrets.BACKUP_S3_BUCKET }}

      - name: Upload snapshot artifact (30-day retention)
        uses: actions/upload-artifact@v5
        with:
          name: testnet-snapshot-${{ github.run_id }}
          path: backups/escrow-snapshot-testnet-*.json
          retention-days: 30
          if-no-files-found: warn

  backup-mainnet:
    name: Backup Mainnet State
    runs-on: ubuntu-24.04
    # Mainnet backups only run when explicitly requested via workflow_dispatch
    if: >
      github.event_name == 'workflow_dispatch' &&
      github.event.inputs.network == 'mainnet'
    steps:
      - uses: actions/checkout@v5

      - name: Cache Stellar CLI binary
        id: cache-stellar-cli
        uses: actions/cache@v5
        with:
          path: /usr/local/bin/stellar
          key: stellar-cli-${{ env.STELLAR_CLI_VERSION }}-x86_64-unknown-linux-gnu

      - name: Install Stellar CLI
        if: steps.cache-stellar-cli.outputs.cache-hit != 'true'
        run: |
          curl -sSL --fail \
            "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_CLI_VERSION}/stellar-cli-${STELLAR_CLI_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
            | tar -xz -C /usr/local/bin stellar
          chmod +x /usr/local/bin/stellar

      - name: Verify Stellar CLI
        run: stellar --version

      - name: Install jq
        run: sudo apt-get install -y --no-install-recommends jq

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION || 'us-east-1' }}

      - name: Run backup (mainnet)
        env:
          STELLAR_NETWORK: mainnet
          CONTRACT_ESCROW: ${{ secrets.MAINNET_CONTRACT_ESCROW }}
          DEPLOYER_KEYPAIR: ${{ secrets.MAINNET_DEPLOYER_KEYPAIR }}
          BACKUP_DIR: backups
          BACKUP_RETENTION_DAYS: "90"
          S3_BUCKET: ${{ secrets.BACKUP_S3_BUCKET }}
        run: |
          if [[ -z "$CONTRACT_ESCROW" ]]; then
            echo "⚠️  MAINNET_CONTRACT_ESCROW secret not set — skipping backup."
            exit 0
          fi
          bash scripts/backup_state.sh mainnet backups

      - name: Upload snapshot artifact (90-day retention)
        uses: actions/upload-artifact@v5
        with:
          name: mainnet-snapshot-${{ github.run_id }}
          path: backups/escrow-snapshot-mainnet-*.json
          retention-days: 90
          if-no-files-found: warn