feat: migrate CI to arbitrum-testnode composite action

.github/workflows/build-test.yml

@@ -161,26 +161,27 @@ jobs:
     name: Test (Integration) - ${{ matrix.config.name }}
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         config:
           - name: Nitro contracts v3.2 - Custom gas token with 18 decimals
-            nitro-contracts-branch: v3.2.0
-            args: --tokenbridge --l3node --l3-token-bridge --l3-fee-token
+            version: v0.2.7
+            nitro-contracts-version: v3.2
             decimals: 18
 
           - name: Nitro contracts v3.2 - Custom gas token with 6 decimals
-            nitro-contracts-branch: v3.2.0
-            args: --tokenbridge --l3node --l3-token-bridge --l3-fee-token --l3-fee-token-decimals 6
+            version: v0.2.7
+            nitro-contracts-version: v3.2
             decimals: 6
 
           - name: Nitro contracts v2.1 - Custom gas token with 18 decimals
-            nitro-contracts-branch: v2.1.3
-            args: --tokenbridge --l3node --l3-token-bridge --l3-fee-token
+            version: v0.2.7
+            nitro-contracts-version: v2.1
             decimals: 18
 
           - name: Nitro contracts v2.1 - Custom gas token with 6 decimals
-            nitro-contracts-branch: v2.1.3
-            args: --tokenbridge --l3node --l3-token-bridge --l3-fee-token --l3-fee-token-decimals 6
+            version: v0.2.7
+            nitro-contracts-version: v2.1
             decimals: 6
 
     steps:
@@ -205,11 +206,13 @@ jobs:
           cache-key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: Set up the local node
-        uses: OffchainLabs/actions/run-nitro-test-node@feat-simplify
+        uses: OffchainLabs/arbitrum-testnode@v0.2.7
         with:
-          nitro-testnode-ref: release
-          nitro-contracts-branch: ${{ matrix.config.nitro-contracts-branch }}
-          args: ${{ matrix.config.args }}
+          version: ${{ matrix.config.version }}
+          l3-enabled: true
+          fee-token-decimals: ${{ matrix.config.decimals }}
+          nitro-contracts-version: ${{ matrix.config.nitro-contracts-version }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Copy .env
         run: cp ./.env.example ./.env
@@ -219,8 +222,8 @@ jobs:
 
       - name: Test
         run: |
-          INTEGRATION_TEST_DECIMALS=${{matrix.config.decimals}} \
-          INTEGRATION_TEST_NITRO_CONTRACTS_BRANCH=${{matrix.config.nitro-contracts-branch}} \
+          INTEGRATION_TEST_DECIMALS=${{ matrix.config.decimals }} \
+          INTEGRATION_TEST_NITRO_CONTRACTS_BRANCH=${{ matrix.config.nitro-contracts-version }} \
           pnpm test:integration
 
   test-integration-arbitrum-testnode:

audit-ci.jsonc

@@ -70,7 +70,44 @@
     // elliptic has no patched release yet (affected: <=6.6.1)
     // transitive via ethereumjs-util -> ethereum-cryptography -> secp256k1 -> elliptic
     // from: @safe-global/protocol-kit>ethereumjs-util>ethereum-cryptography>secp256k1>elliptic
-    "GHSA-848j-6mx2-7j84"
+    "GHSA-848j-6mx2-7j84",
+
+    // flatted
+    ////////////
+    // https://github.com/advisories/GHSA-25h7-pfq9-p65f
+    // flatted ReDoS - transitive dev dep via eslint>file-entry-cache>flat-cache>flatted
+    // not a runtime dependency
+    "GHSA-25h7-pfq9-p65f",
+    // https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
+    // flatted DoS - transitive dev dep via eslint>file-entry-cache>flat-cache>flatted
+    // not a runtime dependency
+    "GHSA-rf6f-7fwh-wjgh",
+
+    // picomatch
+    ////////////
+    // https://github.com/advisories/GHSA-3v7f-55p6-f55p
+    // picomatch method injection - transitive dev dep via @wagmi/cli>chokidar and typescript-eslint
+    // not a runtime dependency
+    "GHSA-3v7f-55p6-f55p",
+    // https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
+    // picomatch ReDoS - transitive dev dep via @wagmi/cli>chokidar and typescript-eslint
+    // not a runtime dependency
+    "GHSA-c2c7-rcm5-vvqj",
+
+    // brace-expansion
+    ////////////
+    // https://github.com/advisories/GHSA-f886-m6hf-6m8v
+    // brace-expansion infinite loop - transitive dev dep via eslint>minimatch, ts-morph, typescript-eslint
+    // not a runtime dependency
+    "GHSA-f886-m6hf-6m8v",
+
+    // yaml
+    ////////////
+    // https://github.com/advisories/GHSA-48c2-rrv3-qjmp
+    // yaml stack overflow via deeply nested collections
+    // transitive dev dep via patch-package>yaml and @arbitrum/nitro-contracts>patch-package>yaml
+    // not a runtime dependency
+    "GHSA-48c2-rrv3-qjmp"
 
   ]
 }

src/actions/sequencerInbox.integration.test.ts

@@ -3,9 +3,9 @@
   createRollupHelper,
   getInformationFromTestnode,
   getNitroTestnodePrivateKeyAccounts,
+  testHelper_getNitroTestnodeL2,
 } from '../testHelpers';
 import { Hex, createPublicClient, http, zeroAddress } from 'viem';
-import { nitroTestnodeL2 } from '../chains';
 import { getMaxTimeVariation } from './getMaxTimeVariation';
 import { isBatchPoster } from './isBatchPoster';
 import { sequencerInboxABI } from '../contracts/SequencerInbox';
@@ -20,7 +20,7 @@
 const { l3TokenBridgeDeployer, deployer, l3RollupOwner } = getNitroTestnodePrivateKeyAccounts();
 
 const client = createPublicClient({
-  chain: nitroTestnodeL2,
+  chain: testHelper_getNitroTestnodeL2(),
   transport: http(),
 });
 
@@ -35,7 +35,7 @@
     const result = await getMaxTimeVariation(client, {
       sequencerInbox: l3SequencerInbox,
     });
     expect(result).toEqual(defaultMaxTimeVariation);
   });
 
   it('buildSetMaxTimeVariation successfully set max time varation', async () => {

src/contracts/RollupCreator/v2.1.ts

@@ -218,7 +218,7 @@ export const rollupCreatorAddress = {
   42161: '0x79607f00e61E6d7C0E6330bd7E9c4AC320D50FC9',
   42170: '0x9B523BF5F77e8d90e0E9eb0924aEA6E40B081aE6',
   84532: '0x6e244cD02BBB8a6dbd7F626f05B2ef82151Ab502',
-  412346: '0x4287839696d650A0cf93b98351e85199102335D0',
+  412346: '0x1E08B9c3f94E9aBcc531f67F949d796eC76963b9',
   421614: '0xd2Ec8376B1dF436fAb18120E416d3F2BeC61275b',
   11155111: '0xfb774eA8A92ae528A596c8D90CBCF1bdBC4Cee79',
 } as const;

src/contracts/RollupCreator/v3.2.ts

@@ -266,7 +266,7 @@ export const rollupCreatorAddress = {
   42161: '0xF5962AD061A1aD6F38F340F5b267b3593cC1Cd7B',
   42170: '0xF5962AD061A1aD6F38F340F5b267b3593cC1Cd7B',
   84532: '0x8d1668636D053C10F57367D68118bD624f41ffe6',
-  412346: '0xbcF51F3AAb5D5Efa025b4A2B235BDc9F3f69b4d2',
+  412346: '0x1E08B9c3f94E9aBcc531f67F949d796eC76963b9',
   421614: '0xF5962AD061A1aD6F38F340F5b267b3593cC1Cd7B',
   11155111: '0xe06Bc77336E201c4C08751918A4bB99ddf0e1Bf7',
 } as const;

src/createRollup.integration.test.ts

@@ -1,16 +1,16 @@
 import { describe, it, expect } from 'vitest';
 import { createPublicClient, http, parseGwei, zeroAddress } from 'viem';
 
-import { nitroTestnodeL2 } from './chains';
 import {
   createRollupHelper,
   getNitroTestnodePrivateKeyAccounts,
   getInformationFromTestnode,
+  testHelper_getNitroTestnodeL2,
 } from './testHelpers';
 import { createRollupFetchTransactionHash } from './createRollupFetchTransactionHash';
 
 const parentChainPublicClient = createPublicClient({
-  chain: nitroTestnodeL2,
+  chain: testHelper_getNitroTestnodeL2(),
   transport: http(),
 });
 

src/createRollup.ts

@@ -21,7 +21,6 @@ type EnsureCustomGasTokenAllowanceGrantedToRollupCreatorParams<TChain extends Ch
   parentChainPublicClient: PublicClient<Transport, TChain>;
   account: PrivateKeyAccount;
   rollupCreatorVersion?: RollupCreatorSupportedVersion;
-  rollupCreatorAddressOverride?: Address;
 };
 
 /**
@@ -39,14 +38,12 @@ async function ensureCustomGasTokenAllowanceGrantedToRollupCreator<
   parentChainPublicClient,
   account,
   rollupCreatorVersion = 'v3.2',
-  rollupCreatorAddressOverride,
 }: EnsureCustomGasTokenAllowanceGrantedToRollupCreatorParams<TChain>) {
   const allowanceParams = {
     nativeToken,
     account: account.address,
     publicClient: parentChainPublicClient,
     rollupCreatorVersion,
-    rollupCreatorAddressOverride,
   };
 
   if (!(await createRollupEnoughCustomFeeTokenAllowance(allowanceParams))) {
@@ -85,21 +82,18 @@ export type CreateRollupFunctionParams<TChain extends Chain | undefined> =
       account: PrivateKeyAccount;
       parentChainPublicClient: PublicClient<Transport, TChain>;
       rollupCreatorVersion: 'v2.1';
-      rollupCreatorAddressOverride?: Address;
     }
   | {
       params: CreateRollupParams<'v3.2'>;
       account: PrivateKeyAccount;
       parentChainPublicClient: PublicClient<Transport, TChain>;
       rollupCreatorVersion: 'v3.2';
-      rollupCreatorAddressOverride?: Address;
     }
   | {
       params: CreateRollupParams<'v3.2'>;
       account: PrivateKeyAccount;
       parentChainPublicClient: PublicClient<Transport, TChain>;
       rollupCreatorVersion?: never;
-      rollupCreatorAddressOverride?: Address;
     };
 
 /**
@@ -179,7 +173,6 @@ export async function createRollup<TChain extends Chain | undefined>({
   account,
   parentChainPublicClient,
   rollupCreatorVersion = 'v3.2',
-  rollupCreatorAddressOverride,
 }: CreateRollupFunctionParams<TChain>): Promise<CreateRollupResults> {
   validateParentChain(parentChainPublicClient);
 
@@ -193,7 +186,6 @@ export async function createRollup<TChain extends Chain | undefined>({
       parentChainPublicClient,
       account,
       rollupCreatorVersion,
-      rollupCreatorAddressOverride,
     });
   }
 
@@ -205,14 +197,12 @@ export async function createRollup<TChain extends Chain | undefined>({
           account: account.address,
           publicClient: parentChainPublicClient,
           rollupCreatorVersion: 'v2.1',
-          rollupCreatorAddressOverride,
         })
       : await createRollupPrepareTransactionRequest({
           params: params as CreateRollupParams<'v3.2'>,
           account: account.address,
           publicClient: parentChainPublicClient,
           rollupCreatorVersion: 'v3.2',
-          rollupCreatorAddressOverride,
         });
 
   // sign and send the transaction

src/createRollupEnoughCustomFeeTokenAllowance.ts

@@ -41,6 +41,7 @@ export async function createRollupEnoughCustomFeeTokenAllowance<TChain extends C
       account,
       nativeToken,
       maxFeePerGasForRetryables,
+      rollupCreatorAddressOverride,
     },
     rollupCreatorVersion,
   );

src/createRollupPrepareCustomFeeTokenApprovalTransactionRequest.ts

@@ -41,6 +41,7 @@ export async function createRollupPrepareCustomFeeTokenApprovalTransactionReques
       account,
       nativeToken,
       maxFeePerGasForRetryables,
+      rollupCreatorAddressOverride,
     },
     rollupCreatorVersion,
   );

src/createTokenBridge.integration.test.ts

@@ -20,7 +20,6 @@
 const testnodeAccounts = getNitroTestnodePrivateKeyAccounts();
 const l2RollupOwner = testnodeAccounts.l2RollupOwner;
 const l3RollupOwner = testnodeAccounts.l3RollupOwner;
-const l3TokenBridgeDeployer = testnodeAccounts.l3TokenBridgeDeployer;
 
 const nitroTestnodeL1Client = createPublicClient({
   chain: nitroTestnodeL1,
@@ -168,7 +167,7 @@
     expect(orbitChainRetryableReceipts[0].status).toEqual('success');
     expect(orbitChainRetryableReceipts[1].status).toEqual('success');
 
-    // get contracts
+    // get contracts (query the freshly-deployed creator that holds the deployment mapping)
     const tokenBridgeContracts = await txReceipt.getTokenBridgeContracts({
       parentChainPublicClient: nitroTestnodeL1Client,
       tokenBridgeCreatorAddressOverride: tokenBridgeCreator,
@@ -208,7 +207,7 @@
     checkWethGateways(tokenBridgeContracts, { customFeeToken: false });
   });
 
   it(`successfully deploys token bridge contracts with a custom fee token through token bridge creator`, async () => {
     const testnodeInformation = getInformationFromTestnode();
 
     // deploy a fresh token bridge creator, because it is only possible to deploy one token bridge per rollup per token bridge creator
@@ -230,13 +229,13 @@
         ],
       }),
       value: BigInt(0),
-      account: l3TokenBridgeDeployer,
+      account: l3RollupOwner,
     });
 
     // sign and send the transaction
     const fundTxRequest = { ...fundTxRequestRaw, chainId: nitroTestnodeL2Client.chain.id };
     const fundTxHash = await nitroTestnodeL2Client.sendRawTransaction({
-      serializedTransaction: await l3TokenBridgeDeployer.signTransaction(fundTxRequest),
+      serializedTransaction: await l3RollupOwner.signTransaction(fundTxRequest),
     });
 
     // get the transaction receipt after waiting for the transaction to complete
@@ -327,7 +326,7 @@
     expect(orbitChainRetryableReceipts[0].status).toEqual('success');
     expect(orbitChainRetryableReceipts[1].status).toEqual('success');
 
-    // get contracts
+    // get contracts (query the freshly-deployed creator that holds the deployment mapping)
     const tokenBridgeContracts = await txReceipt.getTokenBridgeContracts({
       parentChainPublicClient: nitroTestnodeL2Client,
       tokenBridgeCreatorAddressOverride: tokenBridgeCreator,
@@ -384,7 +383,7 @@
     checkWethGateways(tokenBridgeContracts, { customFeeToken: false });
   });
 
   it('successfully deploys token bridge contracts with a custom fee token', async () => {
     const testnodeInformation = getInformationFromTestnode();
 
     // deploy a fresh token bridge creator, because it is only possible to deploy one token bridge per rollup per token bridge creator
@@ -406,13 +405,13 @@
         ],
       }),
       value: BigInt(0),
-      account: l3TokenBridgeDeployer,
+      account: l3RollupOwner,
     });
 
     // sign and send the transaction
     const fundTxRequest = { ...fundTxRequestRaw, chainId: nitroTestnodeL2Client.chain.id };
     const fundTxHash = await nitroTestnodeL2Client.sendRawTransaction({
-      serializedTransaction: await l3TokenBridgeDeployer.signTransaction(fundTxRequest),
+      serializedTransaction: await l3RollupOwner.signTransaction(fundTxRequest),
     });
 
     // get the transaction receipt after waiting for the transaction to complete

src/createTokenBridgePrepareTransactionReceipt.ts

@@ -61,6 +61,8 @@ export type WaitForRetryablesResult = [TransactionReceipt, TransactionReceipt];
 
 type GetTokenBridgeContractsParameters<TParentChain extends Chain | undefined> = {
   parentChainPublicClient: PublicClient<Transport, TParentChain>;
+  // When the token bridge was deployed through a non-default creator (e.g. a freshly deployed
+  // one), the inbox->deployment mapping lives on that creator, so it must be queried there.
   tokenBridgeCreatorAddressOverride?: Address;
 };
 

src/decorators/sequencerInboxActions.integration.test.ts

@@ -2,11 +2,11 @@
 import { createPublicClient, http, zeroAddress } from 'viem';
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';
 
-import { nitroTestnodeL2 } from '../chains';
 import {
   getNitroTestnodePrivateKeyAccounts,
   getInformationFromTestnode,
   createRollupHelper,
+  testHelper_getNitroTestnodeL2,
 } from '../testHelpers';
 import { sequencerInboxActions } from './sequencerInboxActions';
 import { sequencerInboxABI } from '../contracts/SequencerInbox';
@@ -19,7 +19,7 @@
   getInformationFromTestnode();
 
 const client = createPublicClient({
-  chain: nitroTestnodeL2,
+  chain: testHelper_getNitroTestnodeL2(),
   transport: http(),
 }).extend(sequencerInboxActions({ sequencerInbox: l3SequencerInbox }));
 
@@ -93,7 +93,7 @@
       sequencerInbox: l3SequencerInbox,
     });
 
     expect(result).toEqual([
       process.env.ARBITRUM_TESTNODE_CONTAINER ? 28_800n : 5_760n,
       process.env.ARBITRUM_TESTNODE_CONTAINER ? 300n : 12n,
       process.env.ARBITRUM_TESTNODE_CONTAINER ? 345_600n : 86_400n,

src/getKeysets.integration.test.ts

@@ -9,20 +9,20 @@ import {
   zeroAddress,
 } from 'viem';
 
-import { nitroTestnodeL2 } from './chains';
 import { sequencerInboxActions } from './decorators/sequencerInboxActions';
 import {
   createRollupHelper,
   getInformationFromTestnode,
   getNitroTestnodePrivateKeyAccounts,
+  testHelper_getNitroTestnodeL2,
 } from './testHelpers';
 import { getKeysets } from './getKeysets';
 
 const { l3SequencerInbox } = getInformationFromTestnode();
 const { l3TokenBridgeDeployer, deployer } = getNitroTestnodePrivateKeyAccounts();
 
 const client = createPublicClient({
-  chain: nitroTestnodeL2,
+  chain: testHelper_getNitroTestnodeL2(),
   transport: http(),
 }).extend(
   sequencerInboxActions({