deploy-contract.yml

name: Deploy Move Contract

# ── About the hardcoded address below ──────────────────────────────────────
#
# 0xe759eaf1a47566836f825b96a8d12e55b858df1be7d86b032f449638a93489c9 is the
# project's Sui deployer address (matches "Deployer address" in HANDOFF.md's
# "Identity & Addresses" section) — the address the imported
# secrets.SUI_PRIVATE_KEY corresponds to, switched to explicitly after
# import so the publish step definitely runs as this address and not
# whatever the runner's keystore defaulted to.
#
# This workflow can publish to mainnet: `network` defaults to testnet but
# is a workflow_dispatch choice that includes mainnet, and there is no
# separate approval gate or environment protection rule on this job — only
# GitHub's own workflow_dispatch permission (repo write access) stands
# between "I clicked Run workflow" and a real mainnet publish signed by
# this key.
#
on:
  workflow_dispatch:
    inputs:
      network:
        description: 'Network to deploy to'
        required: true
        default: 'testnet'
        type: choice
        options:
          - testnet
          - mainnet

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Sui CLI
        run: |
          LATEST=$(curl -s https://api.github.com/repos/MystenLabs/sui/releases | python3 -c "
          import json,sys
          releases = json.load(sys.stdin)
          for r in releases:
              if 'testnet' in r['tag_name']:
                  print(r['tag_name'])
                  break
          ")
          echo "Installing Sui $LATEST"
          curl -LO "https://github.com/MystenLabs/sui/releases/download/${LATEST}/sui-${LATEST}-ubuntu-x86_64.tgz"
          tar -xzf sui-${LATEST}-ubuntu-x86_64.tgz
          sudo mv sui /usr/local/bin/sui
          sui --version

      - name: Setup wallet
        run: |
          sui client new-env --alias ${{ github.event.inputs.network }} --rpc https://fullnode.${{ github.event.inputs.network }}.sui.io:443 || true
          sui client switch --env ${{ github.event.inputs.network }}
          sui keytool import "${{ secrets.SUI_PRIVATE_KEY }}" ed25519
          sui client switch --address 0xe759eaf1a47566836f825b96a8d12e55b858df1be7d86b032f449638a93489c9
          sui client active-address
          sui client gas

      - name: Build
        working-directory: contracts/navis
        run: sui move build

      - name: Deploy
        id: deploy
        working-directory: contracts/navis
        run: |
          sui client publish \
            --gas-budget 100000000 \
            --json > deploy-output.json 2>&1 || true
          echo "=== Deploy Output ==="
          cat deploy-output.json
          echo "=== End Output ==="
          PACKAGE_ID=$(python3 -c "
          import json
          with open('deploy-output.json') as f:
              data = json.load(f)
          for obj in data.get('objectChanges', []):
              if obj.get('type') == 'published':
                  print(obj['packageId'])
                  break
          " 2>/dev/null || echo "")
          if [ -z "$PACKAGE_ID" ]; then
            echo "Deploy failed - check output above"
            exit 1
          fi
          echo "PACKAGE_ID=$PACKAGE_ID" >> $GITHUB_OUTPUT
          echo "✓ Deployed Package ID: $PACKAGE_ID"