ComposableFi · dzmitry-lahoda · Jun 8, 2023 · Jun 5, 2023 · Jun 7, 2023 · Jun 7, 2023
diff --git a/.github/workflows/pr-workflow.yml b/.github/workflows/pr-workflow.yml
@@ -107,46 +107,27 @@ jobs:
       ok: ${{ steps.ok.outputs.ok }}   
     needs:
       - privilege-check      
-    runs-on: ubuntu-latest
+    runs-on:
+      - x86_64-linux-32C-128GB-2TB
     continue-on-error: false
     concurrency:
       group: ${{ inputs.github_workflow }}-nix-flake-check-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: true
-    steps:
-      # This isn't templated, since checkout needs to happen before templating occurs.
-      - name: Set up Nix
-        uses: cachix/install-nix-action@daddc62a2e67d1decb56e028c9fa68344b9b7c2a
-        with:
-          install_url: https://releases.nixos.org/nix/nix-2.13.2/install
-          nix_path: nixpkgs=channel:nixos-22.11
-          extra_nix_config: |
-            sandbox = relaxed
-            narinfo-cache-negative-ttl = 0      
-            system-features = kvm
-
+    steps:            
       - name: Set up Cachix
         uses: cachix/cachix-action@586bf280495080c5a6d4868237ad28a860e4b309
         with:
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
           name: composable-community
-      - name: Add tools needed for non-nix steps
-        run: |  
-          nix-channel --add https://nixos.org/channels/nixos-22.11 nixpkgs
-          nix-channel --update
-          nix-env -iA nixpkgs.cachix nixpkgs.nodejs nixpkgs.git nixpkgs.git-lfs nixpkgs.tree nixpkgs.docker
       - uses: actions/checkout@v3
         with:
           lfs: true
           ref: ${{ inputs.github_event_pull_request_head_sha || github.sha }}
           persist-credentials: false
       - run: |
-          nix run .#nix-flake-check
-      - name: Nix flake show
-        run: |
           nix --version
           nix show-config
-          NIX_DEBUG_COMMAND="" && [[ $ACTIONS_RUNNER_DEBUG = 'true' ]] && NIX_DEBUG_COMMAND='--print-build-logs --debug --show-trace --verbose'
-          nix flake show --allow-import-from-derivation --fallback --keep-failed ${NIX_DEBUG_COMMAND}          
+          nix run .#nix-flake-check        
       - id: ok
         run: echo "ok=true" >> "$GITHUB_OUTPUT"
 

diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -1,9 +1,8 @@
 {
   description = "Composable Finance";
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-latest.url =
-      "github:NixOS/nixpkgs/0135b7a556ee60144b143b071724fa44348a188e";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
+    nixpkgs-latest.url = "github:NixOS/nixpkgs/nixos-23.05";
     flake-parts.url = "github:hercules-ci/flake-parts";
     flake-utils.url = "github:numtide/flake-utils";
     npm-buildpackage.url = "github:serokell/nix-npm-buildpackage";
@@ -94,6 +93,8 @@
         ./inputs/cosmos/gex.nix
         ./inputs/CosmosContracts/juno.nix
         ./inputs/CosmWasm/wasmvm.nix
+        ./inputs/notional-labs/composable-centauri/flake-module.nix
+        ./inputs/osmosis-labs/beaker/flake-module.nix
         ./inputs/paritytech/cumulus.nix
         ./inputs/paritytech/polkadot.nix
         ./inputs/paritytech/substrate.nix

diff --git a/flake/check.nix b/flake/check.nix
@@ -1,26 +1,32 @@
 { self, ... }: {
   perSystem = { config, self', inputs', pkgs, system, ... }: {
     apps = {
-      nix-flake-check = {
+      nix-flake-check = let basicShellIsolation = [ pkgs.nix ];
+      in {
         type = "app";
         program = pkgs.writeShellApplication {
           name = "nix-flake-check";
-          runtimeInputs = [ ];
+          runtimeInputs = basicShellIsolation;
           text = ''
             NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1
             export NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM 
-            NIX_DEBUG_ARGS=""        
+            NIX_DEBUG_ARGS=""
             if [[ ''${ACTIONS_RUNNER_DEBUG-"false"} = "true" ]]; then
               NIX_DEBUG_ARGS=' --print-build-logs --debug --show-trace --verbose'
             fi
+            # some nix bug, works fine locally
+            # shellcheck disable=SC2086
+            # nix flake show --allow-import-from-derivation --fallback --keep-failed --no-write-lock-file --accept-flake-config --no-update-lock-file --system "${system}" $NIX_DEBUG_ARGS
+
             set -o pipefail -o errexit
             # shellcheck disable=SC2086
-            NIXPKGS_ALLOW_BROKEN=1 nix flake check --keep-going --no-build --allow-import-from-derivation --no-update-lock-file --accept-flake-config --fallback $NIX_DEBUG_ARGS --impure --option sandbox relaxed 2>&1 | tee "nix.check.log"  || true
+            NIXPKGS_ALLOW_BROKEN=1 nix flake check --keep-going --no-build --allow-import-from-derivation --accept-flake-config --no-update-lock-file --accept-flake-config --system "${system}" --fallback $NIX_DEBUG_ARGS --impure --option sandbox relaxed 2>&1 | tee "nix.check.log"  || true
             set +o pipefail +o errexit
             echo "exited with(https://github.com/NixOS/nix/issues/7464) $?" 
-            grep --invert-match  "error: path [']/nix/store/[a-zA-Z0-9]\+-[a-zA-Z0-9\.-]\+['] is not valid" < "nix.check.log" \
-            | grep --invert-match  "error: cannot substitute path [']/nix/store/[a-zA-Z0-9]\+-[a-zA-Z0-9\.-]\+['] \- no write access to the Nix store" \
-            | grep --invert-match '^error: some errors were encountered during the evaluation' > "filtered.nix.check.log"
+            grep --invert-match  "error: path [']/nix/store/[a-zA-Z0-9]\+-[a-zA-Z0-9\.-]\+['] is not valid" < "nix.check.log" |
+            grep --invert-match  "error: cannot substitute path [']/nix/store/[a-zA-Z0-9]\+-[a-zA-Z0-9\.-]\+['] \- no write access to the Nix store" |
+            grep --invert-match '^error: some errors were encountered during the evaluation' |
+            grep --invert-match "error: a [']aarch64-darwin['] with features" > "filtered.nix.check.log"
             RESULT=$(grep -c 'error:' < "filtered.nix.check.log")
             echo "Got errors $RESULT"
             if [[ $RESULT != 0 ]]; then exit "$RESULT"; fi

diff --git a/flake/dev-shells.nix b/flake/dev-shells.nix
@@ -41,13 +41,9 @@
       };
       cosmosattrs = defaultattrs // {
         modules = [{
-          packages = tools ++ (with self'.packages; [ junod gex ]);
+          packages = tools ++ (with self'.packages; [ gex ]);
           devcontainer.enable = true;
           inherit env;
-          enterShell = ''
-            echo "junod alice key:"
-            echo "clip hire initial neck maid actor venue client foam budget lock catalog sweet steak waste crater broccoli pipe steak sister coyote moment obvious choose" | junod keys add alice --recover --keyring-backend test || true
-          '';
         }];
       };
       allattrs = defaultattrs // {

diff --git a/inputs/CosmWasm/wasmvm.nix b/inputs/CosmWasm/wasmvm.nix
@@ -1,17 +1,22 @@
 { self, ... }: {
-  perSystem = { config, self', inputs', pkgs, system, lib, ... }: {
+  perSystem = { config, self', inputs', pkgs, system, lib, crane, ... }: {
     packages = {
-      libwasmvm = pkgs.rustPlatform.buildRustPackage {
-        name = "libwasmvm";
-        src = pkgs.fetchFromGitHub {
-          owner = "CosmWasm";
-          repo = "wasmvm";
-          rev = "1afba37bfd0eda626d11ec760f51b16cb4254167";
-          sha256 = "sha256-/wS+kZFu4RTO7Ump21dM9DpQBxTQ87BlCblE0JYMdiY=";
-        };
-        cargoHash = "sha256-WMfYsGtzOCxbhyoRRLtHg9H8ckPCByjsBSZCXimj/80=";
-        sourceRoot = "source/libwasmvm";
+      libwasmvm = crane.nightly.buildPackage {
+        src = "${
+            pkgs.fetchFromGitHub {
+              owner = "CosmWasm";
+              repo = "wasmvm";
+              rev = "a9e26c0e4e5a076d82556c4f44abeee2a64ff37e";
+              hash = "sha256-zR47q8Z2znPigecPDmw5L4ef20/TXv8cPxaXTdJGxg0=";
+            }
+          }/libwasmvm";
         doCheck = false;
+        installPhase = ''
+          mkdir -p $out/lib
+          mv target/release/libwasmvm.so $out/lib/libwasmvm.${
+            builtins.head (pkgs.lib.strings.splitString "-" system)
+          }.so
+        '';
       };
     };
   };

diff --git a/inputs/cosmos/cosmwasm.nix b/inputs/cosmos/cosmwasm.nix
@@ -22,12 +22,7 @@
           subwasm
           pkgs.binaryen
           cosmwasm-check
-          junod
         ];
-        shellHook = ''
-          echo "junod alice key:"
-          echo "clip hire initial neck maid actor venue client foam budget lock catalog sweet steak waste crater broccoli pipe steak sister coyote moment obvious choose" | junod keys add alice --recover --keyring-backend test || true
-        '';
       };
     };
   };

diff --git a/inputs/notional-labs/composable-centauri/flake-module.nix b/inputs/notional-labs/composable-centauri/flake-module.nix
@@ -0,0 +1,96 @@
+{ self, ... }: {
+  perSystem = { config, self', inputs', pkgs, lib, system, crane
+    , systemCommonRust, subnix, ... }:
+    let
+      name = "banksyd";
+      banksyd = pkgs.buildGoModule {
+        name = name;
+        doCheck = false;
+        nativeBuildInputs = [ pkgs.patchelf ];
+        excludedPackages = [ "interchaintest" "simd" ];
+        ldflags = [ "-v -extldflags '-L${self'.packages.libwasmvm}/lib'" ];
+        src = pkgs.fetchFromGitHub {
+          owner = "notional-labs";
+          repo = "composable-centauri";
+          rev = "bypass";
+          sha256 = "sha256-XLTBYWDvFwirss3JbbVCwYfG3qIGya35HulvFS7SYaM=";
+        };
+        dontFixup = true;
+        vendorSha256 = "sha256-4K0MLZ8FUaAy4vkPONO694jolOzGHYACZRJAfU8Qn4s=";
+      };
+      CW20_BASE_WASM = pkgs.fetchurl {
+        url =
+          "https://github.com/CosmWasm/cw-plus/releases/download/v1.0.1/cw20_base.wasm";
+        hash = "sha256-nClak9UDPLdALVnN7e9yVKafnKUO7RAYDFO7sxwAXpI=";
+      };
+      WYNDEX_PAIR_WASM = pkgs.fetchurl {
+        url =
+          "https://github.com/wynddao/wynddex/releases/download/v2.1.0/wyndex_pair.wasm";
+        hash = "sha256-GQh3SBVccriWhHNPe22VMGWJVqfJa7x3cWy67j6NFTg=";
+      };
+
+      WYNDEX_FACTORY_WASM = pkgs.fetchurl {
+        url =
+          "https://github.com/wynddao/wynddex/releases/download/v2.1.0/wyndex_factory.wasm";
+        hash = "sha256-2ZYILTelKNsuqfOisXhrg4TPLwocaVNp6UN+6LN51SQ=";
+      };
+      banksyd-init = pkgs.writeShellApplication {
+        name = "banksyd-init";
+        runtimeInputs = [ banksyd pkgs.jq pkgs.yq ];
+
+        text = ''
+          BANKSY="/tmp/banksy-dev"
+          CHAIN_ID="centauri-dev"
+          KEYRING_TEST="$BANKSY/keyring-test"
+          banksyd query bank balances banksy1cyyzpxplxdzkeea7kwsydadg87357qna4p6c6f
+          banksyd tx 08-wasm push-wasm ${CW20_BASE_WASM} --from alice --keyring-backend test --gas 902152622 --fees 920166ppica --keyring-dir "$KEYRING_TEST" --chain-id "$CHAIN_ID" --yes
+          sleep 5
+          banksyd tx 08-wasm push-wasm ${WYNDEX_PAIR_WASM} --from alice --keyring-backend test --gas 902152622 --fees 920166ppica --keyring-dir "$KEYRING_TEST" --chain-id "$CHAIN_ID" --yes
+          sleep 5
+          banksyd tx 08-wasm push-wasm ${WYNDEX_FACTORY_WASM} --from alice --keyring-backend test --gas 902152622 --fees 920166ppica --keyring-dir "$KEYRING_TEST" --chain-id "$CHAIN_ID" --yes
+          sleep 5
+          banksyd  query 08-wasm all-wasm-code --chain-id "$CHAIN_ID" --home "$BANKSY" --output json --node tcp://localhost:26657
+        '';
+      };
+
+      banksyd-gen = pkgs.writeShellApplication {
+        name = "banksyd-gen";
+        runtimeInputs = [ banksyd pkgs.jq pkgs.yq ];
+        text = ''
+          BANKSY="/tmp/banksy-dev"
+          CHAIN_ID="centauri-dev"
+          KEYRING_TEST="$BANKSY/keyring-test"
+          rm --force --recursive "$BANKSY"
+          mkdir --parents "$BANKSY"
+          mkdir --parents "$BANKSY/config/gentx"
+          mkdir --parents "$KEYRING_TEST"
+          banksyd init "$CHAIN_ID" --chain-id "$CHAIN_ID" --default-denom ppica --home "$BANKSY"           
+          jq -r  '.consensus_params.block.max_gas |= "-1" '  > "$BANKSY/config/genesis-update.json"  < "$BANKSY/config/genesis.json"
+          sed -i 's/keyring-backend = "os"/keyring-backend = "test"/' "$BANKSY/config/client.toml"
+          mv --force "$BANKSY/config/genesis-update.json" "$BANKSY/config/genesis.json"
+          sed -i 's/keyring-backend = "os"/keyring-backend = "test"/' "$BANKSY/config/client.toml"
+          sed -i 's/output = "text"/output = "json"/' "$BANKSY/config/client.toml"
+          sed -i "s/cors_allowed_origins = \[\]/cors_allowed_origins = \[\"\*\"\]/" "$BANKSY/config/config.toml"
+          sed -i   "s/enable = false/enable = true/" "$BANKSY/config/app.toml"
+          sed -i   "s/swagger = false/swagger = true/" "$BANKSY/config/app.toml"           
+          echo "document prefer nurse marriage flavor cheese west when knee drink sorry minimum thunder tilt cherry behave cute stove elder couch badge gown coral expire" | banksyd keys add alice --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true    
+          echo "bleak slush nose opinion document sample embark couple cabbage soccer cage slow father witness canyon ring distance hub denial topic great beyond actress problem" | banksyd keys add bob --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true
+          echo "coffee hospital claim ability wrap load display submit lecture solid secret law base barrel miss tattoo desert want wall bar ketchup sauce real unknown" | banksyd keys add charlie --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true
+          echo "bottom loan skill merry east cradle onion journey palm apology verb edit desert impose absurd oil bubble sweet glove shallow size build burst effort" | banksyd keys add validator --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true
+          echo "notice oak worry limit wrap speak medal online prefer cluster roof addict wrist behave treat actual wasp year salad speed social layer crew genius" | banksyd keys add test1 --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true
+          echo "quality vacuum heart guard buzz spike sight swarm shove special gym robust assume sudden deposit grid alcohol choice devote leader tilt noodle tide penalty" | banksyd keys add test2 --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true
+          echo "symbol force gallery make bulk round subway violin worry mixture penalty kingdom boring survey tool fringe patrol sausage hard admit remember broken alien absorb" | banksyd keys add test3 --recover --keyring-backend test --keyring-dir "$KEYRING_TEST" || true
+          banksyd --keyring-backend test add-genesis-account banksy1cyyzpxplxdzkeea7kwsydadg87357qna4p6c6f "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test add-genesis-account banksy18s5lynnmx37hq4wlrw9gdn68sg2uxp5r22xlq4 "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test add-genesis-account banksy1qwexv7c6sm95lwhzn9027vyu2ccneaqa0fzz6y "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test add-genesis-account banksy1xtf3wlewqpnzgu20460fjjuc7vrkmysm5xr9e3 "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test add-genesis-account banksy1zr4ng42laatyh9zx238n20r74spcrlct5lzfrk "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test add-genesis-account banksy1makf5hslxqxzl29uyeyyddf89ff7edxydnt89v "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test add-genesis-account banksy12smx2wdlyttvyzvzg54y2vnqwq2qjate74jwmt "1000000000000000ppica" --keyring-backend test --home "$BANKSY"
+          banksyd --keyring-backend test --keyring-dir "$KEYRING_TEST" --home "$BANKSY" gentx validator "250000000000000ppica" --chain-id="$CHAIN_ID" --amount="250000000000000ppica"
+          banksyd collect-gentxs --home "$BANKSY"  --gentx-dir "$BANKSY/config/gentx"
+          banksyd start --rpc.laddr tcp://0.0.0.0:26657 --pruning=nothing  --minimum-gas-prices=0.0001ppica --trace --log_level debug --home "$BANKSY" --db_dir "$BANKSY/data" --log_format json --trace           
+        '';
+      };
+    in { packages = rec { inherit banksyd banksyd-gen banksyd-init; }; };
+}
diff --git a/inputs/osmosis-labs/beaker/flake-module.nix b/inputs/osmosis-labs/beaker/flake-module.nix
@@ -0,0 +1,35 @@
+{ self, ... }: {
+  perSystem = { config, self', inputs', pkgs, system, crane, systemCommonRust
+    , subnix, ... }: {
+      packages = rec {
+        beaker = let
+          name = "beaker";
+          src = pkgs.fetchFromGitHub {
+            owner = "dzmitry-lahoda-forks";
+            repo = name;
+            rev = "d6700f03da8e93de3e5e327c2e87d93fde3967b8";
+            hash = "sha256-42j/ZP8Gyn1gyPTLNMpWJH5pLqz2Ufd8hSb6g8SnkCU=";
+          };
+          env = {
+            doCheck = false;
+            buildInputs = with pkgs; [ openssl zstd protobuf ];
+            nativeBuildInputs = with pkgs;
+              [ clang pkg-config perl ] ++ systemCommonRust.darwin-deps;
+            RUST_BACKTRACE = "full";
+          } // subnix.subattrs;
+
+        in crane.stable.buildPackage (env // {
+          name = name;
+          pname = "beaker";
+          cargoArtifacts = crane.stable.buildDepsOnly (env // {
+            inherit src;
+            doCheck = false;
+            cargoTestCommand = "";
+          });
+          inherit src;
+          cargoTestCommand = "";
+          meta = { mainProgram = name; };
+        });
+      };
+    };
+}
diff --git a/inputs/paritytech/substrate.nix b/inputs/paritytech/substrate.nix
@@ -1,5 +1,6 @@
 { self, ... }: {
-  perSystem = { config, self', inputs', pkgs, system, lib, ... }:
+  perSystem =
+    { config, self', inputs', pkgs, system, lib, systemCommonRust, ... }:
     let
       debug = {
         # CARGO_LOG = "debug";
@@ -27,11 +28,7 @@
         buildInputs = with pkgs; [ openssl zstd protobuf ];
         nativeBuildInputs = with pkgs;
           [ clang pkg-config self'.packages.rust-nightly ]
-          ++ lib.optional stdenv.isDarwin
-          (with pkgs.darwin.apple_sdk.frameworks; [
-            Security
-            SystemConfiguration
-          ]);
+          ++ systemCommonRust.darwin-deps;
         RUST_BACKTRACE = "full";
       } // subattrs;
       check-pallet = pkgs.writeShellApplication {

diff --git a/terraform/github.com/labels.tf b/terraform/github.com/labels.tf
@@ -12,6 +12,6 @@ resource "github_issue_label" "label" {
   for_each    = local.labels
   repository  = "composable"
   name        = each.key
-  description = each.value
-  color       = substr(sha1(each.key), 0, 6)
+  description = "${each.value} #owned:terraform"
+  color       = "FFFFFF"
 }
diff --git a/terraform/github.com/team.tf b/terraform/github.com/team.tf
@@ -30,7 +30,7 @@ resource "github_repository_collaborators" "roles" {
   }
 
   user {
-    permission = "maintain"
+    permission = "admin"
     username   = data.github_user.ops.name
   }