Merge branch 'main' into ceremony/vocdoni-zkcensus-ceremony

.github/workflows/create-ceremony.yml

@@ -14,7 +14,7 @@ jobs:
       run: git lfs checkout
     - name: Run toolkit
       run: |
-        docker build -q -t vocdoni/zk-voceremony-create --target zk-voceremony-create .
+        docker build . -q --target zk-voceremony-create --tag vocdoni/zk-voceremony-create
         docker run --rm -qt -v ./:/app --env-file ./ceremony.env vocdoni/zk-voceremony-create 
     - name: Commit ceremony artifacts
       if : ${{ success() }}

.github/workflows/finish-ceremony.yml

@@ -16,7 +16,7 @@ jobs:
       run: git lfs checkout
     - name: Run toolkit
       run: |
-        docker build -q -t vocdoni/zk-voceremony --target zk-voceremony .
+        docker build . -q --target zk-voceremony --tag vocdoni/zk-voceremony
         docker run --rm -qt -v ./:/app --env-file ./ceremony.env vocdoni/zk-voceremony finish
     - name: Commit ceremony artifacts
       if : ${{ success() }}

.github/workflows/timeout-contribution.yml

@@ -0,0 +1,25 @@
+name: Contribution timeout
+on: 
+  pull_request_target:
+    branches:
+      - ceremony/*
+    paths:
+      - .lock
+
+permissions: write-all
+
+jobs:
+  timeout-contribution:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Wait 10 minutes
+      run: sleep 600
+    - name: Close PR branch if still a draft
+      if: success() && contains(github.event.pull_request.title, 'Contribution:')
+      run: |
+        if gh pr view "$PR_URL" --json isDraft -q .isDraft | grep true; then
+          gh pr close -c "Timed out" "$PR_URL"
+        fi
+      env:
+        PR_URL: ${{github.event.pull_request.html_url}}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/verify-contribution.yml

@@ -3,6 +3,8 @@ on:
   pull_request_target:
     branches:
       - ceremony/*
+    paths:
+      - contributions/*
 
 permissions: write-all
 
@@ -14,11 +16,7 @@ jobs:
       uses: actions/checkout@v4
     - name: Build toolkit
       run: |
-        docker build -q -t vocdoni/zk-voceremony --target zk-voceremony .
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJson(github) }}
-      run: echo "$GITHUB_CONTEXT"
+        docker build . -q --target zk-voceremony --tag vocdoni/zk-voceremony
     - name: Checkout the fork
       uses: actions/checkout@v4
       with:

Dockerfile

@@ -16,6 +16,7 @@ RUN apt update \
     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
     && apt update \
     && apt install --no-install-recommends -y gh \
+    && apt install --no-install-recommends -y jq \
 	&& apt autoremove -y \
     && apt clean \
     && rm -rf /var/lib/apt/lists/*

README.md

@@ -69,6 +69,6 @@ A Github action will compile the circuit and generate the first contribution in
 #### Build docker images locally
 
 ```
-docker build . --target zk-voceremony -t zk-voceremony 
-docker build . --target zk-voceremony-create -t zk-voceremony-create
+docker build . --target zk-voceremony --tag vocdoni/zk-voceremony
+docker build . --target zk-voceremony-create --tag vocdoni/zk-voceremony-create
 ```

scripts/contribute

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+GITHUB_REPO="vocdoni/zk-voceremony"
+
 intro_message() {
     echo "
 
@@ -48,20 +50,38 @@ intro_message() {
     echo "Welcome to the zk-voceremony contribution process!"
     echo
     echo "To start your contribution you need to provide the following information:"
+    echo " - The github repository of the ceremony (by default '$GITHUB_REPO')"
     echo " - Login to your GitHub account (commits will use your github username)"
-    echo " - The URL of the repository of the ceremony (by default 'https://github.com/vocdoni/zk-voceremony.git')"
-    echo " - The name of the ceremony (used to name the ceremony branch)"
 }
 
 
 prompt_env_inputs() {
-    GITHUB_REPO_URL="https://github.com/vocdoni/zk-voceremony.git"
-    read -p "Enter the url of the repo (by default 'https://github.com/vocdoni/zk-voceremony.git'): " REPO_URL
+    read -p "Enter the name of the repo (by default '$GITHUB_REPO'): " REPO_URL
     if [ -n "$REPO_URL" ]; then
-        GITHUB_REPO_URL=$REPO_URL
+        GITHUB_REPO=$REPO_URL
+    fi
+
+    # list on-going ceremonies
+    branches="$(curl -s -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/$GITHUB_REPO/pulls" \
+                | jq '.[].head.ref' | tr -d '"' | grep ^ceremony | sort -u )"
+    echo
+    echo "Current on-going ceremonies:"
+    echo
+    echo "$branches"
+    echo
+    CEREMONY_BRANCH="$(echo "$branches" | head -n 1)"
+    read -p "Enter the name of one of the 'on-going' ceremonies and branches shown above (default $CEREMONY_BRANCH): " BRANCH
+    if [ -n "$BRANCH" ]; then
+        CEREMONY_BRANCH="$BRANCH"
     fi
-    GITHUB_REPO_BASENAME=$(basename "$GITHUB_REPO_URL" .git)
-    GITHUB_REPO_NAME="${GITHUB_REPO_BASENAME##*/}"
+
+    echo
+    if curl -s -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/$GITHUB_REPO/pulls" \
+    | jq '.[].title' | grep Contribution | grep $CEREMONY_BRANCH ; then
+      echo "Oops, there's a PR from someone *right now* uploading a contribution to this ceremony, just wait a couple of minutes and try again"
+      exit 5
+    fi
+
     echo
     echo "Now you need to login to your GitHub account to authenticate the process."
     echo " - During this process, you will be asked to login to your GitHub account using your browser."
@@ -72,36 +92,32 @@ prompt_env_inputs() {
 
     # get the access token
     gh auth login -p https -h github.com -w
-    # list on-going ceremonies
-    branches="$(gh pr list -R $GITHUB_REPO_URL -l on-going-ceremony --json headRefName --jq '.[].headRefName')"
+
     echo
-    echo "Current on-going ceremonies:"
+    echo "Okey! Let's start. After you press enter, this script will fork the repo under your username,"
+    echo "open a PR against upstream, download required files, let you input your contribution (a random string),"
+    echo "and upload it to the PR. Noone else can contribute during this time, so you need to have fast, stable internet connection,"
+    echo "else your contribution process will fail due to an automatic timeout after a few minutes."
     echo
-    echo $branches
+    read -p "Press enter to continue..."
     echo
-    CEREMONY_BRANCH="$(echo "$branches" | head -n 1)"
-    read -p "Enter the name of one of the 'on-going' ceremonies and branches shown above (default $CEREMONY_BRANCH): " BRANCH
-    if [ -n "$BRANCH" ]; then
-        CEREMONY_BRANCH="$BRANCH"
-    fi
+
     # clone the ceremony branch, shallow and without LFS (it will be pulled later)
     echo
     echo "Cloning ceremony branch $CEREMONY_BRANCH (this might take a while)..."
     echo
     git config --global lfs.fetchinclude none
 
-    gh repo clone $GITHUB_REPO_URL ./ceremony -- --branch $CEREMONY_BRANCH --depth 1
+    gh repo fork --clone $GITHUB_REPO -- ./ceremony --branch $CEREMONY_BRANCH --depth 2
     cd ./ceremony
-    gh repo fork --remote=true
+    git reset --hard upstream/$CEREMONY_BRANCH # ensure everything is clean (important when fork already existed)
+
     . ceremony.env
     # set up user identity
     CONTRIBUTOR_NAME="$(gh api user --jq '.login')"
     git config user.name $CONTRIBUTOR_NAME
     git config user.email $CONTRIBUTOR_NAME@users.noreply.github.com
 
-    echo
-    read -p "Okey! Let's start. Press enter to continue..."
-    echo
     . /bin/tools.sh
 }
 
@@ -122,6 +138,13 @@ check_contribute_env() {
         exit 1
     fi
 
+    touch .lock && git add .lock && git commit .lock -m "Prevent other contributions" && git push origin $CEREMONY_BRANCH
+
+    gh pr create --title "Contribution: from $CONTRIBUTOR_NAME to '$CEREMONY_BRANCH' ceremony" --body "" \
+        --base $CEREMONY_BRANCH --draft
+
+    git reset --hard upstream/$CEREMONY_BRANCH # discard .lock commit
+
     echo
     echo "Downloading artifacts..."
     git config lfs.fetchinclude "${LAST_CONTRIBUTION_FILE##./}"
@@ -187,9 +210,9 @@ publish_contribution() {
     echo "Uploading and committing your contribution..."
     echo
     git add $CONTRIBUTIONS_FILE $CURRENT_CONTRIBUTION_FILE && \
-        git commit -m "Contribution: from $CONTRIBUTOR_NAME to '$CEREMONY_BRANCH' ceremony" && \
-        git push origin $CEREMONY_BRANCH && \
-        gh pr create --fill --base $CEREMONY_BRANCH -R $GITHUB_REPO_URL
+        git commit -m "Contribution: from $CONTRIBUTOR_NAME to '$CEREMONY_BRANCH' ceremony" \
+        && git push -f origin $CEREMONY_BRANCH \
+        && gh pr ready
     [ $? -ne 0 ] && {
         echo; echo "Error during the contribution process, please start it over or ask for support"
         exit 1