chore: Refactor onramp upgrade cs to include verifier_id - #1360
Draft
carte7000 wants to merge 1 commit into
Draft
Conversation
|
Code coverage report:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Refactors temporary on-ramp upgrade verifier jobs to isolate runtime identities while retaining canonical aggregator credentials.
Changes:
- Adds isolated job and verifier ID suffixing.
- Preserves canonical credential references across verifier topologies.
- Adds legacy and consolidated topology tests.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
deployment/changesets/apply_verifier_config.go |
Implements isolated identity and credential mapping. |
deployment/changesets/apply_verifier_config_test.go |
Tests canonical verifier IDs. |
deployment/changesets/apply_verifier_config_onramp_upgrade.go |
Enables isolation for upgrade jobs. |
deployment/changesets/apply_verifier_config_onramp_upgrade_test.go |
Tests isolated upgrade jobs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| func WithJobSuffix(suffix string) ApplyVerifierConfigApplyOption { | ||
| // WithIsolatedJob creates a distinct job identity and verifier runtime namespace while | ||
| // preserving the canonical aggregator credential lookup. This is intended for temporary | ||
| // parallel jobs, such as on-ramp upgrade jobs, this avoid sharing durable verifier state |
Comment on lines
+602
to
+610
| if overrides.isIsolatedJob() { | ||
| verifierCfg.Aggregators = []commit.AggregatorConnection{ | ||
| { | ||
| Name: agg.Name, | ||
| SecretName: canonicalVerifierID, | ||
| Address: agg.Address, | ||
| InsecureConnection: agg.InsecureAggregatorConnection, | ||
| }, | ||
| } |
carte7000
changed the title
tt-cll
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduces improved handling and isolation of verifier job identities for temporary or parallel jobs (such as on-ramp upgrade jobs), ensuring that isolated jobs have unique runtime
verifier_ids while still referencing the canonical credentials for aggregator connections. It also adds comprehensive tests to verify correct behavior for both legacy and consolidated job topologies, and clarifies the code and comments around these behaviors.Key changes include:
Isolated Job Identity and Configuration
jobSuffixwithisolatedJobSuffixand introduced helper methods (isIsolatedJob,applyJobID, andapplyVerifierID) inapplyVerifierConfigApplyOverridesto consistently apply isolation to both job IDs and verifier IDs. This ensures isolated jobs have unique identities without affecting credential lookup.ApplyOnrampUpgradeVerifierConfigto use the newWithIsolatedJoboption, ensuring on-ramp upgrade jobs are properly isolated.Job Specification and Aggregator Representation
AggregatorAddressfield, while isolated jobs use a single-entryAggregatorslist and a uniqueverifier_id, ensuring separation of runtime identity from secret lookup. [1] [2] [3]