Upgrade agglayer while attaching cdk opgeth and erigon stack

.github/workflows/upgrade-agglayer-e2e.yml

@@ -0,0 +1,153 @@
+name: Nightly Agglayer Build
+
+on:
+  schedule:
+    - cron: "0 1 * * *"   # 01:00 UTC nightly
+  workflow_dispatch:
+    inputs:
+      FROM_TAG:               { description: "From version tag", required: false }
+      TO_TAG:                 { description: "To version tag",   required: false }
+      ACTION:
+        description: "Action to perform"
+        required: false
+        default: "upgrade"
+        type: choice
+        options: [upgrade, downgrade]
+      KURTOSIS_PACKAGE_HASH:  { description: "Kurtosis package hash", required: false }
+      ENCLAVE_NAME:           { description: "Enclave name",          required: false }
+      SP1_NETWORK_KEY:        { description: "SP1 network key",       required: false }
+  push:
+    branches: [ upgrade-agglayer-cdk-opgeth ]
+
+jobs:
+  run-nightly:
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+
+    # Defaults for scheduled runs; inputs override on manual runs
+    env:
+      # Inputs (manual) → Repo Variables (nightly) → hard default (always)
+      FROM_TAG:              ${{ inputs.FROM_TAG || vars.NIGHTLY_FROM_TAG || '0.3.0-rc.21' }}
+      TO_TAG:                ${{ inputs.TO_TAG   || vars.NIGHTLY_TO_TAG   || '0.3.5' }}
+      ACTION:                ${{ inputs.ACTION   || vars.NIGHTLY_ACTION   || 'upgrade' }}
+      KURTOSIS_PACKAGE_HASH: ${{ inputs.KURTOSIS_PACKAGE_HASH || vars.KURTOSIS_PACKAGE_HASH || '' }}
+      ENCLAVE_NAME:          ${{ inputs.ENCLAVE_NAME          || vars.KURTOSIS_ENCLAVE_NAME || 'cdk' }}
+      SP1_NETWORK_KEY:       ${{ inputs.SP1_NETWORK_KEY       || secrets.SP1_NETWORK_KEY    || '' }}
+      DOCKER_USERNAME:       ${{ secrets.DOCKER_USERNAME || '' }}
+      DOCKER_TOKEN:          ${{ secrets.DOCKER_TOKEN || '' }}
+      POLYCLI_VERSION:       v0.1.84
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Login to Docker Hub
+        if: ${{ env.DOCKER_USERNAME != '' && env.DOCKER_TOKEN != '' }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_TOKEN }}
+
+      # GHCR login
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+       # Install kurtosis
+      - name: Install Kurtosis (via apt.fury.io)
+        run: |
+            set -euxo pipefail
+            echo "deb [trusted=yes] https://apt.fury.io/kurtosis-tech/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+            sudo apt update
+            sudo apt install -y kurtosis-cli
+            kurtosis version || kurtosis --version
+
+       # Install polycli
+      - name: Install polycli
+        run: |
+            polycli_version="${{ env.POLYCLI_VERSION }}"
+            pushd $(mktemp -d) || exit 1
+            curl -s -L "https://github.com/0xPolygon/polygon-cli/releases/download/${polycli_version}/polycli_${polycli_version}_linux_amd64.tar.gz" > polycli.tar.gz
+            tar xf polycli.tar.gz
+            mv polycli_* /usr/local/bin/polycli
+            polycli version
+            popd
+
+
+      - name: Install jq 1.6 and yq v4
+        run: |
+            set -euxo pipefail
+
+            # Create a temp directory
+            tmpdir="$(mktemp -d)"
+
+            # Install jq 1.6
+            curl -L -o "$tmpdir/jq" "https://github.com/jqlang/jq/releases/download/jq-1.6/jq-linux64"
+            sudo install -m 0755 "$tmpdir/jq" /usr/local/bin/jq
+            jq --version  # should print jq-1.6
+
+            # Install yq v4 (example version v4.43.1, change if needed)
+            YQ_VERSION="v4.43.1"
+            curl -L -o "$tmpdir/yq" "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
+            sudo install -m 0755 "$tmpdir/yq" /usr/local/bin/yq
+            yq --version  # should print yq version 4.x
+
+            # Clean up temp dir
+            rm -rf "$tmpdir"
+
+
+      - name: Prepare /tmp run folder
+        run: |
+          set -euxo pipefail
+          mkdir -p /tmp/agglayer-run
+          rsync -a scenarios/agglayer-upgrade-with-supplied-version/ /tmp/agglayer-run/
+          chmod +x /tmp/agglayer-run/run.sh || true
+          chmod +x /tmp/agglayer-run/lxly.sh || true
+          chmod +x /tmp/agglayer-run/check_verification.sh || true
+
+      - name: Create .env from env.example
+        working-directory: /tmp/agglayer-run
+        run: |
+          set -euxo pipefail
+          cp env.example .env
+          sed -i "s|{{KURTOSIS_PACKAGE_HASH}}|${KURTOSIS_PACKAGE_HASH}|g" .env
+          sed -i "s|{{ENCLAVE_NAME}}|${ENCLAVE_NAME}|g" .env
+          sed -i "s|{{SP1_NETWORK_KEY}}|${SP1_NETWORK_KEY}|g" .env
+          sed -i "s|{{FROM_TAG}}|${FROM_TAG}|g" .env
+          sed -i "s|{{TO_TAG}}|${TO_TAG}|g" .env
+          sed -i "s|{{ACTION}}|${ACTION}|g" .env
+
+      - name: Sanity check
+        working-directory: /tmp/agglayer-run
+        run: |
+          set -euxo pipefail
+          ls -la
+          test -f .env
+          test -f run.sh
+          test -f lxly.sh
+          test -d assets
+          jq --version
+          yq --version
+
+      - name: Run nightly
+        working-directory: /tmp/agglayer-run
+        env:
+          FROM_TAG: ${{ env.FROM_TAG }}
+          TO_TAG:   ${{ env.TO_TAG }}
+          ACTION:   ${{ env.ACTION }}
+        run: |
+          set -euxo pipefail
+          : "${FROM_TAG:?FROM_TAG missing}"
+          : "${TO_TAG:?TO_TAG missing}"
+          ./run.sh "$FROM_TAG" "$TO_TAG" "$ACTION"
+
+      - name: Upload outputs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: agglayer-run-outputs
+          path: /tmp/agglayer-run/
+          if-no-files-found: warn

scenarios/agglayer-upgrade-with-supplied-version/README.md

@@ -0,0 +1,69 @@
+# Agglayer Upgrade/Downgrade Automation
+
+This repo contains e2e test scenario to automate **Agglayer image upgrade and downgrade** while running rollup testnets inside **Kurtosis**.
+
+It is designed to:
+
+- Bootstrap multiple rollup flavors ( e.g both opgeth and erigon stack ) into the **same Kurtosis enclave**.
+- Start Agglayer using a **FROM_TAG** version.
+- Upgrade Agglayer to a **TO_TAG** version.
+- Optionally downgrade back to the original **FROM_TAG** for validation.
+- Cleanly tear down the setup using:
+  ```bash
+  kurtosis enclave rm cdk --force
+  ```
+
+- Test file: https://github.com/agglayer/e2e/actions/runs/17996146694/workflow?pr=168
+- Reference: https://github.com/agglayer/e2e/blob/main/tests/lxly/lxly.bats
+- Branch-seen: (https://github.com/agglayer/e2e/blob/jihwan/multi-chain-bridge-workflow/tests/lxly/multi-chain-bridge.bats)
+- Branch-sug: https://github.com/agglayer/e2e/blob/main/tests/lxly/lxly.bats
+- Branch-seen: jihwan/multi-chain-bridge-workflow 
+- Kurtosis-branch: jhilliard/aggsender-validator-committee
+- . ./common.sh && _setup_vars
+# shellcheck source=./lxly.sh
+# source "$SCRIPT_DIR/lxly.sh"
+# main native
+---
+
+##  Scripts
+
+- `run.sh`
+  Main orchestration script. Handles bootstrap, upgrade, and optional downgrade.
+    - **Create the .env file:**
+    ```bash
+    cp env.example .env
+    ```
+
+  - **Upgrade usage:**
+    ```bash
+    ./run.sh FROM_TAG TO_TAG
+    ```
+
+    example
+
+    ```bash
+    ./run.sh 0.3.4 0.3.5
+    ```
+
+  - **Downgrade usage:**
+    ```bash
+    ./run.sh FROM_TAG TO_TAG downgrade
+    ```
+    example
+
+    ```bash
+    ./run.sh  0.3.5 0.3.4  downgrade
+    ```
+##  Arguments & Descriptions
+
+| Argument               | Required | Description |
+|------------------------|----------|-------------|
+| `<FROM_TAG>`           |    Yes   | Docker image tag to start with (e.g., `0.3.4`)|
+| `<TO_TAG>`             |    Yes   | Docker image tag to upgrade to (e.g., `0.3.5`)|
+| `[ACTION]`             |     No   | Optional: set to `downgrade` to  downgrade back to `<FROM_TAG>` after upgrade |
+
+---
+
+
+
+````

scenarios/agglayer-upgrade-with-supplied-version/assets/add_rollup_type.json

@@ -0,0 +1,17 @@
+{
+  "type": "EOA",
+  "consensusContract": "PolygonPessimisticConsensus",
+  "consensusContractAddress": "0xAC77A07dD1683DeA96c08F286b67783fB1e4B583",
+  "polygonRollupManagerAddress": "0x2F50ef6b8e8Ee4E579B17619A92dE3E2ffbD8AD2",
+  "verifierAddress": "0xf22E2B040B639180557745F47aB97dFA95B1e22a",
+  "description": "Type: Pessimistic, Upgrade v0.2.x to v0.3.x",
+  "forkID": 12,
+  "timelockDelay": 0,
+  "timelockSalt": "",
+  "deployerPvtKey": "0x12d7de8621a77640c9241b2595ba78ce443d05e94090365ab3bb5e19df82c625",
+  "maxFeePerGas": "",
+  "maxPriorityFeePerGas": "",
+  "multiplierGas": "",
+  "genesisRoot": "0xd9c8633088ce212acd9280c5f64623add99871234145a808ab6fbdbac5659a87",
+  "programVKey": "0x00e60517ac96bf6255d81083269e72c14ad006e5f336f852f7ee3efb91b966be"
+}

scenarios/agglayer-upgrade-with-supplied-version/assets/erigon-sovereign.yml

@@ -0,0 +1,27 @@
+deployment_stages:
+  deploy_l1: false
+  deploy_agglayer: false
+  deploy_l2_contracts: true
+  deploy_optimism_rollup: false
+  deploy_op_succinct: false
+
+args:
+  sequencer_type: erigon
+  consensus_contract_type: pessimistic
+
+  # aggkit_image: ghcr.io/agglayer/aggkit:0.5.0-beta4
+  aggkit_image: ghcr.io/agglayer/aggkit:0.7.0-beta6
+  zkevm_prover_image: hermeznetwork/zkevm-prover:v8.0.0-RC16-fork.12
+  cdk_erigon_node_image: hermeznetwork/cdk-erigon:v2.63.0-rc4
+
+  sp1_prover_key: ""
+  agglayer_prover_primary_prover: mock-prover
+  erigon_strict_mode: false
+  gas_token_enabled: false
+  zkevm_use_real_verifier: false
+  enable_normalcy: true
+  aggkit_components: aggsender,bridge
+
+  zkevm_rollup_chain_id: 2151910
+  deployment_suffix: "-003"
+  zkevm_rollup_id: 3

scenarios/agglayer-upgrade-with-supplied-version/assets/opgeth-ecdsa.yml

@@ -0,0 +1,36 @@
+# This args-file deploys the OP Succinct chain.
+deployment_stages:
+  deploy_l1: false
+  deploy_agglayer: false
+  deploy_op_succinct: false
+
+args:
+  # aggkit_image: "ghcr.io/agglayer/aggkit:0.7.0-beta3"  # https://github.com/agglayer/aggkit/tree/v0.7.0-beta3
+  aggkit_image: "ghcr.io/agglayer/aggkit:0.7.0-beta6" 
+  # Agghcain ecdsa_multisig consensus.
+  consensus_contract_type: ecdsa_multisig
+  use_agg_sender_validator: True
+  aggkit_prover_primary_prover: "mock-prover"
+  # The below parameter will be used for aggsender multisig to have "agg_sender_validator_total_number" aggsender validators.
+  agg_sender_validator_total_number: 1
+  agg_sender_multisig_threshold: 1
+  zkevm_rollup_chain_id: 2151909
+  deployment_suffix: "-002"
+  zkevm_rollup_id: 2
+  # OP Networks rely on L1 blocks to have finalisation on L2. This means if the L1 blocktime is very fast, OP Succinct proof requests will have to bundle many L1 blocks into a single proof.
+  # This will significantly increase cycles even if the L2 network is empty. Instead of having 2s, for OP Succinct deployments, we recommend 12s.
+  # Note this will noticeably increase the deployment time because of the increased L1 finality.
+  l1_seconds_per_slot: 2 # TEMPORARY - DO NOT MERGE
+
+optimism_package:
+  chains:
+    - proposer_params:
+        enabled: false
+      challenger_params:
+        enabled: false
+      network_params:
+        name: "002"
+        network_id: "2151909"
+        seconds_per_slot: 1
+  observability:
+    enabled: false

scenarios/agglayer-upgrade-with-supplied-version/assets/opgeth-soverign.yml

@@ -0,0 +1,56 @@
+# This args-file deploys the OP Succinct chain.
+deployment_stages:
+  deploy_optimism_rollup: true
+  # deploy_op_succinct: true
+  deploy_agglayer: true
+args:
+  sp1_prover_key: "bcdf20249abf0ed6d944c0288fad489e33f66b3960d9e6229c1cd214ed3bbe31" # XXX: Replace with an active key
+  # Valid values are: "network-prover", "mock-prover"
+  agglayer_prover_primary_prover: "mock-prover"
+  # Valid values are: "network-prover", "mock-prover"
+  aggkit_prover_primary_prover: "mock-prover"
+  consensus_contract_type: pessimistic
+  # aggkit_prover_image: "ghcr.io/agglayer/aggkit-prover:feat-rust-proposer"
+  # false = network
+  # Using the network provers will use the real SP1 verifier contract which is also deployed together in the Kurtosis devnet.
+  # A mock verifier is used otherwise.
+  op_succinct_mock: false
+  # Enable real (non-mock) verifier on contracts
+  zkevm_use_real_verifier: false
+  # Enable the integration with the Agglayer
+  op_succinct_agglayer: true
+  # Proof type. Must match the verifier gateway contract type. Options: "plonk", "groth16", "compressed", "core"
+  op_succinct_agg_proof_mode: "compressed"
+  # The minimum interval in L2 blocks at which checkpoints must be submitted. An aggregation proof can be posted for any range larger than this interval.
+  op_succinct_submission_interval: "1"
+  # The maximum number of concurrent proof requests to send to the `op-succinct-server`
+  op_succinct_max_concurrent_proof_requests: "1"
+  # The maximum number of concurrent witness generation processes to run on the `op-succinct-server`
+  op_succinct_max_concurrent_witness_gen: "1"
+  # Must match network_id field in network_params.network_id
+  # The number following the "-" should be identical to network_params.name
+  deployment_suffix: "-001"
+  zkevm_rollup_id: 1
+  zkevm_rollup_chain_id: 2151908
+  # Size of the range proof.
+  op_succinct_range_proof_interval: "1800"
+  # OP Networks rely on L1 blocks to have finalization on L2. This means if the L1 blocktime is very fast, OP Succinct proof requests will have to bundle many L1 blocks into a single proof.
+  # This will significantly increase cycles even if the L2 network is empty. Instead of having 2s, for OP Succinct deployments, we recommend 12s.
+  # Note this will noticeably increase the deployment time because of the increased L1 finality.
+  l1_seconds_per_slot: 12
+
+optimism_package:
+  chains:
+    - proposer_params:
+        enabled: false
+      challenger_params:
+        enabled: false
+      network_params:
+        name: "001"
+        network_id: "2151908"
+        seconds_per_slot: 1
+  observability:
+    enabled: true
+# optimism_package:
+#   observability:
+#     enabled: true