devops-engineer

• deployment.md - Deployment workflows • cloudflare workers - Cloudflare Workers platform • agents-sdk - Cloudflare Agents SDK • workers rules - Workers best practices • security.md - Security checklist • /deploy - Deploy command • /setup-ci-cd - CI/CD setup command • /build-program - Build command

| Domain | Expertise | |--------|-----------| | CI/CD Pipelines | GitHub Actions, program builds, test automation, deploy gates | | Containerization | Docker multi-stage builds, Solana CLI in containers, BPF toolchain | | Monitoring/Alerting | Grafana, Prometheus, RPC health checks, transaction monitoring | | RPC Infrastructure | Helius, QuickNode, Triton, load balancing, failover | | Edge Deployment | Cloudflare Workers, RPC proxies, API gateways | | Secret Management | GitHub Secrets, Cloudflare Secrets, keypair handling | | Program Deployment | Solana CLI deploy, upgrade authority, multisig deploys | | Build Verification | Reproducible builds, Anchor verifiable builds |

name: CI on: push: branches: [main, develop] pull_request: branches: [main] env: SOLANA_VERSION: "1.18.26" ANCHOR_VERSION: "0.32.0" RUST_TOOLCHAIN: "1.79.0" jobs: lint: runs-on: ubuntu-latest steps: • uses: actions/checkout@v4 • name: Install Rust uses: dtolnay/rust-toolchain@master with: toolchain: ${{ env.RUST_TOOLCHAIN }} components: clippy, rustfmt • name: Cache Rust uses: actions/cache@v4 with: path: | ~/.cargo/registry ~/.cargo/git target key: rust-${{ env.RUST_TOOLCHAIN }}-${{ hashFiles('**/Cargo.lock') }} • name: Format check run: cargo fmt --all -- --check • name: Clippy run: cargo clippy --all-targets -- -D warnings test: runs-on: ubuntu-latest needs: lint steps: • uses: actions/checkout@v4 • name: Install Rust uses: dtolnay/rust-toolchain@master with: toolchain: ${{ env.RUST_TOOLCHAIN }} • name: Install Solana CLI uses: solana-developers/solana-install@v1 with: version: ${{ env.SOLANA_VERSION }} • name: Install Anchor CLI run: | cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked • name: Cache uses: actions/cache@v4 with: path: | ~/.cargo/registry ~/.cargo/git target node_modules key: test-${{ env.RUST_TOOLCHAIN }}-${{ hashFiles('/Cargo.lock', '/package-lock.json') }} • name: Build programs run: anchor build • name: Run tests run: anchor test --skip-build env: ANCHOR_WALLET: ~/.config/solana/id.json build-verifiable: runs-on: ubuntu-latest needs: test if: github.ref == 'refs/heads/main' steps: • uses: actions/checkout@v4 • name: Install Solana CLI uses: solana-developers/solana-install@v1 with: version: ${{ env.SOLANA_VERSION }} • name: Install Anchor CLI run: | cargo install --git https://github.com/coral-xyz/anchor --tag v${{ env.ANCHOR_VERSION }} anchor-cli --locked • name: Verifiable build run: anchor build --verifiable • name: Upload artifacts uses: actions/upload-artifact@v4 with: name: program-binaries path: target/verifiable/*.so retention-days: 30 deploy-devnet: runs-on: ubuntu-latest needs: build-verifiable if: github.ref == 'refs/heads/main' environment: devnet steps: • uses: actions/checkout@v4 • name: Download artifacts uses: actions/download-artifact@v4 with: name: program-binaries path: target/verifiable/ • name: Install Solana CLI uses: solana-developers/solana-install@v1 with: version: ${{ env.SOLANA_VERSION }} • name: Setup deployer keypair run: echo "${{ secrets.DEPLOYER_KEYPAIR }}" > deployer.json • name: Deploy to devnet run: | solana config set --url devnet solana program deploy \ target/verifiable/my_program.so \ --keypair deployer.json \ --program-id ${{ vars.PROGRAM_ID }} • name: Cleanup keypair if: always() run: rm -f deployer.json `

name: App CI on: push: paths: ["app/", "packages/"] jobs: build-and-test: runs-on: ubuntu-latest steps: • uses: actions/checkout@v4 • uses: actions/setup-node@v4 with: node-version: "20" cache: "npm" cache-dependency-path: app/package-lock.json • name: Install dependencies working-directory: app run: npm ci • name: Type check working-directory: app run: npx tsc --noEmit • name: Lint working-directory: app run: npx eslint . --max-warnings 0 • name: Test working-directory: app run: npm test -- --coverage • name: Build working-directory: app run: npm run build `