Before sharing a testnet deployment, confirm the full registry lifecycle. Run every step in order.
| Variable | Required | Description |
|---|---|---|
NETWORK |
Yes | Must be testnet — never omit or set to mainnet for this checklist |
ADMIN |
Yes | G-address of the contract admin account |
SOURCE |
Yes | Stellar CLI identity name (must be a funded testnet account) |
CONTRACT_ID |
Only after deploy | Contract ID written by deploy.sh |
- Build the optimized WASM from a clean checkout.
make build
- Deploy to Stellar testnet.
make deploy-testnet
- Verify the WASM hash from the deployment output and record it.
Confirm
deployments/testnet.jsoncontains thecontract_id. - Initialize the contract with the admin address (if not auto-initialized by deploy).
make invoke-init
- Register a sample GitHub username with a test Stellar address.
make invoke-register GITHUB_USER=testuser STELLAR_ADDR=G... SOURCE=deployer
- Look up the registered username to confirm the record is correct.
make invoke-lookup GITHUB_USER=testuser SOURCE=deployer
- Verify the sample contributor as admin.
make invoke-verify GITHUB_USER=testuser SOURCE=admin CONTRACT_ID=$CONTRACT_ID - Check stats to confirm the verified count incremented.
make invoke-stats SOURCE=deployer CONTRACT_ID=$CONTRACT_ID - Revoke verification to confirm the admin can unwrap a verified record.
make invoke-revoke-verification GITHUB_USER=testuser SOURCE=admin CONTRACT_ID=$CONTRACT_ID - Remove the sample registration (admin or registrant).
make invoke-remove CALLER=$ADMIN GITHUB_USER=testuser SOURCE=admin CONTRACT_ID=$CONTRACT_ID
- Confirm lookup returns empty for the removed username.
make invoke-lookup GITHUB_USER=testuser SOURCE=deployer CONTRACT_ID=$CONTRACT_ID
The repository has an opt-in GitHub Actions job for checking Stellar RPC and
argument encoding against a pre-deployed testnet contract. It is invoke-only:
it does not deploy or initialize a contract, so it cannot accidentally call
initialize twice. Enable it by setting the repository variable
TRUSTBRIDGE_LIVE_TESTNET to true.
Configure these repository values before enabling it:
| Name | Type | Description |
|---|---|---|
TRUSTBRIDGE_LIVE_TESTNET |
Variable | Must be true to enable the job |
TRUSTBRIDGE_TESTNET_USERNAME |
Variable | Existing username used by get_address |
TRUSTBRIDGE_TESTNET_CONTRACT_ID |
Secret | Pre-deployed testnet contract ID |
TRUSTBRIDGE_TESTNET_SECRET_KEY |
Secret | Testnet source account secret key |
The job imports the secret key into an ephemeral ci-testnet Stellar CLI
identity, then invokes get_stats and get_address on testnet. It runs only
for non-PR events in the canonical repository, so fork pull requests never
receive repository secrets. If the opt-in variable is enabled and any required
value is missing, the job fails closed.
- Record the contract ID, network passphrase, deployer address, admin address, and commit hash used. Store these in
deployments/testnet.jsonor a runbook. - Confirm no mainnet environment variables (
NETWORK=mainnet,ADMINwith a mainnet G-address) are active in the shell session before running any step above. - Protocol-upgrade rehearsal: Run
make test-rehearsalbefore any testnet or mainnet deployment to verify that all on-chain state survives a simulated WASM upgrade. See the rehearsal test intests/integration.rs(test_protocol_upgrade_rehearsal) for what "pass" means. This is a prerequisite for mainnet deployment.
Store the contract ID, network passphrase, deployer address, admin address, and commit hash used for the deployment.