feat: private workflow registry deployment behind a feature flag by j-nowak · Pull Request #367 · smartcontractkit/cre-cli

j-nowak · 2026-04-11T04:38:12Z

Added a preview private-registry deploy path for cre workflow deploy behind --preview-private-registry (STAGING-only).
Refactored deploy orchestration into target-specific strategies (onchain vs private) and routed pre-checks/upsert through a shared interface.
Implemented private-registry upsert flow via GraphQL client, including request payload mapping and deploy result output.
Updated artifact handling so uploads happen after pre-deploy checks and are skipped when artifact URLs are already provided.
Added broad test coverage (unit + integration/multi-command flow) for private-registry target resolution, owner derivation, input mapping, and happy-path deploy behavior.

j-nowak · 2026-04-13T14:12:54Z

+// resolveWorkflowOwner returns the effective owner address for workflow ID computation.
+// For private registry deploys, the owner is derived from tenantID and organizationID.
+// For onchain deploys, the configured WorkflowOwner address is used directly.
+func (h *handler) resolveWorkflowOwner(targetWorkflowRegistry registryTarget) (string, error) {


Temporary implementation, that will be resolved with derived workflow owner from GQL in the future.

Ah, I was going to note this. Would we add a new resolveOwner endpoint? From what I can see this flow does not support API_KEY yet, which is fine for now but will need to be supported eventually

We discussed offline, we will use derieved owner from API call, part of a follow up work.

Copilot

Pull request overview

This PR introduces a preview “private workflow registry” deploy path (STAGING-only) and refactors workflow deployment to route through registry-specific strategies (onchain vs private), with accompanying unit and e2e coverage.

Changes:

Add --preview-private-registry flag and resolve registry target (private vs onchain) with STAGING gating.
Refactor deploy flow into registryDeployStrategy implementations for onchain and private registry upsert behavior.
Add unit tests + multi-command e2e happy path for private registry deployment.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/multi_command_test.go	Adds multi-command happy path case for private registry deploy preview flag.
test/multi_command_flows/workflow_private_registry.go	New e2e flow mocking GraphQL + upload endpoints to validate private registry deploy output.
cmd/workflow/deploy/registry_deploy_strategy_test.go	Unit tests for registry target resolution and STAGING-only gating.
cmd/workflow/deploy/registry_deploy_strategy_private.go	Implements private registry deploy strategy using GraphQL upsert + details output.
cmd/workflow/deploy/registry_deploy_strategy_onchain.go	Extracts onchain deploy logic into a strategy with async WRC initialization and prechecks.
cmd/workflow/deploy/registry_deploy_strategy.go	Adds target resolution + strategy factory and STAGING-only validation for preview.
cmd/workflow/deploy/private_registry_test.go	Adds tests for private-registry inputs mapping and owner derivation behavior.
cmd/workflow/deploy/prepare.go	Updates workflow artifact preparation to accept an explicit workflow owner for WorkflowID generation.
cmd/workflow/deploy/deploy_test.go	Adds tests for resolving private registry target/owner and executing private deploy path via mocked GraphQL.
cmd/workflow/deploy/deploy.go	Adds preview flag + target selection, derives owner for private registry, and orchestrates deploy via strategies.
cmd/workflow/deploy/compile_test.go	Updates tests for the new `PrepareWorkflowArtifact(workflowOwner)` signature.
cmd/workflow/deploy/autoLink.go	Uses resolved `h.inputs.WorkflowOwner` for autolink inputs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…to DEVSVCS-4615/private-registry-deploy

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

j-nowak · 2026-04-14T07:50:53Z

+func createTestBearerCredentialsHome(t *testing.T) string {
+	t.Helper()
+
+	homeDir := t.TempDir()
+	creDir := filepath.Join(homeDir, ".cre")
+	require.NoError(t, os.MkdirAll(creDir, 0o700), "failed to create .cre dir")
+
+	jwt := createTestJWT("test-org-id")
+	creConfig := "AccessToken: " + jwt + "\n" +
+		"IDToken: test-id-token\n" +
+		"RefreshToken: test-refresh-token\n" +
+		"ExpiresIn: 3600\n" +
+		"TokenType: Bearer\n"
+
+	require.NoError(t, os.WriteFile(filepath.Join(creDir, "cre.yaml"), []byte(creConfig), 0o600), "failed to write test credentials")
+
+	return homeDir
+}


The private registry test needs to override HOME (and consequently GOPATH) because it uses bearer token (JWT) authentication rather than the API key authentication used by the other happy-path e2e tests.

Why HOME must be overridden:

The other on-chain/EOA deploy tests authenticate by simply setting an environment variable (t.Setenv(credentials.CreApiKeyVar, "test-api")). The CLI reads that env var directly — no files on disk involved, no need to touch HOME.
The private registry flow authenticates using bearer credentials stored in a file at ~/.cre/cre.yaml. The test must fabricate a fake cre.yaml containing a synthetic JWT (with the right org_id, exp, etc.) so the CLI subprocess can read it. To make the subprocess find the fake credentials file (instead of the real user's ~/.cre/cre.yaml, or fail because none exists), HOME is redirected to a t.TempDir() where the fake .cre/cre.yaml lives.
Why GOPATH must be pinned:

When HOME is overridden to a temp directory, Go's default GOPATH becomes $HOME/go — which now points inside the temp dir (e.g. /tmp/.../go). The Go module cache under GOPATH contains read-only files. When the test finishes, t.TempDir() cleanup tries to remove the entire temp directory tree. It cannot delete the read-only module cache files, which causes the cleanup to fail and marks the test as failed even though the actual test logic succeeded. By explicitly setting GOPATH back to the real home's go directory (e.g. /Users/jnowak/go), the module cache stays outside the temp dir and cleanup succeeds cleanly.

In short: the on-chain tests inject auth via a simple env var, but the private registry test injects auth via a file on disk, which forces the HOME override, which in turn necessitates the GOPATH fix to avoid a spurious cleanup failure.

timothyF95

Can address in follow up PR

timothyF95 · 2026-04-15T07:56:07Z

+// resolveWorkflowOwner returns the effective owner address for workflow ID computation.
+// For private registry deploys, the owner is derived from tenantID and organizationID.
+// For onchain deploys, the configured WorkflowOwner address is used directly.
+func (h *handler) resolveWorkflowOwner(targetWorkflowRegistry registryTarget) (string, error) {


Ah, I was going to note this. Would we add a new resolveOwner endpoint? From what I can see this flow does not support API_KEY yet, which is fine for now but will need to be supported eventually

timothyF95 · 2026-04-15T08:10:38Z

+
+const (
+	registryTargetOnchain registryTargetType = "onchain"
+	registryTargetPrivate registryTargetType = "private"


Can we reuse the registry types already defined by tenant manifest?

cre-cli/internal/tenantctx/tenantctx.go

Line 121 in 2c7e301

func mapRegistryType(gqlType string) string {

We could hoist as an enum or const as you suggested in #371 (comment)

This part should be refactored in https://smartcontract-it.atlassian.net/browse/DEVSVCS-4634. I guess the flow control will change and use fields directly from resolved registry.

* registry client * tests * linter * initial implementation of private workflow registry deploy * refactoring * fix derived owner * init refactoring * move workflow exists function * merge input to usage * remove not neeeded check * merge registry target and adapter logic * consolidate files * refactor deploy inputs * rename * add unit tests * init e2e test * improve test * remove redundant file * rename * linter * fix wornflow owner * Update cmd/workflow/deploy/artifacts_test.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update test/multi_command_flows/workflow_private_registry.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * code review fixes * docs * fix test * update doc for temp feature flag --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

j-nowak added 3 commits April 11, 2026 05:27

registry client

91957b4

tests

c32f679

linter

f9458bd

j-nowak changed the base branch from main to DEVSVCS-4530/registry-client April 11, 2026 04:44

initial implementation of private workflow registry deploy

a4048aa

j-nowak force-pushed the DEVSVCS-4615/private-registry-deploy branch from 39b44d6 to a4048aa Compare April 11, 2026 04:45

j-nowak added 10 commits April 11, 2026 07:05

refactoring

30249d7

fix derived owner

06fabea

init refactoring

d44df0e

move workflow exists function

b5e5338

merge input to usage

b442796

remove not neeeded check

daec2c8

merge registry target and adapter logic

a31464c

consolidate files

649ae12

refactor deploy inputs

e6ed984

rename

b4508c9

j-nowak commented Apr 13, 2026

View reviewed changes

j-nowak added 5 commits April 13, 2026 17:04

add unit tests

25a6b46

init e2e test

04d3ec9

improve test

d888a40

remove redundant file

ac78442

rename

36d4c92

j-nowak requested a review from Copilot April 13, 2026 16:14

Copilot started reviewing on behalf of j-nowak April 13, 2026 16:15 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread cmd/workflow/deploy/deploy.go

Comment thread test/multi_command_flows/workflow_private_registry.go Outdated

j-nowak added 2 commits April 14, 2026 05:59

linter

ecf4ba8

fix wornflow owner

e4ab239

j-nowak requested a review from Copilot April 14, 2026 04:25

Copilot started reviewing on behalf of j-nowak April 14, 2026 04:26 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread cmd/workflow/deploy/private_registry_test.go

Comment thread cmd/workflow/deploy/artifacts_test.go

Comment thread test/multi_command_flows/workflow_private_registry.go Outdated

j-nowak requested a review from timothyF95 April 14, 2026 04:32

j-nowak and others added 2 commits April 14, 2026 07:52

Update cmd/workflow/deploy/artifacts_test.go

80692f3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update test/multi_command_flows/workflow_private_registry.go

d52f486

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

j-nowak requested a review from Copilot April 14, 2026 05:53

Copilot started reviewing on behalf of j-nowak April 14, 2026 05:53 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread cmd/workflow/deploy/registry_deploy_strategy.go Outdated

Comment thread cmd/workflow/deploy/deploy.go Outdated

Comment thread test/multi_command_flows/workflow_private_registry.go Outdated

code review fixes

c147d34

Base automatically changed from DEVSVCS-4530/registry-client to main April 14, 2026 07:02

Merge branch 'main' of https://github.com/smartcontractkit/cre-cli in…

9978cee

…to DEVSVCS-4615/private-registry-deploy

j-nowak requested a review from Copilot April 14, 2026 07:16

Copilot started reviewing on behalf of j-nowak April 14, 2026 07:17 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread cmd/workflow/deploy/registry_deploy_strategy_onchain.go

j-nowak added 2 commits April 14, 2026 09:32

docs

908507a

fix test

c80c414

j-nowak commented Apr 14, 2026

View reviewed changes

j-nowak marked this pull request as ready for review April 14, 2026 08:38

j-nowak requested a review from a team as a code owner April 14, 2026 08:38

j-nowak changed the title ~~[WIP] Private workflow registry deployment~~ feat: private workflow registry deployment behind a feature flag Apr 14, 2026

timothyF95 previously approved these changes Apr 15, 2026

View reviewed changes

update doc for temp feature flag

c2cdd90

j-nowak dismissed timothyF95’s stale review via c2cdd90 April 15, 2026 08:22

j-nowak enabled auto-merge April 15, 2026 08:36

timothyF95 approved these changes Apr 15, 2026

View reviewed changes

j-nowak added this pull request to the merge queue Apr 15, 2026

Merged via the queue into main with commit 95f28c3 Apr 15, 2026
21 checks passed

j-nowak deleted the DEVSVCS-4615/private-registry-deploy branch April 15, 2026 09:02

Conversation

j-nowak commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

j-nowak Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

timothyF95 Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

j-nowak Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

j-nowak Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

timothyF95 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

timothyF95 Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

timothyF95 Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

j-nowak Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

j-nowak commented Apr 11, 2026 •

edited

Loading