🔴 Ecosystem Project Idea: GitHub PR Attestation Bot

[smartcontracts]

What is an Ecosystem Project Idea?

An Ecosystem Project Idea is an idea for a project that someone could build within the Optimism ecosystem. As opposed to an Ecosystem Concept or an Ecosystem Idea, an Ecosystem Project is generally more fleshed out and corresponds to a relatively clear product to be built.

---

Summary

Tracking contributions to a GitHub repository is a useful way to see who's been doing what. Since this information is already public, it can be valuable to make it more easily accessible in the form of an on-chain attestation. A GitHub PR Attestation Bot would automatically make an attestation every time a PR is merged into a repository's main branch. This attestation would contain a reference to the repository, the specific PR, the branch name the PR was merged to, and the GitHub username of the account that created the PR.

Attestations should be published to the Ethereum Attestation Service version of the AttestationStation (ATST). As of the creation of this PR, this version is only available on OP Goerli, but the bot should be designed to support OP Mainnet as well once the mainnet ATST has been upgraded to EAS.

An ideal version of this bot would be configured with the following:

• RPC URL to be used when publishing attestations
• Private key to use when publishing attestations
• Branch or branches to look for PRs to

This can take the form of a GitHub actions task or a GitHub app.

Possible Features

• Allow repository owners to install your GitHub action or GitHub app
• Allow repository owners to configure your GitHub action or GitHub app with the above listed config options
• Automatically publish an attestation when a PR is merged
• Create a schema that represents the attestations based on the required information

Impact

• Help projects keep track of their contributors
• Help contributors be potentially rewarded via RPGF

[GrapeBaBa]

interesting idea

[0xJepsen]

Seems like the MVP would need to use the contract abi's to register an attestation schema and then build a self configurable endpoint to integrate with the bot. Is the idea that the one submitting the PR would use their own PKs, and also pay for the tx?

[smartcontracts]

@0xJepsen I think the repository owner would include a PK in their CI secrets so they would be responsible for paying for the txn

[buildooor]

I created a github action to make an attestation to Ethereum Attestation Service when a PR is merged to the main branch.

The action is available here:

https://github.com/buildooor/github-attestation-action

The Schema is viewable here:

https://sepolia.easscan.org/schema/view/0x47a1041b689b790b4d3fa58ae2289a1d903dcc5b4e00d14f941090b59d947971

Here's an example hello world action that integrates this attestation action:

name: hello-world
on:
  pull_request:
    types: [closed]

jobs:
  my-job:
    runs-on: ubuntu-latest
    steps:
      - name: Attestation
        id: attestation
        uses: buildooor/github-attestation-action@master
        with:
          private-key: ${{ secrets.PRIVATE_KEY }}
          rpc-url: ${{ secrets.RPC_URL }}
          network: sepolia
          branch: master

An example job can be viewed here:

https://github.com/buildooor/github-action-test/actions/runs/5235160033/jobs/9451797252

The example job tx:

https://sepolia.etherscan.io/tx/0x419d5c1a845c38a4ba25596286f00ab39208c62312ee27e703b8bb7097a470d5

The example job attestation:

https://sepolia.easscan.org/attestation/view/0xe1166d38f2edae4e2373c800cbb7af1be4845b2bdf356c8a3cd0daea3ae1a7be

Open to feedback and suggestions!

[smartcontracts]

Oh damn! That's so sick. I'm gonna try integrating it into one of my repositories...

[smartcontracts]

@buildooor haha, this is sick! https://sepolia.easscan.org/attestation/view/0x2301da3994b4328126935b1830c1929f3f07fc43aed00b9a32516cb28094ef2a

[smartcontracts]

@buildooor we're going to be deploying the EAS contracts to OP Mainnet relatively soon. Once that's ready I'm going to get this merged into the monorepo!

[buildooor]

I created a github bot that makes an attestation to Ethereum Attestation Service when a PR is merged to the main branch.

The bot and setup instructions is available here:

https://github.com/buildooor/github-attestation-bot

An example PR merge with bot attestation interaction can be viewed here:

The github bot can be used instead of the github action if the repo does not use github actions.

Open to feedback and suggestions!