CCIP-9778 - Add EVM contract verification changeset hooks to the framework by AnieeG · Pull Request #899 · smartcontractkit/chainlink-deployments-framework

AnieeG · 2026-03-30T20:01:13Z

NewVerifyDeployedEVMContractsPostHook — After a successful Apply, walks EVM address refs in the changeset output datastore and verifies them on the configured explorer (same ContractInputsProvider / metadata path as verify-env). Skips when Apply failed or when there is no output datastore. Uses Abort on failure.
NewRequireVerifiedEVMContractsPreHook — Before Apply, loads the environment datastore and checks that every EVM contract is already verified (IsVerified only). Uses Abort if anything is unverified or checks fail.

Related ticket - https://smartcontract-it.atlassian.net/browse/CCIP-9778

…nts-framework

…nts-framework into pre-post-hook-verification

changeset-bot · 2026-03-30T20:01:22Z

⚠️ No Changeset found

Latest commit: 4e71794

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-03-30T20:01:27Z

👋 AnieeG, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

Copilot

Pull request overview

Adds changeset lifecycle hooks to automatically verify EVM contracts post-apply and to enforce that environment EVM contracts are already verified pre-apply, reusing the existing EVM verification infrastructure (network config + ContractInputsProvider + explorer verifiers).

Changes:

Introduces a post-hook that verifies EVM contracts emitted into ChangesetOutput.DataStore after a successful Apply.
Introduces a pre-hook that checks IsVerified for EVM contracts in the environment datastore before Apply and aborts if any are unverified.
Adds unit tests covering hook definitions and iterateEVMVerifiers behavior across key skip/error cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
engine/cld/verification/hooks/evm/hooks.go	Adds pre/post changeset hooks and shared datastore iteration for EVM explorer verification.
engine/cld/verification/hooks/evm/hooks_test.go	Adds tests for hook definitions and verifier iteration control flow (skip/error/success paths).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-30T20:17:32Z

+		ds, err := dom.EnvDir(params.Env.Name).DataStore()
+		if err != nil {
+			return fmt.Errorf("require verified pre-hook: load datastore: %w", err)
+		}


requireVerifiedEnvContracts loads the environment datastore via dom.EnvDir(...).DataStore(), which only reads the local JSON files. In catalog mode (domain config datastore: catalog / all), local files may not exist or may be stale, causing this pre-hook to fail/block pipelines even though the canonical datastore is in the catalog.

Consider loading the datastore using the same logic as the contract verify-env command (i.e., respect the domain’s datastore type and load from catalog when configured), or factoring out a shared datastore loader helper so both flows stay consistent.

Copilot · 2026-03-30T20:17:34Z

+func TestRequireVerified_PreHook_DataStoreError(t *testing.T) {
+	t.Parallel()
+
+	dom := domain.NewDomain(t.TempDir(), "test")
+	h := NewRequireVerifiedEVMContractsPreHook(dom, &mockProvider{})
+	err := h.Func(t.Context(), changeset.PreHookParams{
+		Env: changeset.HookEnv{Name: "staging", Logger: logger.Test(t)},
+	})
+	require.Error(t, err)
+	require.ErrorContains(t, err, "require verified pre-hook: load datastore")
+}
+
+func TestRequireVerified_PreHook_LoadNetworksError(t *testing.T) {
+	t.Parallel()
+
+	dom := domain.NewDomain(t.TempDir(), "test")
+	h := NewRequireVerifiedEVMContractsPreHook(dom, &mockProvider{})
+	// Minimal env layout so DataStore() succeeds: empty files skip JSON decode in loadDataStore.
+	envDir := dom.EnvDir("staging")
+	require.NoError(t, mkdirAllAndWrite(t, envDir.AddressRefsFilePath(), ""))
+	require.NoError(t, mkdirAllAndWrite(t, envDir.ChainMetadataFilePath(), ""))
+	require.NoError(t, mkdirAllAndWrite(t, envDir.ContractMetadataFilePath(), ""))
+	require.NoError(t, mkdirAllAndWrite(t, envDir.EnvMetadataFilePath(), ""))
+
+	err := h.Func(t.Context(), changeset.PreHookParams{
+		Env: changeset.HookEnv{Name: "staging", Logger: logger.Test(t)},
+	})
+	require.Error(t, err)
+	require.ErrorContains(t, err, "require verified pre-hook: load networks")
+}


The new hooks’ core behaviors aren’t exercised in tests yet: there’s no test proving the pre-hook errors when IsVerified returns false (and succeeds when true), nor that the post-hook invokes Verify for resolvable EVM address refs.

Consider adding unit tests that stand up an httptest server for a supported strategy (e.g., Sourcify / Blockscout), point network.BlockExplorer.URL at it, and assert hook success/failure based on the mocked explorer responses.

…kit/chainlink-deployments-framework into pre-post-hook-verification

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cl-sonarqube-production · 2026-03-30T20:56:33Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
94.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

DimitriosNaikopoulos · 2026-03-31T07:09:30Z

+				continue
+			}
+
+			if err := step(ctx, v, ref, ch); err != nil {


Are we verifying contracts sequentially? If so wouldn't that make the hook slow if we have to always run the verifier for all evm contracts that exist for the domain env?

ajaskolski · 2026-03-31T09:00:50Z

+		if err != nil {
+			return fmt.Errorf("require verified pre-hook: load datastore: %w", err)
+		}
+


Bot is right here we should use catalog supportive flow This loads from local files only. In environments where the catalog is the source of truth (datastore_type: all / catalog), the pre-hook won't see catalog data — it will read stale or empty local files. verify-env CLI handles this via DataStoreLoaderFunc (see deps.go); the hook should do the same or accept a loader.

ajaskolski · 2026-03-31T09:02:23Z

+			continue
+		}
+
+		strategy := evm.GetVerificationStrategy(ch.EvmChainID)


GetVerificationStrategy(chainID) was removed — this won't compile against the current evm package. Needs to be GetVerificationStrategyForNetwork(network) - hardcoded chains ids in CLDF was making it hard to add any new chains, now we just take network configuration from CLD

ajaskolski · 2026-03-31T09:06:39Z

+				lggr.Debugf("%s: skipping %s (%s): %v", logPrefix, ref.Address, ref.Type, err)
+				continue
+			}
+


VerifierConfig.HTTPClient is not set — all explorer calls go through http.DefaultClient. This makes it hard to test and impossible to inject custom transports (timeouts, retries, auth proxies) might be helpful to add it there.

AnieeG · 2026-04-01T23:51:00Z

Closing PR and moving hooks to chainlink-ccip smartcontractkit/chainlink-ccip#1925

AnieeG added 4 commits December 10, 2025 14:57

Merge branch 'main' of github.com:smartcontractkit/chainlink-deployme…

712a1e8

…nts-framework

Merge branch 'main' of github.com:smartcontractkit/chainlink-deployme…

c746e95

…nts-framework

adding pre and post hook for evm verifications

32ffdb5

Merge branch 'main' of github.com:smartcontractkit/chainlink-deployme…

75036b6

…nts-framework into pre-post-hook-verification

AnieeG requested a review from a team as a code owner March 30, 2026 20:01

Copilot AI review requested due to automatic review settings March 30, 2026 20:01

Copilot started reviewing on behalf of AnieeG March 30, 2026 20:01 View session

AnieeG changed the title ~~Add EVM contract verification changeset hooks to the framework~~ CCIP-9778 - Add EVM contract verification changeset hooks to the framework Mar 30, 2026

Copilot AI reviewed Mar 30, 2026

View reviewed changes

Comment thread engine/cld/verification/hooks/evm/hooks.go Outdated

Comment thread engine/cld/verification/hooks/evm/hooks.go Outdated

Comment thread engine/cld/verification/hooks/evm/hooks.go Outdated

Apply suggestions from code review

cb89dbd

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 30, 2026 20:10

Copilot started reviewing on behalf of AnieeG March 30, 2026 20:11 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

AnieeG added 3 commits March 30, 2026 13:18

Merge branch 'pre-post-hook-verification' of github.com:smartcontract…

dbfa899

…kit/chainlink-deployments-framework into pre-post-hook-verification

lint fixes

f9f9d95

move

4e71794

Copilot AI review requested due to automatic review settings March 30, 2026 20:49

Copilot AI reviewed Mar 30, 2026

View reviewed changes

Comment thread engine/cld/hooks/verification/evm/hooks.go

Comment thread engine/cld/hooks/verification/evm/hooks.go

Comment thread engine/cld/hooks/verification/evm/hooks.go

Comment thread engine/cld/hooks/verification/evm/hooks_test.go

Comment thread engine/cld/hooks/verification/evm/hooks.go

DimitriosNaikopoulos reviewed Mar 31, 2026

View reviewed changes

ajaskolski reviewed Mar 31, 2026

View reviewed changes

AnieeG closed this Apr 1, 2026

Conversation

AnieeG commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Mar 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cl-sonarqube-production Bot commented Mar 30, 2026

Quality Gate passed

Uh oh!

DimitriosNaikopoulos Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

ajaskolski Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

ajaskolski Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

ajaskolski Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

AnieeG commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

AnieeG commented Mar 30, 2026 •

edited

Loading

changeset-bot Bot commented Mar 30, 2026 •

edited

Loading