Anchor CI/CD: Issues with Program Upgrade and Keypair Management

Question

I've been struggling to understand some things related to Anchor Programs and their Keypairs, and I couldn't find answers to some dilemmas. I'm sorry if they have been discussed already and I searched incorrectly.

When I create an Anchor Program, it generates the ProgramID (hardcoded in lib.rs) for me and stores the keypair on ./target/deploy/<program_name>-keypair.json.

It also generates a .gitignore file ignoring the ./target folder (and the keypair), which is totally fine.

According to this thread, the keypair is used only for deploying the program for the first time. Upgrading a program doesn't require the keypair (as long as I am the Upgrade Authority)

What I'm failing to understand is: as the ./target folder and the keypair are not versioned, when my CI/CD runs anchor build for a change in the program, it's generating a new keypair and anchor deploy is deploying it as a new program instead of upgrading the existing one.

I'm probably missing something regarding upgrading my program in a CI/CD pipeline. If I manually put the generated keypair on ./target/deploy, the anchor build does not override it and the anchor deploy upgrades the program successfully. It also works if I pass --program-keypair keypair.json on the deploy. However I understood that upgrading the program should not rely on the keypair.

Could someone give me a light here, please? :) THanks

Answer 1

Yes, you understand correctly that the problem is related to updating the program in the CI/CD pipeline. The main issue is that every time anchor build is run in the CI/CD pipeline, a new keypair is generated, leading to the deployment of a new program instead of updating the existing one. Here are some steps that can help you resolve this issue:

1. Save the original keypair:

When you first deploy the program, save the program-keypair.json to a secure location accessible by your CI/CD pipeline, such as a secure secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager, or similar).

2. Use the saved keypair for deployment:

Configure your CI/CD pipeline to use the saved keypair when deploying the program. This can be done by passing the path to the keypair using the --program-keypair parameter:

anchor deploy --program-keypair /path/to/saved/keypair.json

3. Use the anchor upgrade command to update the program:

To update an already deployed program, use the anchor upgrade command with the path to the compiled .so file and the Program ID:

anchor upgrade target/deploy/your_program.so --program-id ESxva9jHfqyZDuWdc8c2jz86Nmx4sWz56qoEHLNqwFmX

4. Ensure proper permission setup:

Ensure that your CI/CD pipeline has the necessary permissions to access the saved keypair and that the keypair is protected from unauthorized access.

---

Here is an example of setting up your CI/CD pipeline (using GitHub Actions as an example):

name: Deploy Program

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Set up Node.js
        uses: actions/setup-node@v2
        with:
          node-version: '14'

      - name: Install Anchor
        run: |
          npm install -g @project-serum/anchor-cli

      - name: Set up Solana CLI
        run: |
          sh -c "$(curl -sSfL https://release.solana.com/stable/install)"
          echo "export PATH=/home/runner/.local/share/solana/install/active_release/bin:$PATH" >> $GITHUB_ENV

      - name: Save Keypair
        run: |
          echo "${{ secrets.PROGRAM_KEYPAIR }}" > /tmp/keypair.json

      - name: Build and Upgrade
        run: |
          anchor build
          anchor upgrade target/deploy/your_program.so --program-id ESx3a9jHfqyZuuWZc8c2jz86N4xUsWz56qoEHLNqwFmX
        env:
          ANCHOR_PROVIDER_URL: https://api.devnet.solana.com
          ANCHOR_WALLET: /tmp/keypair.json

In this example, PROGRAM_KEYPAIR is a secret stored in GitHub Secrets containing your original keypair.

I hope this helps solve your problem with updating the program in the CI/CD pipeline. Good luck!