Production hardening: secure deployments and CI validation

.github/workflows/validate.yml

@@ -0,0 +1,33 @@
+name: Validate Contracts
+
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Compile contracts
+        run: npm run compile
+
+      - name: Run tests
+        run: npm test

scripts/deploy.js

@@ -2,11 +2,14 @@
 
 const hre = require("hardhat");
 const fs = require("fs");
+require("dotenv").config();
 
 async function main() {
   const network = hre.network.name;
   const [deployer] = await hre.ethers.getSigners();
 
+  if (!deployer) throw new Error("No deployer wallet configured");
+
   const AgentExecutor = await hre.ethers.getContractFactory("AgentExecutor");
   const executor = await AgentExecutor.deploy();
   await executor.waitForDeployment();
@@ -17,7 +20,7 @@ async function main() {
     network,
     contract: "AgentExecutor",
     address,
-    destination: "0xfd1610f5eae31dd757e55d6b4ba543b80a2720b3",
+    destination: process.env.DESTINATION_ADDRESS || null,
     deployer: deployer.address,
     deployedAt: new Date().toISOString()
   };
@@ -27,11 +30,6 @@ async function main() {
     JSON.stringify(record, null, 2)
   );
 
-  fs.writeFileSync(
-    "agent-deployment-base.json",
-    JSON.stringify(record, null, 2)
-  );
-
   console.log(record);
 }