payments-stripe: retrofit into offchain pipeline conventions

.github/actions/coverage/action.yml

@@ -59,8 +59,9 @@ runs:
 
     - name: Generate Coverage
       shell: bash
+      working-directory: offchain
       run: |
-        cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+        cargo llvm-cov --all-features --workspace --lcov --output-path ../lcov.info
       env:
         CARGO_TERM_COLOR: always
         CACHE_ON_FAILURE: true

.github/actions/gcp-auth-infra/action.yml

@@ -0,0 +1,37 @@
+name: Authenticate to GCP (infra project)
+description: Authenticate via workload identity to the GCP project that owns GCR + shared images
+inputs:
+  project-id:
+    description: 'GCP infra project ID'
+    required: true
+  project-number:
+    description: 'GCP infra project number'
+    required: true
+  provider-name:
+    description: 'Workload identity pool provider name (e.g. nexus-tools)'
+    required: true
+outputs:
+  auth_token:
+    description: 'OAuth2 access token for GCR login'
+    value: ${{ steps.auth.outputs.auth_token }}
+runs:
+  using: composite
+  steps:
+    - name: Authenticate
+      id: auth
+      uses: google-github-actions/auth@v2
+      with:
+        project_id: ${{ inputs.project-id }}
+        workload_identity_provider: "projects/${{ inputs.project-number }}/locations/global/workloadIdentityPools/${{ inputs.project-id }}/providers/${{ inputs.provider-name }}"
+        # No service_account / token_format — use Direct WIF.
+        # google-github-actions/auth exposes the federated token via
+        # `auth_token` output, which docker/login-action consumes below.
+        # `token_format: 'access_token'` would require a service_account
+        # to impersonate, which we don't have for this WIF setup.
+
+    - name: Login to GCR
+      uses: docker/login-action@v3
+      with:
+        registry: gcr.io
+        username: oauth2accesstoken
+        password: ${{ steps.auth.outputs.auth_token }}

.github/actions/gcp-auth-protocol/action.yml

@@ -0,0 +1,33 @@
+name: Authenticate to GCP (protocol project)
+description: Authenticate via workload identity to the GCP project that owns GCS + Secret Manager
+inputs:
+  project-id:
+    description: 'GCP project ID'
+    required: true
+  project-number:
+    description: 'GCP project number'
+    required: true
+  provider-name:
+    description: 'Workload identity pool provider name (e.g. nexus-tools)'
+    required: true
+outputs:
+  credentials_file_path:
+    description: 'Path to the generated credentials file'
+    value: ${{ steps.auth.outputs.credentials_file_path }}
+runs:
+  using: composite
+  steps:
+    - name: Authenticate
+      id: auth
+      uses: google-github-actions/auth@v2
+      with:
+        project_id: ${{ inputs.project-id }}
+        workload_identity_provider: "projects/${{ inputs.project-number }}/locations/global/workloadIdentityPools/${{ inputs.project-id }}/providers/${{ inputs.provider-name }}"
+
+    - name: Setup Python (gcloud needs it)
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+
+    - name: Setup Cloud SDK
+      uses: google-github-actions/setup-gcloud@v2

.github/actions/install-nexus-cli/action.yml

@@ -0,0 +1,29 @@
+name: Install Nexus CLI
+description: Extract the nexus CLI from the nexus-sdk shell image
+inputs:
+  nexus-tag:
+    description: 'Tag of gcr.io/.../nexus-sdk/shell to extract from'
+    required: true
+  infra-registry:
+    description: 'Infra GCR registry prefix (e.g. gcr.io/production-tf-talus-infra)'
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Extract nexus binary
+      shell: bash
+      env:
+        NEXUS_TAG: ${{ inputs.nexus-tag }}
+        INFRA_REGISTRY: ${{ inputs.infra-registry }}
+      run: |
+        set -euo pipefail
+        mkdir -p "$HOME/.local/bin"
+        CONTAINER_ID=$(docker create "${INFRA_REGISTRY}/nexus-sdk/shell:${NEXUS_TAG}")
+        docker cp "${CONTAINER_ID}:/usr/local/bin/nexus" "$HOME/.local/bin/nexus"
+        docker rm "${CONTAINER_ID}"
+        chmod +x "$HOME/.local/bin/nexus"
+        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+    - name: Verify
+      shell: bash
+      run: nexus --version

.github/actions/install-sui/action.yml

@@ -0,0 +1,45 @@
+name: Install Sui CLI
+description: Install the Sui CLI from suiup, with cache support
+inputs:
+  sui-channel:
+    description: 'Sui release channel (e.g. testnet, mainnet)'
+    required: true
+  cache-version:
+    description: 'Bump to invalidate the cache'
+    required: false
+    default: 'v1'
+runs:
+  using: composite
+  steps:
+    - name: Cache Sui binary
+      id: cache
+      uses: actions/cache@v4
+      with:
+        path: ~/.local/bin/sui
+        key: sui-${{ runner.os }}-${{ inputs.sui-channel }}-${{ inputs.cache-version }}
+
+    - name: Install suiup and Sui CLI
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        SUI_CHANNEL: ${{ inputs.sui-channel }}
+      run: |
+        set -euo pipefail
+        install_dir="$HOME/.local/bin"
+        temp_dir="$(mktemp -d)"
+        mkdir -p "$install_dir"
+        curl --retry 5 --retry-all-errors -sSfL \
+          -o "$temp_dir/suiup.tar.gz" \
+          https://github.com/MystenLabs/suiup/releases/latest/download/suiup-Linux-musl-x86_64.tar.gz
+        tar -xzf "$temp_dir/suiup.tar.gz" -C "$temp_dir"
+        install -m 0755 "$temp_dir/suiup" "$install_dir/suiup"
+        "$install_dir/suiup" install "sui@$SUI_CHANNEL" -y
+
+    - name: Add Sui to PATH
+      shell: bash
+      run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+    - name: Verify
+      shell: bash
+      run: sui --version

.github/actions/pre-commit/dependencies/action.yml

@@ -20,4 +20,4 @@ runs:
 
     - name: Install NPM stuff from helpers/npm-install-g.txt
       shell: bash
-      run: ./helpers/npm-install-g.sh
+      run: ./offchain/helpers/npm-install-g.sh