From a4bcde98b0e140145937953164de0766095a2783 Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Sun, 23 Aug 2026 02:31:06 +0700
Subject: [PATCH 1/5] fix: use public Testnet RPC for BENS

---
 .github/scripts/tests/test_validate_testnet_bens.py | 10 +++-------
 .github/workflows/dependency-build.yml              |  2 +-
 .github/workflows/deploy-config.yml                 |  2 +-
 docker-compose/bens/config.template.json            |  2 +-
 docker-compose/docker-compose-testnet.yml           |  2 +-
 scripts/validate-testnet-bens.py                    | 13 +++++--------
 6 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/.github/scripts/tests/test_validate_testnet_bens.py b/.github/scripts/tests/test_validate_testnet_bens.py
index bcb4fea8d4c..506af39c41a 100644
--- a/.github/scripts/tests/test_validate_testnet_bens.py
+++ b/.github/scripts/tests/test_validate_testnet_bens.py
@@ -54,10 +54,6 @@ def test_bens_database_password_is_not_hardcoded(self):
 
     def test_bens_uses_canonical_testnet_rpcs(self):
         public_rpc = "https://test.doschain.com/"
-        internal_rpc = (
-            "http://10.148.0.7:9650/ext/bc/"
-            "JASJZyVTWR7aviy4eY5yE8AVfdXtH33c1AinvzhLcVBARhcm9/rpc"
-        )
         template = json.loads(
             (ROOT / "docker-compose" / "bens" / "config.template.json").read_text(
                 encoding="utf-8"
@@ -72,11 +68,11 @@ def test_bens_uses_canonical_testnet_rpcs(self):
         retry_script = RPC_RETRY_SCRIPT.read_text(encoding="utf-8")
 
         self.assertEqual(
-            internal_rpc,
+            public_rpc,
             template["subgraphs_reader"]["networks"]["3939"]["rpc_url"],
         )
-        self.assertIn(f"ethereum: dos-testnet:{internal_rpc}", compose)
-        self.assertNotIn("ethereum: dos-testnet:https://test.doschain.com/", compose)
+        self.assertIn(f"ethereum: dos-testnet:{public_rpc}", compose)
+        self.assertNotIn("ethereum: dos-testnet:http://10.148.0.7:9650/", compose)
         bytecode_gate = workflow.split('contract_code="$(\n', 1)[1].split(
             'if [ "${contract_code}"', 1
         )[0]
diff --git a/.github/workflows/dependency-build.yml b/.github/workflows/dependency-build.yml
index 623f26b4884..ab11ad6cfe1 100644
--- a/.github/workflows/dependency-build.yml
+++ b/.github/workflows/dependency-build.yml
@@ -53,7 +53,7 @@ env:
   ELIXIR_VERSION: "1.19.4"
   MIX_ENV: prod
   DOS_NAMES_REPOSITORY: https://github.com/DOS/DOS-Names-Contracts.git
-  DOS_NAMES_SUBGRAPH_REF: 6224395661280a739c20ebd8a420913a0dd7fd6e
+  DOS_NAMES_SUBGRAPH_REF: 130d42ae22881896cab89e33c3c3c096b9b8e989
   AA_SOURCE_REPOSITORY: https://github.com/eth-infinitism/account-abstraction.git
   AA_SOURCE_REF: 4cbc06072cdc19fd60f285c5997f4f7f57a588de
 
diff --git a/.github/workflows/deploy-config.yml b/.github/workflows/deploy-config.yml
index 0f7958a7fda..3031badb448 100644
--- a/.github/workflows/deploy-config.yml
+++ b/.github/workflows/deploy-config.yml
@@ -64,7 +64,7 @@ env:
   GCP_TESTNET_ZONE: asia-southeast1-a
   GCP_TESTNET_INSTANCE: dos-testnet-r0
   DOS_NAMES_REPOSITORY: https://github.com/DOS/DOS-Names-Contracts.git
-  DOS_NAMES_SUBGRAPH_REF: 6224395661280a739c20ebd8a420913a0dd7fd6e
+  DOS_NAMES_SUBGRAPH_REF: 130d42ae22881896cab89e33c3c3c096b9b8e989
 
 jobs:
   deploy-mainnet:
diff --git a/docker-compose/bens/config.template.json b/docker-compose/bens/config.template.json
index 1496f347ed7..f97335299a7 100644
--- a/docker-compose/bens/config.template.json
+++ b/docker-compose/bens/config.template.json
@@ -8,7 +8,7 @@
           "url": "http://backend:4000"
         },
         "use_protocols": ["dos-names"],
-        "rpc_url": "http://10.148.0.7:9650/ext/bc/JASJZyVTWR7aviy4eY5yE8AVfdXtH33c1AinvzhLcVBARhcm9/rpc"
+        "rpc_url": "https://test.doschain.com/"
       }
     },
     "protocols": {
diff --git a/docker-compose/docker-compose-testnet.yml b/docker-compose/docker-compose-testnet.yml
index ca80674a364..7757493df76 100644
--- a/docker-compose/docker-compose-testnet.yml
+++ b/docker-compose/docker-compose-testnet.yml
@@ -91,7 +91,7 @@ services:
       postgres_user: graph-node
       postgres_db: graph-node
       ipfs: bens-ipfs:5001
-      ethereum: dos-testnet:http://10.148.0.7:9650/ext/bc/JASJZyVTWR7aviy4eY5yE8AVfdXtH33c1AinvzhLcVBARhcm9/rpc
+      ethereum: dos-testnet:https://test.doschain.com/
       GRAPH_LOG: info
 
   bens:
diff --git a/scripts/validate-testnet-bens.py b/scripts/validate-testnet-bens.py
index 4ba30f5a8a1..5bd3c695a4f 100644
--- a/scripts/validate-testnet-bens.py
+++ b/scripts/validate-testnet-bens.py
@@ -21,10 +21,7 @@
 SUBGRAPH_DEPLOY_SCRIPT = ROOT / "docker-compose" / "bens" / "deploy-subgraph.sh"
 CANONICAL_TESTNET_BLOCKCHAIN = "JASJZyVTWR7aviy4eY5yE8AVfdXtH33c1AinvzhLcVBARhcm9"
 RETIRED_TESTNET_BLOCKCHAIN = "2EhCz8u48mSCUzxEEGsqY7d1PnqUKkc2B1zkTQaJxbT99wshkJ"
-CANONICAL_TESTNET_INTERNAL_RPC = (
-    "http://10.148.0.7:9650/ext/bc/"
-    f"{CANONICAL_TESTNET_BLOCKCHAIN}/rpc"
-)
+CANONICAL_TESTNET_BENS_RPC = "https://test.doschain.com/"
 CANONICAL_BLOCKSCOUT_DB = "blockscout_jasj_20260809"
 
 
@@ -88,8 +85,8 @@ def validate() -> list[str]:
         )
     if caddy.count('X-DOS-RPC-Origin "dos-testnet-r0-JASJZyVT"') != 2:
         errors.append("Caddy must identify both canonical Testnet RPC routes")
-    if f"ethereum: dos-testnet:{CANONICAL_TESTNET_INTERNAL_RPC}" not in compose:
-        errors.append("Graph Node must bootstrap from the canonical internal Testnet RPC")
+    if f"ethereum: dos-testnet:{CANONICAL_TESTNET_BENS_RPC}" not in compose:
+        errors.append("Graph Node must bootstrap from the canonical public Testnet RPC")
 
     canonical_database_url = (
         f"postgresql://postgres:@db:5432/{CANONICAL_BLOCKSCOUT_DB}"
@@ -190,8 +187,8 @@ def validate() -> list[str]:
         errors.append("ENSv2 token IDs must not use the ENSv1 native NFT mapping")
     if networks.get("3939", {}).get("use_protocols") != ["dos-names"]:
         errors.append("BENS network 3939 must enable only dos-names")
-    if networks.get("3939", {}).get("rpc_url") != CANONICAL_TESTNET_INTERNAL_RPC:
-        errors.append("BENS must use the canonical internal Testnet RPC")
+    if networks.get("3939", {}).get("rpc_url") != CANONICAL_TESTNET_BENS_RPC:
+        errors.append("BENS must use the canonical public Testnet RPC")
 
     ref_match = re.search(r"DOS_NAMES_SUBGRAPH_REF: ([0-9a-f]{40})", workflow)
     if ref_match is None:

From 09eba6fedce5c4dbd4130cbf5a43bcd564b9f9e9 Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Sun, 23 Aug 2026 02:35:15 +0700
Subject: [PATCH 2/5] fix: limit config deploys by environment

---
 .../tests/test_validate_testnet_bens.py       | 18 +++++++
 .github/workflows/deploy-config.yml           | 50 +++++++++++++++++--
 2 files changed, 63 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/tests/test_validate_testnet_bens.py b/.github/scripts/tests/test_validate_testnet_bens.py
index 506af39c41a..ce702d4f520 100644
--- a/.github/scripts/tests/test_validate_testnet_bens.py
+++ b/.github/scripts/tests/test_validate_testnet_bens.py
@@ -150,6 +150,24 @@ def test_account_abstraction_uses_the_canonical_blockscout_database(self):
         )
         self.assertNotIn("pg_dump -U postgres -Fc blockscout", testnet_deploy)
 
+    def test_push_deploys_only_affected_environment(self):
+        workflow = (
+            ROOT / ".github" / "workflows" / "deploy-config.yml"
+        ).read_text(encoding="utf-8")
+        mainnet_job = workflow.split("  deploy-mainnet:", 1)[1].split(
+            "\n  deploy-testnet:", 1
+        )[0]
+        testnet_job = workflow.split("  deploy-testnet:", 1)[1].split(
+            "\n  deploy-beta:", 1
+        )[0]
+
+        self.assertIn("github.event.commits.*.modified", mainnet_job)
+        self.assertIn("docker-compose/docker-compose-mainnet.yml", mainnet_job)
+        self.assertIn("github.event.commits.*.modified", testnet_job)
+        self.assertIn("docker-compose/docker-compose-testnet.yml", testnet_job)
+        self.assertIn("docker-compose/bens/config.template.json", testnet_job)
+        self.assertNotIn("docker-compose/bens/config.template.json", mainnet_job)
+
     def test_deployment_builds_and_verifies_immutable_account_abstraction_sources(
         self,
     ):
diff --git a/.github/workflows/deploy-config.yml b/.github/workflows/deploy-config.yml
index 3031badb448..79a0c4ff948 100644
--- a/.github/workflows/deploy-config.yml
+++ b/.github/workflows/deploy-config.yml
@@ -70,8 +70,29 @@ jobs:
   deploy-mainnet:
     if: >
       github.ref == 'refs/heads/main' &&
-      (github.event_name == 'push' ||
-      (github.event_name == 'workflow_dispatch' && inputs.environment == 'mainnet'))
+      ((github.event_name == 'workflow_dispatch' && inputs.environment == 'mainnet') ||
+      (github.event_name == 'push' &&
+      (contains(github.event.commits.*.modified, 'docker-compose/docker-compose-mainnet.yml') ||
+      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-mainnet') ||
+      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-edge') ||
+      contains(github.event.commits.*.modified, 'docker-compose/bens/config.mainnet.template.json') ||
+      contains(github.event.commits.*.modified, 'docker-compose/bens/deploy-subgraph.sh') ||
+      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-chains.json') ||
+      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-bridges.json') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout-mainnet.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend-scan.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-smart-contract-verifier.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-visualizer.env') ||
+      contains(github.event.commits.*.modified, 'scripts/validate-blockscout-env-parity.py') ||
+      contains(github.event.commits.*.modified, 'scripts/render-mainnet-bens.py') ||
+      contains(github.event.commits.*.modified, '.github/scripts/mainnet-bens-runtime.sh') ||
+      contains(github.event.commits.*.modified, '.github/scripts/mainnet-bens-ui.spec.mjs') ||
+      contains(github.event.commits.*.modified, '.github/scripts/mainnet-aa-source-ui.spec.mjs') ||
+      contains(github.event.commits.*.modified, '.github/scripts/prepare-mainnet-aa-verification.sh') ||
+      contains(github.event.commits.*.modified, '.github/scripts/verify-mainnet-aa-bytecode.mjs') ||
+      contains(github.event.commits.*.modified, '.github/scripts/verify-mainnet-aa-sources.sh'))))
     runs-on: ubuntu-latest
     environment: mainnet
     env:
@@ -758,9 +779,28 @@ jobs:
   deploy-testnet:
     if: >
       github.ref == 'refs/heads/main' &&
-      (github.event_name == 'push' ||
-      (github.event_name == 'workflow_dispatch' && inputs.environment == 'testnet')
-      )
+      ((github.event_name == 'workflow_dispatch' && inputs.environment == 'testnet') ||
+      (github.event_name == 'push' &&
+      (contains(github.event.commits.*.modified, 'docker-compose/docker-compose-testnet.yml') ||
+      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-testnet') ||
+      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-edge') ||
+      contains(github.event.commits.*.modified, 'docker-compose/bens/config.template.json') ||
+      contains(github.event.commits.*.modified, 'docker-compose/bens/deploy-subgraph.sh') ||
+      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-chains.json') ||
+      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-bridges.json') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout-testnet.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend-scan.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend-testnet.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-smart-contract-verifier.env') ||
+      contains(github.event.commits.*.modified, 'docker-compose/envs/common-visualizer.env') ||
+      contains(github.event.commits.*.modified, 'scripts/validate-blockscout-env-parity.py') ||
+      contains(github.event.commits.*.modified, 'scripts/render-testnet-bens.py') ||
+      contains(github.event.commits.*.modified, 'scripts/validate-testnet-bens.py') ||
+      contains(github.event.commits.*.modified, '.github/scripts/extract-aa-verification-inputs.mjs') ||
+      contains(github.event.commits.*.modified, '.github/scripts/testnet-bens-ui.spec.mjs') ||
+      contains(github.event.commits.*.modified, '.github/scripts/verify-testnet-aa-sources.sh'))))
     runs-on: ubuntu-latest
     environment: testnet
     env:

From afb2278e2cec2c5d866f55229fae2dfaba44bf15 Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Sun, 23 Aug 2026 02:41:11 +0700
Subject: [PATCH 3/5] fix: select config deploy targets from diff

---
 .../tests/test_validate_testnet_bens.py       |  21 +++-
 .github/workflows/deploy-config.yml           | 105 +++++++++---------
 2 files changed, 70 insertions(+), 56 deletions(-)

diff --git a/.github/scripts/tests/test_validate_testnet_bens.py b/.github/scripts/tests/test_validate_testnet_bens.py
index ce702d4f520..4a628d24ce5 100644
--- a/.github/scripts/tests/test_validate_testnet_bens.py
+++ b/.github/scripts/tests/test_validate_testnet_bens.py
@@ -154,6 +154,9 @@ def test_push_deploys_only_affected_environment(self):
         workflow = (
             ROOT / ".github" / "workflows" / "deploy-config.yml"
         ).read_text(encoding="utf-8")
+        changes_job = workflow.split("  changes:", 1)[1].split(
+            "\n  deploy-mainnet:", 1
+        )[0]
         mainnet_job = workflow.split("  deploy-mainnet:", 1)[1].split(
             "\n  deploy-testnet:", 1
         )[0]
@@ -161,12 +164,18 @@ def test_push_deploys_only_affected_environment(self):
             "\n  deploy-beta:", 1
         )[0]
 
-        self.assertIn("github.event.commits.*.modified", mainnet_job)
-        self.assertIn("docker-compose/docker-compose-mainnet.yml", mainnet_job)
-        self.assertIn("github.event.commits.*.modified", testnet_job)
-        self.assertIn("docker-compose/docker-compose-testnet.yml", testnet_job)
-        self.assertIn("docker-compose/bens/config.template.json", testnet_job)
-        self.assertNotIn("docker-compose/bens/config.template.json", mainnet_job)
+        self.assertIn("needs: changes", mainnet_job)
+        self.assertIn("needs.changes.outputs.mainnet == 'true'", mainnet_job)
+        self.assertIn("needs: changes", testnet_job)
+        self.assertIn("needs.changes.outputs.testnet == 'true'", testnet_job)
+        self.assertIn("fetch-depth: 0", changes_job)
+        self.assertIn("${{ github.event.before }}", changes_job)
+        self.assertIn('git diff --name-only "${before}" "${GITHUB_SHA}"', changes_job)
+        self.assertIn("docker-compose/docker-compose-mainnet.yml", changes_job)
+        self.assertIn("docker-compose/docker-compose-testnet.yml", changes_job)
+        self.assertIn("docker-compose/bens/config.template.json", changes_job)
+        self.assertIn("mainnet=true", changes_job)
+        self.assertIn("testnet=true", changes_job)
 
     def test_deployment_builds_and_verifies_immutable_account_abstraction_sources(
         self,
diff --git a/.github/workflows/deploy-config.yml b/.github/workflows/deploy-config.yml
index 79a0c4ff948..cd0c9c0b1c5 100644
--- a/.github/workflows/deploy-config.yml
+++ b/.github/workflows/deploy-config.yml
@@ -35,7 +35,6 @@ on:
       - ".github/scripts/verify-mainnet-aa-bytecode.mjs"
       - ".github/scripts/verify-mainnet-aa-sources.sh"
       - ".github/scripts/verify-testnet-aa-sources.sh"
-      - ".github/workflows/deploy-config.yml"
   workflow_dispatch:
     inputs:
       environment:
@@ -67,32 +66,60 @@ env:
   DOS_NAMES_SUBGRAPH_REF: 130d42ae22881896cab89e33c3c3c096b9b8e989
 
 jobs:
+  changes:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    outputs:
+      mainnet: ${{ steps.targets.outputs.mainnet }}
+      testnet: ${{ steps.targets.outputs.testnet }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - id: targets
+        shell: bash
+        run: |
+          set -euo pipefail
+          mainnet=false
+          testnet=false
+
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ inputs.environment }}" in
+              mainnet) mainnet=true ;;
+              testnet) testnet=true ;;
+            esac
+          else
+            before="${{ github.event.before }}"
+            if [[ "${before}" =~ ^0+$ ]]; then
+              changed_files="$(git diff-tree --no-commit-id --name-only -r "${GITHUB_SHA}")"
+            else
+              changed_files="$(git diff --name-only "${before}" "${GITHUB_SHA}")"
+            fi
+
+            printf '%s\n' "${changed_files}"
+            while IFS= read -r file; do
+              case "${file}" in
+                docker-compose/docker-compose-mainnet.yml|docker-compose/docker-compose-gcp-edge.yml|docker-compose/docker-compose-gcp-edge.override.yml|docker-compose/Caddyfile-gcp-mainnet|docker-compose/Caddyfile-gcp-edge|docker-compose/bens/config.mainnet.template.json|docker-compose/configs/interchain-indexer-chains.json|docker-compose/configs/interchain-indexer-bridges.json|docker-compose/envs/common-blockscout-mainnet.env|docker-compose/envs/common-frontend-scan.env|scripts/render-mainnet-bens.py|.github/scripts/extract-mainnet-aa-verification-inputs.mjs|.github/scripts/mainnet-aa-solc/*|.github/scripts/mainnet-bens-runtime.sh|.github/scripts/mainnet-bens-ui.spec.mjs|.github/scripts/mainnet-aa-source-ui.spec.mjs|.github/scripts/prepare-mainnet-aa-verification.sh|.github/scripts/verify-mainnet-aa-bytecode.mjs|.github/scripts/verify-mainnet-aa-sources.sh)
+                  mainnet=true
+                  ;;
+                docker-compose/docker-compose-testnet.yml|docker-compose/Caddyfile-gcp-testnet|docker-compose/bens/config.template.json|docker-compose/envs/common-blockscout-testnet.env|docker-compose/envs/common-frontend-testnet.env|scripts/render-testnet-bens.py|scripts/validate-testnet-bens.py|.github/scripts/extract-aa-verification-inputs.mjs|.github/scripts/testnet-bens-ui.spec.mjs|.github/scripts/verify-testnet-aa-sources.sh)
+                  testnet=true
+                  ;;
+                docker-compose/bens/*|docker-compose/envs/common-blockscout.env|docker-compose/envs/common-frontend.env|docker-compose/envs/common-smart-contract-verifier.env|docker-compose/envs/common-visualizer.env|scripts/validate-blockscout-env-parity.py)
+                  mainnet=true
+                  testnet=true
+                  ;;
+              esac
+            done <<< "${changed_files}"
+          fi
+
+          echo "mainnet=${mainnet}" >> "${GITHUB_OUTPUT}"
+          echo "testnet=${testnet}" >> "${GITHUB_OUTPUT}"
+
   deploy-mainnet:
-    if: >
-      github.ref == 'refs/heads/main' &&
-      ((github.event_name == 'workflow_dispatch' && inputs.environment == 'mainnet') ||
-      (github.event_name == 'push' &&
-      (contains(github.event.commits.*.modified, 'docker-compose/docker-compose-mainnet.yml') ||
-      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-mainnet') ||
-      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-edge') ||
-      contains(github.event.commits.*.modified, 'docker-compose/bens/config.mainnet.template.json') ||
-      contains(github.event.commits.*.modified, 'docker-compose/bens/deploy-subgraph.sh') ||
-      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-chains.json') ||
-      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-bridges.json') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout-mainnet.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend-scan.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-smart-contract-verifier.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-visualizer.env') ||
-      contains(github.event.commits.*.modified, 'scripts/validate-blockscout-env-parity.py') ||
-      contains(github.event.commits.*.modified, 'scripts/render-mainnet-bens.py') ||
-      contains(github.event.commits.*.modified, '.github/scripts/mainnet-bens-runtime.sh') ||
-      contains(github.event.commits.*.modified, '.github/scripts/mainnet-bens-ui.spec.mjs') ||
-      contains(github.event.commits.*.modified, '.github/scripts/mainnet-aa-source-ui.spec.mjs') ||
-      contains(github.event.commits.*.modified, '.github/scripts/prepare-mainnet-aa-verification.sh') ||
-      contains(github.event.commits.*.modified, '.github/scripts/verify-mainnet-aa-bytecode.mjs') ||
-      contains(github.event.commits.*.modified, '.github/scripts/verify-mainnet-aa-sources.sh'))))
+    needs: changes
+    if: needs.changes.outputs.mainnet == 'true'
     runs-on: ubuntu-latest
     environment: mainnet
     env:
@@ -777,30 +804,8 @@ jobs:
             --reporter=line
 
   deploy-testnet:
-    if: >
-      github.ref == 'refs/heads/main' &&
-      ((github.event_name == 'workflow_dispatch' && inputs.environment == 'testnet') ||
-      (github.event_name == 'push' &&
-      (contains(github.event.commits.*.modified, 'docker-compose/docker-compose-testnet.yml') ||
-      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-testnet') ||
-      contains(github.event.commits.*.modified, 'docker-compose/Caddyfile-gcp-edge') ||
-      contains(github.event.commits.*.modified, 'docker-compose/bens/config.template.json') ||
-      contains(github.event.commits.*.modified, 'docker-compose/bens/deploy-subgraph.sh') ||
-      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-chains.json') ||
-      contains(github.event.commits.*.modified, 'docker-compose/configs/interchain-indexer-bridges.json') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-blockscout-testnet.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend-scan.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-frontend-testnet.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-smart-contract-verifier.env') ||
-      contains(github.event.commits.*.modified, 'docker-compose/envs/common-visualizer.env') ||
-      contains(github.event.commits.*.modified, 'scripts/validate-blockscout-env-parity.py') ||
-      contains(github.event.commits.*.modified, 'scripts/render-testnet-bens.py') ||
-      contains(github.event.commits.*.modified, 'scripts/validate-testnet-bens.py') ||
-      contains(github.event.commits.*.modified, '.github/scripts/extract-aa-verification-inputs.mjs') ||
-      contains(github.event.commits.*.modified, '.github/scripts/testnet-bens-ui.spec.mjs') ||
-      contains(github.event.commits.*.modified, '.github/scripts/verify-testnet-aa-sources.sh'))))
+    needs: changes
+    if: needs.changes.outputs.testnet == 'true'
     runs-on: ubuntu-latest
     environment: testnet
     env:

From 61c7a0c0849390c6f36658a4fec6f5e0ecd9db3a Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Sun, 23 Aug 2026 02:42:46 +0700
Subject: [PATCH 4/5] fix: handle initial config deployment push

---
 .github/scripts/tests/test_validate_testnet_bens.py | 2 ++
 .github/workflows/deploy-config.yml                 | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/tests/test_validate_testnet_bens.py b/.github/scripts/tests/test_validate_testnet_bens.py
index 4a628d24ce5..304268464ea 100644
--- a/.github/scripts/tests/test_validate_testnet_bens.py
+++ b/.github/scripts/tests/test_validate_testnet_bens.py
@@ -170,6 +170,8 @@ def test_push_deploys_only_affected_environment(self):
         self.assertIn("needs.changes.outputs.testnet == 'true'", testnet_job)
         self.assertIn("fetch-depth: 0", changes_job)
         self.assertIn("${{ github.event.before }}", changes_job)
+        self.assertIn('git hash-object -t tree /dev/null', changes_job)
+        self.assertIn('git diff --name-only "${empty_tree}" "${GITHUB_SHA}"', changes_job)
         self.assertIn('git diff --name-only "${before}" "${GITHUB_SHA}"', changes_job)
         self.assertIn("docker-compose/docker-compose-mainnet.yml", changes_job)
         self.assertIn("docker-compose/docker-compose-testnet.yml", changes_job)
diff --git a/.github/workflows/deploy-config.yml b/.github/workflows/deploy-config.yml
index cd0c9c0b1c5..d455a5246d6 100644
--- a/.github/workflows/deploy-config.yml
+++ b/.github/workflows/deploy-config.yml
@@ -92,7 +92,8 @@ jobs:
           else
             before="${{ github.event.before }}"
             if [[ "${before}" =~ ^0+$ ]]; then
-              changed_files="$(git diff-tree --no-commit-id --name-only -r "${GITHUB_SHA}")"
+              empty_tree="$(git hash-object -t tree /dev/null)"
+              changed_files="$(git diff --name-only "${empty_tree}" "${GITHUB_SHA}")"
             else
               changed_files="$(git diff --name-only "${before}" "${GITHUB_SHA}")"
             fi

From 8ce63afd8afaf3cc0684159112652d2b76bba7d8 Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Sun, 23 Aug 2026 02:45:48 +0700
Subject: [PATCH 5/5] fix: scope subgraph deploy pins by network

---
 .../tests/test_validate_testnet_bens.py       |  7 +++--
 .github/workflows/deploy-config.yml           | 30 ++++++++++++-------
 scripts/validate-testnet-bens.py              |  2 +-
 3 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/.github/scripts/tests/test_validate_testnet_bens.py b/.github/scripts/tests/test_validate_testnet_bens.py
index 304268464ea..87761a30951 100644
--- a/.github/scripts/tests/test_validate_testnet_bens.py
+++ b/.github/scripts/tests/test_validate_testnet_bens.py
@@ -171,11 +171,12 @@ def test_push_deploys_only_affected_environment(self):
         self.assertIn("fetch-depth: 0", changes_job)
         self.assertIn("${{ github.event.before }}", changes_job)
         self.assertIn('git hash-object -t tree /dev/null', changes_job)
-        self.assertIn('git diff --name-only "${empty_tree}" "${GITHUB_SHA}"', changes_job)
-        self.assertIn('git diff --name-only "${before}" "${GITHUB_SHA}"', changes_job)
+        self.assertIn('git diff --name-only "${diff_base}" "${GITHUB_SHA}"', changes_job)
         self.assertIn("docker-compose/docker-compose-mainnet.yml", changes_job)
         self.assertIn("docker-compose/docker-compose-testnet.yml", changes_job)
         self.assertIn("docker-compose/bens/config.template.json", changes_job)
+        self.assertIn("DOS_NAMES_MAINNET_SUBGRAPH_REF", changes_job)
+        self.assertIn("DOS_NAMES_TESTNET_SUBGRAPH_REF", changes_job)
         self.assertIn("mainnet=true", changes_job)
         self.assertIn("testnet=true", changes_job)
 
@@ -546,7 +547,7 @@ def test_deployment_fetches_an_immutable_dos_names_revision(self):
 
         self.assertRegex(
             workflow,
-            r"DOS_NAMES_SUBGRAPH_REF: [0-9a-f]{40}",
+            r"DOS_NAMES_TESTNET_SUBGRAPH_REF: [0-9a-f]{40}",
         )
         self.assertIn(
             "https://github.com/DOS/DOS-Names-Contracts.git",
diff --git a/.github/workflows/deploy-config.yml b/.github/workflows/deploy-config.yml
index d455a5246d6..e2378d79c3b 100644
--- a/.github/workflows/deploy-config.yml
+++ b/.github/workflows/deploy-config.yml
@@ -35,6 +35,7 @@ on:
       - ".github/scripts/verify-mainnet-aa-bytecode.mjs"
       - ".github/scripts/verify-mainnet-aa-sources.sh"
       - ".github/scripts/verify-testnet-aa-sources.sh"
+      - ".github/workflows/deploy-config.yml"
   workflow_dispatch:
     inputs:
       environment:
@@ -63,7 +64,8 @@ env:
   GCP_TESTNET_ZONE: asia-southeast1-a
   GCP_TESTNET_INSTANCE: dos-testnet-r0
   DOS_NAMES_REPOSITORY: https://github.com/DOS/DOS-Names-Contracts.git
-  DOS_NAMES_SUBGRAPH_REF: 130d42ae22881896cab89e33c3c3c096b9b8e989
+  DOS_NAMES_MAINNET_SUBGRAPH_REF: 6224395661280a739c20ebd8a420913a0dd7fd6e
+  DOS_NAMES_TESTNET_SUBGRAPH_REF: 130d42ae22881896cab89e33c3c3c096b9b8e989
 
 jobs:
   changes:
@@ -92,11 +94,11 @@ jobs:
           else
             before="${{ github.event.before }}"
             if [[ "${before}" =~ ^0+$ ]]; then
-              empty_tree="$(git hash-object -t tree /dev/null)"
-              changed_files="$(git diff --name-only "${empty_tree}" "${GITHUB_SHA}")"
+              diff_base="$(git hash-object -t tree /dev/null)"
             else
-              changed_files="$(git diff --name-only "${before}" "${GITHUB_SHA}")"
+              diff_base="${before}"
             fi
+            changed_files="$(git diff --name-only "${diff_base}" "${GITHUB_SHA}")"
 
             printf '%s\n' "${changed_files}"
             while IFS= read -r file; do
@@ -113,6 +115,14 @@ jobs:
                   ;;
               esac
             done <<< "${changed_files}"
+
+            workflow_diff="$(git diff --unified=0 "${diff_base}" "${GITHUB_SHA}" -- .github/workflows/deploy-config.yml)"
+            if grep -Eq '^[+-]  DOS_NAMES_MAINNET_SUBGRAPH_REF:' <<< "${workflow_diff}"; then
+              mainnet=true
+            fi
+            if grep -Eq '^[+-]  DOS_NAMES_TESTNET_SUBGRAPH_REF:' <<< "${workflow_diff}"; then
+              testnet=true
+            fi
           fi
 
           echo "mainnet=${mainnet}" >> "${GITHUB_OUTPUT}"
@@ -203,9 +213,9 @@ jobs:
           git -C "${checkout}" fetch --filter=blob:none origin \
             refs/heads/dos:refs/remotes/origin/dos
           git -C "${checkout}" merge-base --is-ancestor \
-            "${DOS_NAMES_SUBGRAPH_REF}" refs/remotes/origin/dos
-          git -C "${checkout}" checkout --detach -q "${DOS_NAMES_SUBGRAPH_REF}"
-          [ "$(git -C "${checkout}" rev-parse HEAD)" = "${DOS_NAMES_SUBGRAPH_REF}" ]
+            "${DOS_NAMES_MAINNET_SUBGRAPH_REF}" refs/remotes/origin/dos
+          git -C "${checkout}" checkout --detach -q "${DOS_NAMES_MAINNET_SUBGRAPH_REF}"
+          [ "$(git -C "${checkout}" rev-parse HEAD)" = "${DOS_NAMES_MAINNET_SUBGRAPH_REF}" ]
           test -f "${checkout}/subgraph/dos-names/subgraph.template.yaml"
           test -f "${checkout}/contracts/deployments/dos-mainnet-7979.json"
           cp -a "${checkout}/subgraph/dos-names" docker-compose/bens/subgraph
@@ -871,9 +881,9 @@ jobs:
           git -C "${checkout}" fetch --filter=blob:none origin \
             refs/heads/dos:refs/remotes/origin/dos
           git -C "${checkout}" merge-base --is-ancestor \
-            "${DOS_NAMES_SUBGRAPH_REF}" refs/remotes/origin/dos
-          git -C "${checkout}" checkout --detach -q "${DOS_NAMES_SUBGRAPH_REF}"
-          [ "$(git -C "${checkout}" rev-parse HEAD)" = "${DOS_NAMES_SUBGRAPH_REF}" ]
+            "${DOS_NAMES_TESTNET_SUBGRAPH_REF}" refs/remotes/origin/dos
+          git -C "${checkout}" checkout --detach -q "${DOS_NAMES_TESTNET_SUBGRAPH_REF}"
+          [ "$(git -C "${checkout}" rev-parse HEAD)" = "${DOS_NAMES_TESTNET_SUBGRAPH_REF}" ]
           test -f "${checkout}/subgraph/dos-names/subgraph.template.yaml"
           test -f "${checkout}/contracts/deployments/dos-testnet-3939.json"
           cp -a "${checkout}/subgraph/dos-names" docker-compose/bens/subgraph
diff --git a/scripts/validate-testnet-bens.py b/scripts/validate-testnet-bens.py
index 5bd3c695a4f..a8b4fc282a1 100644
--- a/scripts/validate-testnet-bens.py
+++ b/scripts/validate-testnet-bens.py
@@ -190,7 +190,7 @@ def validate() -> list[str]:
     if networks.get("3939", {}).get("rpc_url") != CANONICAL_TESTNET_BENS_RPC:
         errors.append("BENS must use the canonical public Testnet RPC")
 
-    ref_match = re.search(r"DOS_NAMES_SUBGRAPH_REF: ([0-9a-f]{40})", workflow)
+    ref_match = re.search(r"DOS_NAMES_TESTNET_SUBGRAPH_REF: ([0-9a-f]{40})", workflow)
     if ref_match is None:
         errors.append("The deployment workflow must pin a full DOS Names commit")
     if "https://github.com/DOS/DOS-Names-Contracts.git" not in workflow: