Update GitHub links

.env.example

@@ -1,15 +1,15 @@
 # GENERAL
 
 ## The network used for testing purposes
-NETWORK_NAME="sepolia" #  ["mainnet", "sepolia", "polygon", "polygonMumbai", "base", "baseSepolia", "arbitrum", "arbitrumSepolia"]
+NETWORK_NAME="sepolia" #  ["mainnet", "sepolia", "polygon", "mumbai","baseMainnet", "baseGoerli", "baseSepolia", "arbitrum", "arbitrumSepolia"]
 
 # CONTRACTS
 
 ## One or multiple hex encoded private keys separated by commas `,` replacing the hardhat default accounts.
 PRIVATE_KEY="0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80" # Default hardhat account 0 private key. DON'T USE FOR DEPLOYMENTS
 
-## Infura credentials
-INFURA_API_KEY="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
+## Alchemy RPC endpoint credentials
+ALCHEMY_API_KEY="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
 
 ## Gas Reporting
 REPORT_GAS='true'

.github/pull_request_template.md

@@ -0,0 +1,28 @@
+## Description
+
+Please include a summary of the change and be sure you follow the contributions rules we do provide [here](../CONTRIBUTIONS.md)
+
+Task ID: [OS-?](https://aragonassociation.atlassian.net/browse/OS-?)
+
+## Type of change
+
+See the framework lifecylce in `packages/contracts/docs/framework-lifecycle` to decide what kind of change this pull request is.
+
+<!--- Please delete options that are not relevant. -->
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+
+## Checklist:
+
+- [ ] I have selected the correct base branch.
+- [ ] I have performed a self-review of my own code.
+- [ ] I have commented my code, particularly in hard-to-understand areas.
+- [ ] My changes generate no new warnings.
+- [ ] Any dependent changes have been merged and published in downstream modules.
+- [ ] I ran all tests with success and extended them if necessary.
+- [ ] I have updated the `CHANGELOG.md` file in the root folder.
+- [ ] I have updated the `DEPLOYMENT_CHECKLIST` file in the root folder.
+- [ ] I have updated the `UPDATE_CHECKLIST` file in the root folder.
+- [ ] I have updated the Subgraph and added a QA URL to the description of this PR.

.github/workflows/contracts-tests.yml

@@ -2,7 +2,7 @@ name: 'contracts'
 
 on:
   workflow_dispatch:
-  push:
+  pull_request:
     paths:
       - 'packages/contracts/**'
       - '.github/workflows/contracts-*.yml'
@@ -31,10 +31,10 @@ jobs:
       - name: 'Build the contracts'
         run: 'yarn build'
         env:
-          INFURA_API_KEY: ${{ secrets.INFURA_API_KEY }}
+          ALCHEMY_API_KEY: ${{ secrets.ALCHEMY_API_KEY }}
 
       - name: 'Test the contracts and generate the coverage report'
         run: 'yarn coverage'
         env:
           NETWORK_NAME: ${{ vars.NETWORK_NAME }}
-          INFURA_API_KEY: ${{ secrets.INFURA_API_KEY }}
+          ALCHEMY_API_KEY: ${{ secrets.ALCHEMY_API_KEY }}

.github/workflows/subgraph-tests.yml

@@ -2,7 +2,7 @@ name: 'subgraph'
 
 on:
   workflow_dispatch:
-  push:
+  pull_request:
     paths:
       - 'packages/subgraph/**'
       - 'packages/contracts/**'
@@ -41,7 +41,7 @@ jobs:
         working-directory: packages/subgraph
         env:
           SUBGRAPH_NETWORK_NAME: ${{ vars.SUBGRAPH_NETWORK_NAME }}
-          INFURA_API_KEY: ${{ secrets.INFURA_API_KEY }}
+          ALCHEMY_API_KEY: ${{ secrets.ALCHEMY_API_KEY }}
 
       - name: 'Test the subgraph'
         run: yarn test

CONTRIBUTIONS.md

@@ -0,0 +1,129 @@
+# Contribution Guide
+
+---
+
+Thank you for being interested in contributing to Aragon! 🎉  We’re excited to have you building this vision with us.
+
+There are many ways to contribute! Some ideas are:
+
+- writing tutorials, blog posts or improving the documentation,
+- submitting bug reports,
+- submitting feature requests,
+- refactoring code,
+- or even writing new functionality to incorporate into the project.
+
+All community members are expected to adhere to our community guidelines. Please familiarize yourself with our [Terms and Conditions](https://aragon.org/terms-and-conditions) to ensure a welcoming and friendly environment across all our platforms. Adhering to these principles is essential. 💙
+
+## Your first contribution
+
+Unsure where to begin contributing to Aragon?
+
+You can start with a [Good First Issue](https://github.com/aragon/multisig-plugin/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).
+
+> Good first issues are usually for small features, additional tests, spelling / grammar fixes, formatting changes, or other clean up.
+
+Start small, pick a subject you care about, are familiar with, or want to learn.
+
+If you're not already familiar with git or Github, here are a couple of friendly tutorials: [First Contributions](https://github.com/firstcontributions/first-contributions), [Open Source Guide](https://opensource.guide/), and [How to Contribute to an Open Source Project on GitHub](https://egghead.io/series/how-to-contribute-to-an-open-source-project-on-github).
+
+Otherwise, you can also contribute through improving our documentation. You can find our documentation within the `docs` folder of each of our repositories. If you see something that could be better explained, or if you want to share better resources for each of the topics, we’d love to hear from you. Feel free to either submit a PR directly to the repo or simply [register here](https://aragonteam.typeform.com/to/QJyKtESU) and we’ll reach out.
+
+## How to file an issue or report a bug
+
+If you see a problem, you can report it in our [issue tracker](https://github.com/aragon/multisig-plugin/issues) (or [here](https://aragonteam.typeform.com/to/QJyKtESU)).
+
+Please take a quick look to see if the issue doesn't already exist before filing yours.
+
+Do your best to include as many details as needed in order for someone else to fix the problem and resolve the issue.
+
+Some things that help us better understand:
+
+- Device: which device are you using, which version, how old is it, etc
+- Browser: which browser are you using, which version..
+- Wallet: which wallet do you use to sign transactions
+- Network: which network have you been testing on
+- Logs: any specific transaction error or log that may support us in reviewing the error
+
+### If you find a security vulnerability, do NOT open an issue. Email [[email protected]](mailto:[email protected]) instead.
+
+In order to determine whether you are dealing with a security issue, ask yourself these two questions:
+
+- Can I access or steal something that's not mine, or access something I shouldn't have access to?
+- Can I disable something for other people?
+
+If the answer to either of those two questions are "yes", then you're probably dealing with a security issue. Note that even if you answer "no" to both questions, you may still be dealing with a security issue, so if you're unsure, please send a email.
+
+## Fixing issues
+
+1. [Find an issue](https://github.com/aragon/multisig-plugin/issues) that you are interested in.
+   - You may want to ask on the GitHub issue or in our [developer channel](https://discord.com/channels/672466989217873929/742442842474938478) if anyone has already started working on the issue.
+2. Fork and clone a local copy of the repository.
+3. Make the appropriate changes for the issue you are trying to address or the feature that you want to add.
+4. Push the changes to the remote repository.
+5. Submit a pull request to our repository on Github, explaining any changes and further questions you may have.
+
+   We kindly ask that every PR follows this format and checks all checkboxes.
+
+   ```markdown
+   ## Description
+
+   ## Type of change
+
+   ## Checklist
+
+   [ ] I have selected the correct base branch.
+   [ ] I have performed a self-review of my own code.
+   [ ] I have commented my code, particularly in hard-to-understand areas.
+   [ ] I have made corresponding changes to the documentation.
+   [ ] My changes generate no new warnings.
+   [ ] Any dependent changes have been merged and published in downstream modules.
+   [ ] I ran all tests with success and extended them if necessary.
+   [ ] I have updated the CHANGELOG.md file in the root folder of the package after the [UPCOMING] title and before the latest version.
+   [ ] I have tested my code on the test network.
+   ```
+
+6. Wait for the pull request to be reviewed by the team.
+7. Make adjustments to the pull request if they were requested by the maintainer.
+8. Celebrate your success after your pull request is merged! You will be able to claim your POAP for the hard work and join our Developer Inner Circle community.
+
+**Disclaimer**
+
+It's OK if your pull request is not perfect (no pull request is). The reviewer will be able to help you address any issues and improve it.
+
+### Tips and Tricks
+
+Windows users may need to install the [windows-build-tools](https://www.npmjs.com/package/windows-build-tools) or [Windows Subsystems for Linux](https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux) before installing this project's dependencies.
+
+### Documentation
+
+The documentation on how to run the code locally will be found within the `docs` folder of every repository.
+
+You can also access our [Developer Portal](https://devs.aragon.org) where you’ll learn about our architecture, how it works, and useful tutorials to get you started.
+
+### Style guide and development processes
+
+You can find our documentation [Style Guide here](https://www.notion.so/Documentation-Style-Guide-07c88cec18114b0aac88e8f0ba289976).
+
+For the frontends, we use [prettier](https://prettier.io/) and [eslint](https://eslint.org/) to automatically lint and format the project.
+
+For the contracts, we use [eth-lint](https://github.com/duaraghav8/Ethlint) and [prettier](https://prettier.io/) to automatically lint the project.
+
+For the SDK, we use [Prettier JS/TS formatter](https://prettier.io/docs/en/editors.html).
+
+Handy `npm` scripts (usually `npm run lint`) are provided at all levels to help automate these checks.
+
+We generally avoid adding external dependencies if they can be ported over easily, due to numerous NPM-related security issues in the past (e.g. `[event-stream](https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident)`).
+
+### Git branch convention
+
+Due to the unconventional release process of smart contracts, this repo utilizes a slightly different flow of git.
+
+The main challenge is that smart contracts should be heavily scrutinized before a release, making the process cumbersome and unlike the release process for "normal" dependencies or apps. [See here](https://forum.aragon.org/t/git-branch-convention-for-aragon-repos/298/3) for a more detailed explanation.
+
+Thus, we use the following convention: any change that can be release immediately, base it on the [develop branch](https://github.com/aragon/multisig-plugin/tree/develop).
+
+As `next` becomes ready, merge `next` onto `master` with a rebase.
+
+## Community
+
+If you need help, please reach out to Aragon core contributors and community members in our [Discord](https://discord.gg/aragon-672466989217873929). We'd love to hear from you and know what you're working on!

README.md

@@ -1,44 +1,13 @@
-# Aragon OSX Plugin Template [![Hardhat][hardhat-badge]][hardhat] [![License: AGPL v3][license-badge]][license]
+# Multisig Plugin [![Hardhat][hardhat-badge]][hardhat] [![License: AGPL v3][license-badge]][license]
 
 [hardhat]: https://hardhat.org/
 [hardhat-badge]: https://img.shields.io/badge/Built%20with-Hardhat-FFDB1C.svg
 [license]: https://opensource.org/licenses/AGPL-v3
 [license-badge]: https://img.shields.io/badge/License-AGPL_v3-blue.svg
 
-## Quickstart
-
-After [creating a new repository from this template](https://github.com/new?template_name=osx-plugin-template-hardhat&template_owner=aragon), cloning, and opening it in your IDE, run
-
-```sh
-yarn install && cd packages/contracts && yarn install && yarn build && yarn typechain
-```
-
-Meanwhile, create an `.env` file from the `.env.example` file and put in the API keys for the services that you want to use.
-You can now develop a plugin by changing the `src/MyPlugin.sol` and `src/MyPluginSetup.sol` files. You can directly import contracts from [Aragon OSx](https://github.com/aragon/osx) as well as OpenZeppelin's [openzeppelin-contracts](https://github.com/OpenZeppelin/openzeppelin-contracts) and [openzeppelin-contracts-upgradeable](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable) that are already set up for you.
-
-```sol
-// SPDX-License-Identifier: AGPL-3.0-or-later
-pragma solidity ^0.8.17;
-
-import {IDAO, PluginUUPSUpgradeable} from "@aragon/osx/core/plugin/PluginUUPSUpgradeable.sol";
-import {SafeCastUpgradeable} from '@openzeppelin/contracts-upgradeable/utils/math/SafeCastUpgradeable.sol';
-
-contract MyPlugin is PluginUUPSUpgradeable {
-    //...
-};
-```
-
-The initial `MyPlugin` and `MyPluginSetup` example comes with unit test, integration test, and test helpers in the `package/contracts/test` folder that you can reuse.
-
-To build and test your contracts, run
-
-```sh
-yarn clean && yarn build && yarn test
-```
-
 ## Project
 
-The root folder of the repo includes three subfolders:
+The root folder of the repo includes two subfolders:
 
 ```markdown
 .
@@ -99,7 +68,7 @@ yarn lint
 
 To be able to work on the contracts, make sure that you have created an `.env` file from the `.env.example` file and put in the API keys for
 
-- [Infura](https://www.infura.io/) that we use as the web3 provider
+- [Alchemy](https://www.alchemy.com) that we use as the web3 provider
 - [Alchemy Subgraphs](https://www.alchemy.com/subgraphs) that we use as the subgraph provider
 - the block explorer that you want to use depending on the networks that you want to deploy to
 
@@ -202,22 +171,38 @@ Deploy the contracts to the local Hardhat Network (being forked from the network
 yarn deploy --tags CreateRepo,NewVersion
 ```
 
-This will create a plugin repo and publish the the first version (`v1.1`) of your plugin.
+This will create a plugin repo and publish the first version (`v1.1`) of your plugin.
+By adding the tag `TransferOwnershipToManagmentDao`, the `ROOT_PERMISSION_ID`, `MAINTAINER_PERMISSION_ID`, and
+`UPGRADE_REPO_PERMISSION_ID` are granted to the management DAO and revoked from the deployer.
+You can do this directly
+
+```sh
+yarn deploy --tags CreateRepo,NewVersion,TransferOwnershipToManagmentDao
+```
+
+or at a later point by executing
 
-Deploy the contracts to sepolia with
+```sh
+yarn deploy --tags TransferOwnershipToManagmentDao
+```
+
+To deploy the contracts to a production network use the `--network` option, for example
 
 ```sh
-yarn deploy --network sepolia --tags CreateRepo,NewVersion,Verification
+yarn deploy --network sepolia --tags CreateRepo,NewVersion,TransferOwnershipToManagmentDao,Verification
 ```
 
-This will create a plugin repo, publish the the first version (`v1.1`) of your plugin, and verfiy the contracts on sepolia.
+This will create a plugin repo, publish the first version (`v1.1`) of your plugin, transfer permissions to the
+management DAO, and lastly verfiy the contracts on sepolia.
 
 If you want to deploy a new version of your plugin afterwards (e.g., `1.2`), simply change the `VERSION` entry in the `packages/contracts/plugin-settings.ts` file and use
 
 ```sh
 yarn deploy --network sepolia --tags NewVersion,Verification
 ```
 
+Note, that if the deploying account doesn't own the repo anymore, this will create a `createVersionProposalData-sepolia.json` containing the data for a management DAO signer to create a proposal publishing a new version.
+
 Note, that if you include the `CreateRepo` tag after you've created your plugin repo already, this part of the script will be skipped.
 
 #### Upgrading Your Plugin Repository
@@ -237,6 +222,8 @@ yarn deploy --network sepolia --tags UpgradeRepo
 This will upgrade your plugin repo to the latest Aragon OSx protocol version implementation, which might include new features and security updates.
 **For this to work, make sure that you are using the latest version of [this repository](https://github.com/aragon/osx-plugin-template-hardhat) in your fork.**
 
+Note, that if the deploying account doesn't own the repo anymore, this will create a `upgradeRepoProposalData-sepolia.json` containing the data for a management DAO signer to create a proposal upgrading the repo.
+
 ## Subgraph
 
 ### Installing
@@ -281,6 +268,10 @@ and finally the subgraph itself with
 yarn build:subgraph
 ```
 
+When running `yarn build`, it requires a plugin address, which is obtained from the configuration file located
+at `subgraph/manifest/data/<network>.json`, based on the network specified in your `.env` file under the `SUBGRAPH_NETWORK_NAME` variable.
+You do not need to provide a plugin address for building or testing purposes, but it becomes necessary when deploying the subgraph.
+
 During development of the subgraph, you might want to clean outdated files that were build, imported, and generated. To do this, run
 
 ```sh
@@ -313,7 +304,8 @@ yarn coverage
 
 ### Deployment
 
-To deploy the subgraph to the subgraph provider, write your intended subgraph name and version into the `SUBGRAPH_NAME` and `SUBGRAPH_VERSION` variables [in the `.env` file that you created in the beginning](environment-variables) and pick a network name `SUBGRAPH_NETWORK_NAME` [being supported by the subgraph provider](https://docs.alchemy.com/reference/supported-subgraph-chains). Then run
+To deploy the subgraph to the subgraph provider, write your intended subgraph name and version into the `SUBGRAPH_NAME` and `SUBGRAPH_VERSION` variables [in the `.env` file that you created in the beginning](environment-variables) and pick a network name `SUBGRAPH_NETWORK_NAME` [being supported by the subgraph provider](https://docs.alchemy.com/reference/supported-subgraph-chains). Remember to place correctly the Plugin address on the network you are going to deploy to, you can do that by adding it on `subgraph/manifest/data/<network>.json`.
+Then run
 
 ```sh
 yarn deploy

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@aragon/osx-plugin-template",
+  "name": "@aragon/multisig-plugin",
   "description": "A template to fork from when developing an Aragon OSx plugin",
   "version": "0.0.1-alpha.1",
   "license": "AGPL-3.0-or-later",

packages/contracts/CHANGELOG.md

@@ -0,0 +1,17 @@
+# Multisig Plugin
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to the [Aragon OSx Plugin Versioning Convention](https://devs.aragon.org/docs/osx/how-to-guides/plugin-development/publication/versioning).
+
+## v1.3
+
+### Added
+
+- Copied files from [aragon/osx commit 1130df](https://github.com/aragon/osx/commit/1130dfce94fd294c4341e91a8f3faccc54cf43b7)
+
+### Changed
+
+- Used `ProxyLib` from `osx-commons-contracts` for the minimal proxy deployment in `MultisigSetup`.
+- Hard-coded the `bytes32 internal constant EXECUTE_PERMISSION_ID` constant in `MultisigSetup` until it is available in `PermissionLib`.

packages/contracts/deploy/20_new_version/22_setup_conclude.ts

@@ -1,5 +1,5 @@
 import {PLUGIN_SETUP_CONTRACT_NAME} from '../../plugin-settings';
-import {MyPluginSetup__factory, MyPlugin__factory} from '../../typechain';
+import {MultisigSetup__factory, Multisig__factory} from '../../typechain';
 import {DeployFunction} from 'hardhat-deploy/types';
 import {HardhatRuntimeEnvironment} from 'hardhat/types';
 import path from 'path';
@@ -17,12 +17,12 @@ const func: DeployFunction = async function (hre: HardhatRuntimeEnvironment) {
 
   // Get the plugin setup address
   const setupDeployment = await deployments.get(PLUGIN_SETUP_CONTRACT_NAME);
-  const setup = MyPluginSetup__factory.connect(
+  const setup = MultisigSetup__factory.connect(
     setupDeployment.address,
     deployer
   );
   // Get the plugin implementation address
-  const implementation = MyPlugin__factory.connect(
+  const implementation = Multisig__factory.connect(
     await setup.implementation(),
     deployer
   );