ci: propose program upgrades via shared Squads action

.github/workflows/propose-program-upgrade.yml

@@ -0,0 +1,50 @@
+name: Propose Program Upgrade
+
+# Builds the VRF program verifiably and opens a Squads proposal that upgrades
+# it and records its otter-verify PDA. Members approve and execute in Squads.
+#
+# Each cluster is a GitHub environment named <cluster>-program-upgrade with:
+#   secrets   RPC_URL, SQUADS_PROPOSER_KEYPAIR (Initiate-only multisig member)
+#   variable  SQUADS_MULTISIG_PDA (multisig whose vault is the upgrade authority)
+
+on:
+  workflow_dispatch:
+    inputs:
+      cluster:
+        description: Target cluster
+        type: choice
+        options: [devnet, mainnet]
+        default: devnet
+      proposal_name:
+        description: Squads proposal memo
+        default: Upgrade VRF program
+      dry_run:
+        description: Build, upload and simulate only; close the buffer without proposing
+        type: boolean
+        default: false
+
+concurrency: program-upgrade-${{ inputs.cluster }}
+
+permissions:
+  contents: read
+
+jobs:
+  propose:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.cluster }}-program-upgrade
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: magicblock-labs/.github/actions/squads-program-upgrade@f230947fd85afe668cbea20b94766252a278cc85
+        with:
+          rpc-url: ${{ secrets.RPC_URL }}
+          proposer-keypair: ${{ secrets.SQUADS_PROPOSER_KEYPAIR }}
+          multisig: ${{ vars.SQUADS_MULTISIG_PDA }}
+          program-id: Vrf1RNUjXmQGjmQrQLvJHs9SNkvDJEsRVFPkfSQUwGz
+          library-name: solana_vrf_program
+          solana-version: v3.1.13
+          proposal-name: ${{ inputs.proposal_name }}
+          dry-run: ${{ inputs.dry_run }}

.github/workflows/verify-program-remote.yml

@@ -0,0 +1,20 @@
+name: Verify Program (Remote)
+
+# Asks OtterSec to rebuild the VRF program from its otter-verify PDA, so
+# explorers show it as verified. Run it after each mainnet upgrade executes.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - uses: magicblock-labs/.github/actions/verify-program-remote@f230947fd85afe668cbea20b94766252a278cc85
+        with:
+          program-id: Vrf1RNUjXmQGjmQrQLvJHs9SNkvDJEsRVFPkfSQUwGz

README.md

@@ -230,6 +230,14 @@ CLI for managing oracles. See all available commands with:
 cargo run --bin vrf-cli -- --help
 ```
 
+## Upgrading the program
+
+Upgrades go through a Squads multisig whose vault holds the upgrade authority. CI only proposes them.
+
+1. Run **Actions → Propose Program Upgrade** with the target `cluster` (start with `dry_run`). It builds the program verifiably, uploads a buffer and opens a Squads proposal that upgrades it and records its verified build.
+2. Members approve and execute it: on mainnet in the [Squads app](https://app.squads.so), on devnet with the [shared command-line tools](https://github.com/magicblock-labs/.github/tree/main/actions/squads-program-upgrade#approving-and-managing-the-multisig-devnet).
+3. **mainnet:** run **Actions → Verify Program (Remote)** so explorers show the program as verified. Every upgrade needs this step again.
+
 ## Example usage
 
 See the [integration test program](program/tests/integration/use-randomness/programs/use-randomness/src/lib.rs) for a minimal program-level example, or the [MagicBlock Engine examples repository](https://github.com/magicblock-labs/magicblock-engine-examples) for full app integrations.