feat(price-pusher): allow mnemonic from MNEMONIC env var (closes #1015)

Previously the price pusher required `--mnemonic-file` pointing at a file on
disk containing the signing mnemonic. On platforms that provide encrypted env
vars (DigitalOcean, Fly.io, etc.) this forces operators to first write the
secret to disk before launching the process.

Make `--mnemonic-file` optional and fall back to the `MNEMONIC` environment
variable when the flag is not supplied. If both are supplied, the file takes
precedence (explicit beats implicit). If neither is supplied, the existing
required-arg error is replaced with a clearer message naming both sources.

The helper lives in `utils.ts` so all four chain commands (evm, sui, aptos,
injective) share identical resolution behaviour.

Author: 0xghost42

apps/price_pusher/README.md

@@ -83,6 +83,8 @@ Pyth hosts [public endpoints](https://docs.pyth.network/price-feeds/api-instance
 Hermes RPC providers for more reliability. Please refer to [this
 document](https://docs.pyth.network/documentation/pythnet-price-feeds/hermes) for more information.
 
+The signing mnemonic can be supplied via either the `--mnemonic-file` flag (path to a file containing the mnemonic) or the `MNEMONIC` environment variable. The environment variable is convenient for platforms that inject secrets as encrypted env vars (e.g. DigitalOcean, Fly.io). If both are supplied, `--mnemonic-file` takes precedence.
+
 To run the price pusher, please run the following commands, replacing the command line arguments as necessary:
 
 ```sh

apps/price_pusher/src/aptos/command.ts

@@ -3,8 +3,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import fs from "node:fs";
-
 import { HermesClient } from "@pythnetwork/hermes-client";
 import { AptosAccount } from "aptos";
 import pino from "pino";
@@ -15,7 +13,7 @@ import { PricePusherMetrics } from "../metrics.js";
 import * as options from "../options.js";
 import { readPriceConfigFile } from "../price-config.js";
 import { PythPriceListener } from "../pyth-price-listener.js";
-import { filterInvalidPriceItems } from "../utils.js";
+import { filterInvalidPriceItems, readMnemonic } from "../utils.js";
 import {
   APTOS_ACCOUNT_HD_PATH,
   AptosPriceListener,
@@ -87,7 +85,7 @@ export default {
       logger.info(`Metrics server started on port ${metricsPort}`);
     }
 
-    const mnemonic = fs.readFileSync(mnemonicFile, "utf8").trim();
+    const mnemonic = readMnemonic(mnemonicFile);
     const account = AptosAccount.fromDerivePath(
       APTOS_ACCOUNT_HD_PATH,
       mnemonic,

apps/price_pusher/src/evm/command.ts

@@ -3,8 +3,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import fs from "node:fs";
-
 import { HermesClient } from "@pythnetwork/hermes-client";
 import pino from "pino";
 import type { Options } from "yargs";
@@ -14,7 +12,11 @@ import { PricePusherMetrics } from "../metrics.js";
 import * as options from "../options.js";
 import { readPriceConfigFile } from "../price-config.js";
 import { PythPriceListener } from "../pyth-price-listener.js";
-import { filterInvalidPriceItems, isWsEndpoint } from "../utils.js";
+import {
+  filterInvalidPriceItems,
+  isWsEndpoint,
+  readMnemonic,
+} from "../utils.js";
 import { createEvmBalanceTracker } from "./balance-tracker.js";
 import { getCustomGasStation } from "./custom-gas-station.js";
 import { EvmPriceListener, EvmPricePusher } from "./evm.js";
@@ -129,7 +131,7 @@ export default {
       accessToken: hermesAccessToken,
     });
 
-    const mnemonic = fs.readFileSync(mnemonicFile, "utf8").trim();
+    const mnemonic = readMnemonic(mnemonicFile);
 
     let priceItems = priceConfigs.map(({ id, alias }) => ({ alias, id }));
 

apps/price_pusher/src/injective/command.ts

@@ -1,8 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import fs from "node:fs";
-
 import { getNetworkInfo } from "@injectivelabs/networks";
 import { HermesClient } from "@pythnetwork/hermes-client";
 import { pino } from "pino";
@@ -11,7 +9,7 @@ import { Controller } from "../controller.js";
 import * as options from "../options.js";
 import { readPriceConfigFile } from "../price-config.js";
 import { PythPriceListener } from "../pyth-price-listener.js";
-import { filterInvalidPriceItems } from "../utils.js";
+import { filterInvalidPriceItems, readMnemonic } from "../utils.js";
 import { InjectivePriceListener, InjectivePricePusher } from "./injective.js";
 export default {
   builder: {
@@ -83,7 +81,7 @@ export default {
     const hermesClient = new HermesClient(priceServiceEndpoint, {
       accessToken: hermesAccessToken,
     });
-    const mnemonic = fs.readFileSync(mnemonicFile, "utf8").trim();
+    const mnemonic = readMnemonic(mnemonicFile);
 
     let priceItems = priceConfigs.map(({ id, alias }) => ({ alias, id }));
 

apps/price_pusher/src/options.ts

@@ -60,9 +60,11 @@ export const pushingFrequency = {
 
 export const mnemonicFile = {
   "mnemonic-file": {
-    description: "Path to payer mnemonic (private key) file.",
-    required: true,
+    description:
+      "Path to payer mnemonic (private key) file. " +
+      "If omitted, the mnemonic is read from the `MNEMONIC` environment variable.",
     type: "string",
+    required: false,
   } as Options,
 };
 

apps/price_pusher/src/sui/command.ts

@@ -3,8 +3,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import fs from "node:fs";
-
 import { SuiClient } from "@mysten/sui/client";
 import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
 import { HermesClient } from "@pythnetwork/hermes-client";
@@ -16,7 +14,7 @@ import { PricePusherMetrics } from "../metrics.js";
 import * as options from "../options.js";
 import { readPriceConfigFile } from "../price-config";
 import { PythPriceListener } from "../pyth-price-listener.js";
-import { filterInvalidPriceItems } from "../utils.js";
+import { filterInvalidPriceItems, readMnemonic } from "../utils.js";
 import { createSuiBalanceTracker } from "./balance-tracker.js";
 import { SuiPriceListener, SuiPricePusher } from "./sui.js";
 
@@ -114,7 +112,7 @@ export default {
       accessToken: hermesAccessToken,
     });
 
-    const mnemonic = fs.readFileSync(mnemonicFile, "utf8").trim();
+    const mnemonic = readMnemonic(mnemonicFile);
     const keypair = Ed25519Keypair.deriveKeypair(
       mnemonic,
       `m/44'/784'/${accountIndex}'/0'/0'`,

apps/price_pusher/src/utils.ts

@@ -1,6 +1,8 @@
 /* eslint-disable @typescript-eslint/no-unsafe-return */
 /* eslint-disable @typescript-eslint/no-unnecessary-type-parameters */
 /* eslint-disable @typescript-eslint/no-explicit-any */
+import fs from "node:fs";
+
 import type { HermesClient, HexString } from "@pythnetwork/hermes-client";
 
 import type { PriceItem } from "./interface.js";
@@ -60,6 +62,21 @@ export const assertDefined = <T>(value: T | undefined): T => {
   }
 };
 
+export function readMnemonic(mnemonicFile: string | undefined): string {
+  if (mnemonicFile !== undefined && mnemonicFile !== "") {
+    return fs.readFileSync(mnemonicFile, "utf8").trim();
+  }
+
+  const envMnemonic = process.env.MNEMONIC;
+  if (envMnemonic !== undefined && envMnemonic !== "") {
+    return envMnemonic.trim();
+  }
+
+  throw new Error(
+    "No mnemonic provided. Pass --mnemonic-file or set the MNEMONIC environment variable.",
+  );
+}
+
 export async function filterInvalidPriceItems(
   hermesClient: HermesClient,
   priceItems: PriceItem[],