Skip to content

Commit 9ee3754

Browse files
Merge branch 'merge-train/barretenberg' into claudebox/fix-nightly-bb-debug-build
2 parents a7a3511 + d8f7e77 commit 9ee3754

385 files changed

Lines changed: 12923 additions & 6085 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.claude/skills/merge-trains/SKILL.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ A merge train is an automated batching system (inspired by [Rust rollups](https:
1818
| `merge-train/ci` | CI infrastructure / ci3 | `#help-ci` |
1919
| `merge-train/docs` | Documentation | `#dev-rels` |
2020
| `merge-train/fairies` | aztec-nr | `#team-fairies` |
21-
| `merge-train/spartan` | Spartan / infra / yarn-project sequencer and prover orchestration | `#e-team-alpha` |
21+
| `merge-train/spartan` | Spartan / infra / yarn-project sequencer and prover orchestration | `#team-alpha` |
2222

2323
## How to Use a Merge Train
2424

.github/workflows/aztec-cli-acceptance-test.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ jobs:
2424
(github.event_name == 'workflow_run'
2525
&& github.event.workflow_run.conclusion == 'success'
2626
&& !contains(github.event.workflow_run.head_branch, '-commit.'))
27-
timeout-minutes: 30
2827
env:
2928
VERSION: ${{ github.event.inputs.version || github.event.workflow_run.head_branch }}
3029
steps:
@@ -41,6 +40,7 @@ jobs:
4140
node-version: 22
4241

4342
- name: Run Aztec CLI acceptance test
43+
timeout-minutes: 30
4444
run: ./aztec-up/test/aztec-cli-acceptance-test/run-test.sh
4545

4646
- name: Notify Slack on success
@@ -49,8 +49,9 @@ jobs:
4949
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
5050
run: |
5151
export CI=1
52-
./ci3/slack_notify "#team-fairies" \
53-
"Aztec CLI Acceptance Test passed for version ${VERSION} :white_check_mark:"
52+
./ci3/slack_notify \
53+
"Aztec CLI Acceptance Test passed for version ${VERSION} :white_check_mark:" \
54+
"#team-fairies"
5455
5556
- name: Notify Slack and dispatch ClaudeBox on failure
5657
if: failure() && github.event_name != 'workflow_dispatch'

.github/workflows/ci3.yml

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -499,6 +499,9 @@ jobs:
499499
ci-release-publish:
500500
runs-on: ubuntu-latest
501501
environment: master
502+
permissions:
503+
id-token: write
504+
contents: read
502505
needs: [ci, ci-compat-e2e]
503506
if: |
504507
startsWith(github.ref, 'refs/tags/v')
@@ -514,10 +517,16 @@ jobs:
514517
with:
515518
ref: ${{ github.sha }}
516519

520+
- name: Configure AWS credentials (OIDC)
521+
uses: aws-actions/configure-aws-credentials@v4
522+
with:
523+
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
524+
aws-region: us-east-2
525+
role-session-name: ci3-release-publish-${{ github.run_id }}
526+
role-duration-seconds: 21600
527+
517528
- name: Run Release Publish
518529
env:
519-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
520-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
521530
GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
522531
BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
523532
GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}

.github/workflows/deploy-irm.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
CLUSTER_NAME: ${{ inputs.cluster }}
7070
GKE_CLUSTER_CONTEXT: "gke_testnet-440309_us-west1-a_${{ inputs.cluster }}"
7171
REGION: us-west1-a
72-
INFURA_SECRET_NAME: infura-${{ inputs.l1_network }}-url
72+
ETHEREUM_HOSTS_SECRET_NAME: irm-ethereum-hosts-${{ inputs.l1_network }}
7373

7474
runs-on: ubuntu-latest
7575
steps:
@@ -150,4 +150,4 @@ jobs:
150150
echo "L1 network: ${{ inputs.l1_network }}"
151151
echo "Image tag: ${IMAGE_TAG}"
152152
153-
./spartan/metrics/irm-monitor/scripts/update-monitoring.sh $NAMESPACE $MONITORING_NAMESPACE ${{ inputs.network }} $INFURA_SECRET_NAME
153+
./spartan/metrics/irm-monitor/scripts/update-monitoring.sh $NAMESPACE $MONITORING_NAMESPACE ${{ inputs.network }} $ETHEREUM_HOSTS_SECRET_NAME

.github/workflows/deploy-network.yml

Lines changed: 41 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ on:
1010
required: true
1111
type: string
1212
semver:
13-
description: "Semver version (e.g., 2.3.4)"
14-
required: true
13+
description: "Semver version (e.g., 2.3.4). Used to construct docker image if aztec_docker_image is not set."
14+
required: false
1515
type: string
16-
docker_image_tag:
17-
description: "Full docker image tag (optional, defaults to semver)"
16+
aztec_docker_image:
17+
description: "Full Aztec docker image (e.g., aztecprotocol/aztec:2.3.4). If not set, constructed from semver."
1818
required: false
1919
type: string
2020
ref:
@@ -50,11 +50,11 @@ on:
5050
- testnet
5151
- mainnet
5252
semver:
53-
description: "Semver version (e.g., 2.3.4)"
54-
required: true
53+
description: "Semver version (e.g., 2.3.4). Used to construct docker image if aztec_docker_image is not set."
54+
required: false
5555
type: string
56-
docker_image_tag:
57-
description: "Full docker image tag (optional, defaults to semver)"
56+
aztec_docker_image:
57+
description: "Full Aztec docker image (e.g., aztecprotocol/aztec:2.3.4). If not set, constructed from semver."
5858
required: false
5959
type: string
6060
namespace:
@@ -76,7 +76,7 @@ on:
7676
type: string
7777

7878
concurrency:
79-
group: deploy-network-${{ inputs.network }}-${{ inputs.namespace || inputs.network }}-${{ inputs.semver }}-${{ github.ref || github.ref_name }}
79+
group: deploy-network-${{ inputs.network }}-${{ inputs.namespace || inputs.network }}-${{ inputs.aztec_docker_image || inputs.semver }}-${{ github.ref || github.ref_name }}
8080
cancel-in-progress: true
8181

8282
jobs:
@@ -120,16 +120,33 @@ jobs:
120120
exit 1
121121
fi
122122
123-
# Validate semver format
124-
if ! echo "${{ inputs.semver }}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-.*)?$'; then
125-
echo "Error: Invalid semver format '${{ inputs.semver }}'. Expected format: X.Y.Z or X.Y.Z-suffix"
123+
# Require at least one of aztec_docker_image or semver
124+
if [[ -z "${{ inputs.aztec_docker_image }}" && -z "${{ inputs.semver }}" ]]; then
125+
echo "Error: Either 'aztec_docker_image' or 'semver' must be provided"
126126
exit 1
127127
fi
128128
129-
# Extract major version for v2 check
130-
major_version="${{ inputs.semver }}"
131-
major_version="${major_version%%.*}"
132-
echo "MAJOR_VERSION=$major_version" >> $GITHUB_ENV
129+
# Validate semver format if provided
130+
if [[ -n "${{ inputs.semver }}" ]]; then
131+
if ! echo "${{ inputs.semver }}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-.*)?$'; then
132+
echo "Error: Invalid semver format '${{ inputs.semver }}'. Expected format: X.Y.Z or X.Y.Z-suffix"
133+
exit 1
134+
fi
135+
fi
136+
137+
# Resolve the docker image
138+
if [[ -n "${{ inputs.aztec_docker_image }}" ]]; then
139+
AZTEC_DOCKER_IMAGE="${{ inputs.aztec_docker_image }}"
140+
else
141+
AZTEC_DOCKER_IMAGE="aztecprotocol/aztec:${{ inputs.semver }}"
142+
fi
143+
echo "AZTEC_DOCKER_IMAGE=$AZTEC_DOCKER_IMAGE" >> $GITHUB_ENV
144+
145+
# Only use the separate prover-agent image for official semver builds;
146+
# for custom images, let the deploy script fall back to AZTEC_DOCKER_IMAGE
147+
if [[ -n "${{ inputs.semver }}" ]]; then
148+
echo "PROVER_AGENT_DOCKER_IMAGE=aztecprotocol/aztec-prover-agent:${{ inputs.semver }}" >> $GITHUB_ENV
149+
fi
133150
134151
- name: Store the GCP key in a file
135152
env:
@@ -174,12 +191,12 @@ jobs:
174191
RUN_ID: ${{ github.run_id }}
175192
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
176193
GOOGLE_APPLICATION_CREDENTIALS: ${{ env.GOOGLE_APPLICATION_CREDENTIALS }}
177-
REF_NAME: "v${{ inputs.semver }}"
194+
REF_NAME: ${{ inputs.semver && format('v{0}', inputs.semver) || '' }}
178195
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
179196
NAMESPACE: ${{ inputs.namespace }}
180-
AZTEC_DOCKER_IMAGE: "aztecprotocol/aztec:${{ inputs.docker_image_tag || inputs.semver }}"
197+
AZTEC_DOCKER_IMAGE: ${{ env.AZTEC_DOCKER_IMAGE }}
181198
CREATE_ROLLUP_CONTRACTS: ${{ inputs.deploy_contracts == true && 'true' || '' }}
182-
PROVER_AGENT_DOCKER_IMAGE: "aztecprotocol/aztec-prover-agent:${{ inputs.docker_image_tag || inputs.semver }}"
199+
PROVER_AGENT_DOCKER_IMAGE: ${{ env.PROVER_AGENT_DOCKER_IMAGE || env.AZTEC_DOCKER_IMAGE }}
183200
VALIDATOR_HA_DOCKER_IMAGE: ${{ inputs.ha_docker_image || '' }}
184201
run: |
185202
echo "Deploying network: ${{ inputs.network }}"
@@ -209,7 +226,7 @@ jobs:
209226
echo "| Item | Value |"
210227
echo "|------|-------|"
211228
echo "| Network | \`${{ inputs.network }}\` |"
212-
echo "| Semver | \`${{ inputs.semver }}\` |"
229+
echo "| Docker Image | \`${{ env.AZTEC_DOCKER_IMAGE }}\` |"
213230
echo "| Ref | \`${{ steps.checkout-ref.outputs.ref }}\` |"
214231
if [[ -n "${{ inputs.source_tag }}" ]]; then
215232
echo "| Source Tag | [\`${{ inputs.source_tag }}\`](https://github.com/${{ github.repository }}/releases/tag/${{ inputs.source_tag }}) |"
@@ -229,7 +246,7 @@ jobs:
229246
230247
CHANNEL="#alerts-${{ inputs.network }}"
231248
RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
232-
TEXT="Deploy Network workflow FAILED for *${{ inputs.network }}* (version ${{ inputs.semver }}): <${RUN_URL}|View Run> (🤖)"
249+
TEXT="Deploy Network workflow FAILED for *${{ inputs.network }}* (image ${{ env.AZTEC_DOCKER_IMAGE }}): <${RUN_URL}|View Run> (🤖)"
233250
234251
# Post to Slack and capture timestamp for permalink
235252
RESP=$(curl -sS -X POST https://slack.com/api/chat.postMessage \
@@ -247,11 +264,11 @@ jobs:
247264
fi
248265
249266
# Dispatch ClaudeBox to investigate the failure
250-
PROMPT="Deployment of ${{ inputs.network }} (version ${{ inputs.semver }}) failed. \
267+
PROMPT="Deployment of ${{ inputs.network }} (image ${{ env.AZTEC_DOCKER_IMAGE }}) failed. \
251268
Follow .claude/claudebox/deploy-investigation.md to investigate. \
252269
GitHub Actions run: ${RUN_URL}. \
253-
Network: ${{ inputs.network }}. Version: ${{ inputs.semver }}. \
254-
Docker image: ${{ inputs.docker_image_tag || inputs.semver }}. \
270+
Network: ${{ inputs.network }}. \
271+
Docker image: ${{ env.AZTEC_DOCKER_IMAGE }}. \
255272
Git ref: ${{ steps.checkout-ref.outputs.ref }}. \
256273
Namespace: ${{ inputs.namespace || inputs.network }}. \
257274
Deploy contracts: ${{ inputs.deploy_contracts }}."

.github/workflows/deploy-next-net.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ on:
1010
workflow_dispatch:
1111
inputs:
1212
image_tag:
13-
description: 'Docker image tag (e.g., 2.3.4, 3.0.0-nightly.20251004-amd64, or leave empty for latest nightly)'
13+
description: "Docker image tag (e.g., 2.3.4, 3.0.0-nightly.20251004-amd64, or leave empty for latest nightly)"
1414
required: false
1515
type: string
1616

@@ -67,6 +67,6 @@ jobs:
6767
with:
6868
network: next-net
6969
semver: ${{ needs.get-image-tag.outputs.semver }}
70-
docker_image_tag: ${{ needs.get-image-tag.outputs.tag }}
70+
aztec_docker_image: "aztecprotocol/aztec:${{ needs.get-image-tag.outputs.tag }}"
7171
ref: ${{ github.ref }}
7272
secrets: inherit
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Merge-Train Stale Check
2+
3+
on:
4+
schedule:
5+
# Daily at 09:15 UTC — once per day, off the round-minute mark.
6+
- cron: "15 9 * * *"
7+
workflow_dispatch:
8+
9+
jobs:
10+
spartan:
11+
name: Check merge-train/spartan
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
pull-requests: read
16+
steps:
17+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
18+
- name: Run stale check
19+
env:
20+
GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
21+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
22+
run: ./ci3/merge_train_stale_check merge-train/spartan '#team-alpha'

.test_patterns.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,14 @@ tests:
294294
owners:
295295
- *palla
296296

297+
# tx_stats_bench's 10 TPS sub-test occasionally returns valid:false from a single IVC
298+
# verification under heavy concurrency (8 parallel verifiers, each spawning a fresh bb subprocess
299+
# via the bb.js NativeUnixSocket backend introduced in #21564). The serial sub-tests pass.
300+
- regex: "tx_stats_bench"
301+
error_regex: "tx_stats_bench\\.test\\.ts:[0-9]+:[0-9]+"
302+
owners:
303+
- *charlie
304+
297305
- regex: "src/e2e_token_bridge_tutorial.test.ts"
298306
error_regex: "Error: Unable to find low leaf for block"
299307
owners:

SECURITY.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,12 @@ If you believe a vulnerability is actively being exploited or has severe impact
3333
**Use GitHub Issues** to report bugs or issues that are **not** security-sensitive (performance problems, feature requests, etc.):
3434

3535
Keeping normal bugs and feature requests public helps the community track progress and collaborate on fixes, while keeping security issues private helps protect users until a fix is available.
36+
37+
## Vulnerabilities discovered in Aztec Network v4
38+
39+
The following table contains a list of high and critical vulnerabilities discovered internally and through external audits by 11.05.2026
40+
41+
|Severity | Count |
42+
|----|----|
43+
| Critical | 8 |
44+
| High | 7 |

aztec-up/bin/0.0.1/install

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -123,13 +123,13 @@ function install_node {
123123
# Need to install - check if nvm is available
124124
if [ ! -f "$HOME/.nvm/nvm.sh" ]; then
125125
echo "Minimum Node.js version $node_min_version not found (got $node_installed_version)."
126-
echo "Installation: nvm install --lts && nvm alias default lts/*"
126+
echo "Installation: nvm install $node_min_version && nvm alias default $node_min_version"
127127
exit 1
128128
fi
129129

130130
. "$HOME/.nvm/nvm.sh"
131-
nvm install --lts
132-
nvm alias default lts/*
131+
nvm install "$node_min_version"
132+
nvm alias default "$node_min_version"
133133
}
134134

135135
function install_versions_file {

0 commit comments

Comments
 (0)