chore: merge v5 into v5-next (#24700)

Merges public `v5` into public `v5-next` so ongoing development can
continue on `v5-next` while `v5` stays the release line. Requested in
#engineering.

`v5` was ~887 commits ahead of the merge base and `v5-next` ~31, and the
merge is **not** clean — 4 conflicts. Structured as three commits for
review:

### Commit 1 — raw merge (conflict markers committed)
`Merge remote-tracking branch 'origin/v5'` — the merge commit with the
conflict markers left in place, so you can see exactly what git couldn't
auto-resolve:

- `yarn-project/txe/esbuild/plugins/size_guard.mjs`
- `noir-projects/aztec-nr/aztec/src/standard_addresses.nr` *(generated)*
- `yarn-project/standard-contracts/src/standard_contract_data.ts`
*(generated)*
- `noir-projects/noir-contracts/pinned-standard-contracts.tar.gz`
*(generated, binary)*

### Commit 2 — hand resolution
- **`size_guard.mjs`** — resolved by hand. Kept the higher
`totalLimitMiB = 15` (from `v5`): merging `v5`'s larger bundle content
into `v5-next` needs the bigger cap. Merged both bump-log lines
chronologically.
- The 3 generated standard-contract artifacts were left at the `v5-next`
baseline as a placeholder (correctly flagged by CI: `BBApiException:
verification key has wrong size: expected 5216, got 4576` — the old
pinned VKs don't match `v5`'s bb).

### Commit 3 — regenerated standard-contract artifacts
Ran the real regeneration on the merged tree:
`noir-projects/noir-contracts/bootstrap.sh pin-standard-build` + `yarn
workspace @aztec/standard-contracts run generate`, iterated to a
fixpoint (3 rounds — the standard contracts embed each other's address
stamps via aztec-nr, so re-pinning shifts addresses until they
stabilize). All four standard-contract addresses changed, as expected:
the merged tree combines **v5-next's** handshake forgery-protection
changes with **v5's** `aztec-nr` + protocol-constants + bb (VK format)
changes, so the addresses match neither committed side.

Verified locally on the merged tree: full `noir-contracts` build and
full `yarn-project` build (the CI job that failed) both pass, including
the standard-contracts drift check.

Everything else auto-merged (including `constants.gen.ts` /
`constants.nr` and the handshake contract/aztec-nr source). Opened as a
draft for review per the usual conflict-PR flow.

---
*Created by
[claudebox](https://claudebox.work/v2/sessions/97f178a58b3b68fb) ·
group: `slackbot`*

Author: nventuro

.github/ci3_labels_to_env.sh

@@ -127,6 +127,9 @@ function main {
     echo "WARNING: Skipping main CI because Chonk input refresh was requested; the update step will run after this step succeeds." >&2
     ci_mode="skip"
   elif has_label "ci-release-pr"; then
+    # Release-PR mode creates and pushes a release tag for this PR's head (ci3.sh::handle_release_pr).
+    # In the private repo that tag triggers a private release via the safety gate below — this is the
+    # manual way to cut a private release from a PR, alongside the nightly tag cron.
     ci_mode="release-pr"
   elif has_label "ci-full"; then
     ci_mode="full"
@@ -141,6 +144,9 @@ function main {
   elif has_label "ci-barretenberg" || [ "$target_branch" == "merge-train/barretenberg" ]; then
     ci_mode="barretenberg"
   elif [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+    # A pushed semver tag is a release; REF_NAME is the tag (see ci3/source_refname). In the private
+    # repo this is the nightly path (nightly-release-tag*.yml push v<ver>-nightly.<date> tags on next and
+    # v5-next); the private-repo safety gate below routes it to the internal Artifact Registry.
     ci_mode="release"
   else
     ci_mode="fast"
@@ -149,6 +155,17 @@ function main {
   echo "CI_MODE=$ci_mode" >> $GITHUB_ENV
   echo "CI mode: $ci_mode"
 
+  # Private-repo safety gate. The release flow can publish to DockerHub/npmjs/crates.io/github; that
+  # MUST NEVER run in the private fork. So whenever this repo would release — for ANY trigger (a pushed
+  # nightly tag, a ci-release-pr tag, anything future) — force the private path: publish only the docker
+  # image and npm packages to our internal Artifact Registry (bootstrap.sh::private_release). Keyed on
+  # the repo name (case-insensitive) so it can't be reached in the public repo.
+  if [ "$ci_mode" = "release" ] &&
+     [ "$(printf '%s' "${GITHUB_REPOSITORY:-}" | tr 'A-Z' 'a-z')" = "aztecprotocol/aztec-packages-private" ]; then
+    echo "PRIVATE_RELEASE=1" >> $GITHUB_ENV
+    echo "SKIP_COMPAT_E2E=1" >> $GITHUB_ENV
+  fi
+
   # Determine if benchmarks should be uploaded (merge-queue, full, or full-no-test-cache modes)
   if [[ "$ci_mode" == "merge-queue" || "$ci_mode" == "merge-queue-heavy" || "$ci_mode" == "full" || "$ci_mode" == "full-no-test-cache" ]]; then
     echo "SHOULD_UPLOAD_BENCHMARKS=1" >> $GITHUB_ENV

.github/workflows/avm-circuit-inputs.yml

@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   collect-avm-circuit-inputs:
+    if: github.repository != 'AztecProtocol/aztec-packages-private'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -66,6 +67,7 @@ jobs:
 
   avm-check-circuit:
     needs: collect-avm-circuit-inputs
+    if: github.repository != 'AztecProtocol/aztec-packages-private'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/ci3.yml

@@ -7,6 +7,8 @@ name: CI3
 on:
   workflow_dispatch:
   push:
+    branches:
+      - next
     tags:
       - "v*"
   pull_request:
@@ -115,6 +117,9 @@ jobs:
           EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY: ${{ secrets.GCP_SEPOLIA_API_KEY }}
           EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY_HEADER: "X-goog-api-key"
           GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          # Internal GCP Artifact Registry the private repo's release pushes the docker image to (see
+          # bootstrap.sh::private_release). Empty in the public repo, where releases publish normally.
+          INTERNAL_DOCKER_REGISTRY: ${{ vars.INTERNAL_DOCKER_REGISTRY }}
           MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
           PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}

.github/workflows/docs-typesense.yml

@@ -39,6 +39,11 @@ jobs:
         run: |
           set -euo pipefail
 
+          if [ -z "$TYPESENSE_API_KEY" ] || [ -z "$TYPESENSE_HOST" ]; then
+            echo "Typesense secrets are not configured; skipping docs search reindex."
+            exit 0
+          fi
+
           docker run \
             -e "TYPESENSE_API_KEY=$TYPESENSE_API_KEY" \
             -e "TYPESENSE_HOST=$TYPESENSE_HOST" \

.github/workflows/fuzzing-docker-avm-build-private.yml

@@ -1,9 +1,6 @@
 name: Build Private Fuzzing AVM Container
 
 on:
-  push:
-    branches:
-      - next
   workflow_dispatch:
     inputs:
       commit:

.github/workflows/fuzzing-docker-build-private.yml

@@ -1,9 +1,6 @@
 name: Build Private Fuzzing Container
 
 on:
-  push:
-    branches:
-      - next
   workflow_dispatch:
     inputs:
       commit:

…orkflows/nightly-release-tag-v4-next.yml …orkflows/nightly-release-tag-v5-next.yml.github/workflows/nightly-release-tag-v4-next.yml renamed to .github/workflows/nightly-release-tag-v5-next.yml .github/workflows/nightly-release-tag-v4-next.yml renamed to .github/workflows/nightly-release-tag-v5-next.yml

@@ -1,4 +1,4 @@
-name: Nightly Release Tag (v4-next)
+name: Nightly Release Tag (v5-next)
 on:
   schedule:
     # Run the workflow every night at 5:00 AM UTC.
@@ -9,24 +9,24 @@ permissions:
   contents: write
 
 concurrency:
-  group: ${{ github.workflow }}-v4-next
+  group: ${{ github.workflow }}-v5-next
 
 jobs:
-  nightly-release-tag-v4-next:
+  nightly-release-tag-v5-next:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
-          ref: v4-next
+          ref: v5-next
           token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
 
-      - name: Create v4-next Nightly Tag
+      - name: Create v5-next Nightly Tag
         run: |
           git config --global user.email "tech@aztecprotocol.com"
           git config --global user.name "AztecBot"
           current_version=$(jq -r '."."' .release-please-manifest.json)
           echo "Current version: $current_version"
           nightly_tag="v${current_version}-nightly.$(date -u +%Y%m%d)"
-          echo "v4-next nightly tag: $nightly_tag"
+          echo "v5-next nightly tag: $nightly_tag"
           git tag -a "$nightly_tag" -m "$nightly_tag"
           git push origin "$nightly_tag"

.github/workflows/public-next-pr-body.yml

@@ -0,0 +1,34 @@
+name: Public Next PR Body
+
+on:
+  push:
+    branches:
+      - next
+      - public-next
+  workflow_dispatch:
+
+concurrency:
+  group: public-next-pr-body
+  cancel-in-progress: true
+
+jobs:
+  update-public-next-pr-body:
+    name: Update next to public-next PR body
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout public-next workflow scripts
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: public-next
+          fetch-depth: 0
+          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+
+      - name: Update holding PR body
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          BASE_BRANCH: public-next
+          HEAD_BRANCH: next
+        run: ./scripts/merge-train/update-public-next-pr-body.sh

.github/workflows/public-next-to-next.yml

@@ -0,0 +1,37 @@
+name: Public Next Auto-Pull
+
+on:
+  push:
+    branches:
+      - public-next
+  workflow_dispatch:
+
+concurrency:
+  group: public-next-to-next
+  cancel-in-progress: false
+
+jobs:
+  merge-to-next:
+    name: Merge public-next to next
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout public-next automation
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: public-next
+          fetch-depth: 0
+          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          persist-credentials: true
+
+      - name: Configure Git
+        run: |
+          git config user.name AztecBot
+          git config user.email tech@aztecprotocol.com
+
+      - name: Merge public-next into next
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          SOURCE_BRANCH: public-next
+          TARGET_BRANCH: next
+          CONFLICT_EXIT_CODE: 1
+        run: ./scripts/merge-train/merge-public-next.sh

.github/workflows/public-v5-next-pr-body.yml

@@ -0,0 +1,34 @@
+name: Public v5-next PR Body
+
+on:
+  push:
+    branches:
+      - v5-next
+      - public-v5-next
+  workflow_dispatch:
+
+concurrency:
+  group: public-v5-next-pr-body
+  cancel-in-progress: true
+
+jobs:
+  update-public-v5-next-pr-body:
+    name: Update v5-next to public-v5-next PR body
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout public-v5-next workflow scripts
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: public-v5-next
+          fetch-depth: 0
+          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+
+      - name: Update holding PR body
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          BASE_BRANCH: public-v5-next
+          HEAD_BRANCH: v5-next
+        run: ./scripts/merge-train/update-public-next-pr-body.sh