refactor(ci): unify release back into a single ci-release command (#23780)

## What

1. Reunifies the release flow into a single `ci-release` command (undoes
the `ci-release` / `ci-release-publish` split from #22930). This had
introduced several bugs and caused the command to span multiple
machines.
2. Fixes runner-side `git push` auth, broken by the checkout-v6 repin.

Author: ludamad

.github/workflows/auto-close-issues.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: read
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # Conservative depth that avoids historical large files while covering typical merge scenarios
           fetch-depth: 200

.github/workflows/auto-rebase-pr.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}

.github/workflows/avm-circuit-inputs.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           persist-credentials: false
 
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           persist-credentials: false
 

.github/workflows/aztec-cli-acceptance-test.yml

@@ -32,7 +32,7 @@ jobs:
       VERSION: ${{ github.event.inputs.version || github.event.workflow_run.head_branch }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
 
@@ -57,7 +57,7 @@ jobs:
       VERSION: ${{ github.event.inputs.version || github.event.workflow_run.head_branch }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
 

.github/workflows/backport.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}

.github/workflows/barretenberg-nightly-debug-build.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: next
 

.github/workflows/ci3-dashboard-deploy.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           persist-credentials: false
 

.github/workflows/ci3-external.yml

@@ -27,7 +27,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # The commit to checkout.  We want our actual commit, and not the result of merging the PR to the target.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}

.github/workflows/ci3.yml

@@ -54,14 +54,22 @@ jobs:
           GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
         run: gh pr edit ${{ github.event.pull_request.number }} --remove-label ci-wakeup-pr-after-merge --repo ${{ github.repository }} || true
 
+      # Do NOT bump actions/checkout to v6 here. v6 ("persist creds to a separate file", #2286)
+      # stores the persisted github.token in a temp credentials file pulled in via includeIf, which
+      # `git config --unset-all http....extraheader` cannot clear. Our runner-side pushes (ci3.sh
+      # release-pr tag, ci3_success.sh squash-and-merge) rely on swapping that header for a bot-PAT
+      # remote, so under v6 they push as github-actions[bot] (contents: read) and 403. v5.0.1 is still
+      # node24 but keeps the credential as a removable local extraheader.
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           # The commit to checkout. We want our actual commit, and not the result of merging the PR to the target.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           # Fetch PR commits depth (we'll deepen by 1 in squash script if needed)
           fetch-depth: ${{ github.event.pull_request.commits || 1 }}
-          persist-credentials: true   # Required for bootstrap_ec2's git fetch
+          # Persisted for authenticated reads (e.g. the aztec-packages-private mirror); pushes swap in
+          # a bot-PAT remote at each push site.
+          persist-credentials: true
 
       - name: Configure AWS credentials (OIDC)
         uses: aws-actions/configure-aws-credentials@v4
@@ -114,6 +122,8 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
           GITHUB_ACTOR: ${{ github.actor }}
+          # Forwarded to EC2 so release_compat_e2e's nightly-failure Slack alert can build a real run URL.
+          RUN_ID: ${{ github.run_id }}
           CI3_INSTANCE_PROFILE_NAME: ${{ secrets.CI3_INSTANCE_PROFILE_NAME }}
           CI3_SECURITY_GROUP_ID: ${{ secrets.CI3_SECURITY_GROUP_ID }}
           AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
@@ -199,11 +209,10 @@ jobs:
       matrix:
         test_set: ["1", "2"]
     # We run on current nightly tags only, or when the ci-network-scenario label is present in a PR.
-    needs: [ci, validate-nightly-tag, ci-release-publish]
+    needs: [ci, validate-nightly-tag]
     if: |
       always()
       && (needs.ci.result == 'success' || needs.ci.result == 'skipped')
-      && (needs.ci-release-publish.result == 'success' || needs.ci-release-publish.result == 'skipped')
       && github.event.pull_request.head.repo.fork != true
       && github.event.pull_request.draft == false
       && (
@@ -218,7 +227,7 @@ jobs:
         run: gh pr edit ${{ github.event.pull_request.number }} --remove-label ci-network-scenario --repo ${{ github.repository }} || true
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
@@ -341,7 +350,7 @@ jobs:
         run: gh pr edit ${{ github.event.pull_request.number }} --remove-label ci-network-bench --repo ${{ github.repository }} || true
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
@@ -423,7 +432,7 @@ jobs:
         run: gh pr edit ${{ github.event.pull_request.number }} --remove-label ci-network-kind --repo ${{ github.repository }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
@@ -449,99 +458,3 @@ jobs:
           AWS_SHUTDOWN_TIME: 180
         run: |
           ./.github/ci3.sh network-tests-kind
-
-  # Backwards compatibility e2e tests.
-  # Runs e2e tests with contract artifacts from every prior stable release to validate
-  # that new client code works with old contract artifacts ("new pxe / old contracts").
-  # Blocking for stable/RC releases: ci-release-publish requires this job to pass before
-  # publishing. Observational for nightlies: runs, but continue-on-error keeps the workflow
-  # green and ci-release-publish's condition publishes nightlies regardless of the result.
-  # Escape hatch: ci-skip-compat-e2e label makes failures non-blocking on release PRs.
-  ci-compat-e2e:
-    runs-on: ubuntu-latest
-    needs: [ci]
-    if: |
-      always()
-      && (needs.ci.result == 'success' || needs.ci.result == 'skipped')
-      && github.event.pull_request.head.repo.fork != true
-      && github.event.pull_request.draft == false
-      && (
-        (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-commit.'))
-        || contains(github.event.pull_request.labels.*.name, 'ci-compat-e2e')
-        || contains(github.event.pull_request.labels.*.name, 'ci-release-pr')
-      )
-    # Non-blocking for nightlies and when ci-skip-compat-e2e escape hatch is applied.
-    continue-on-error: ${{ contains(github.ref_name, '-nightly.') || contains(github.event.pull_request.labels.*.name, 'ci-skip-compat-e2e') }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-
-      - name: Run Backwards Compatibility E2E Tests
-        timeout-minutes: 60
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
-          BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
-          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
-          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-          CI3_INSTANCE_PROFILE_NAME: ${{ secrets.CI3_INSTANCE_PROFILE_NAME }}
-          CI3_SECURITY_GROUP_ID: ${{ secrets.CI3_SECURITY_GROUP_ID }}
-          RUN_ID: ${{ github.run_id }}
-          AWS_SHUTDOWN_TIME: 60
-        run: ./.github/ci3.sh compat-e2e
-
-  # Publishes the release (npm, Docker, GitHub release, aztec-up scripts, etc.).
-  # Gated on ci-compat-e2e: a compat regression blocks stable/RC publishing. Nightlies
-  # publish regardless — compat-e2e runs there observationally. Dev `-commit.` tags from
-  # the ci-release-pr flow never reach this job (they are not real releases).
-  ci-release-publish:
-    runs-on: ubuntu-latest
-    environment: master
-    permissions:
-      id-token: write
-      contents: read
-    needs: [ci, ci-compat-e2e]
-    if: |
-      startsWith(github.ref, 'refs/tags/v')
-      && !contains(github.ref_name, '-commit.')
-      && needs.ci.result == 'success'
-      && (
-        contains(github.ref_name, '-nightly.')
-        || needs.ci-compat-e2e.result == 'success'
-      )
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.sha }}
-
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
-          aws-region: us-east-2
-          role-session-name: ci3-release-publish-${{ github.run_id }}
-          role-duration-seconds: 21600
-
-      - name: Run Release Publish
-        env:
-          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
-          BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
-          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
-          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
-          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-          CI3_INSTANCE_PROFILE_NAME: ${{ secrets.CI3_INSTANCE_PROFILE_NAME }}
-          CI3_SECURITY_GROUP_ID: ${{ secrets.CI3_SECURITY_GROUP_ID }}
-          RUN_ID: ${{ github.run_id }}
-        run: ./.github/ci3.sh release-publish

.github/workflows/codeql.yml

@@ -50,7 +50,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL