chore: Patch discv5

.github/.gitignore

@@ -1 +1,2 @@
-.secrets
+.secrets
+.act-tool-cache

.github/local_workflow.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Runs a github workflow locally.
+#
+# Needs `act`. See https://nektosact.com/installation/index.html
+#
+# Bind-mounts the local directory into the container, which executes as the current user.
+# Attempts to use a GCP service account, which you can download from
+# https://console.cloud.google.com/iam-admin/serviceaccounts
+
+# Your workflow may not need a GCP service account, nor a kubeconfig, etc.
+# Feel free to send a PR to tweak the script ;)
+
+# example usage:
+# export GOOGLE_APPLICATION_CREDENTIALS=/your/path/to/testnet-helm-sa.json
+# alias lwfl=/your/path/to/aztec-clones/alpha/.github/local_workflow.sh
+# lwfl deploy_eth_devnet --input cluster=kind --input resource_profile=dev --input namespace=mitch-eth-devnet --input create_static_ips=false
+# lwfl deploy_eth_devnet --input cluster=aztec-gke-private --input resource_profile=prod --input namespace=mitch-eth-devnet --input create_static_ips=false
+
+workflow_name=$1
+
+REPO_ROOT=$(git rev-parse --show-toplevel)
+
+if [ -z "$workflow_name" ]; then
+  echo "Usage: $0 <workflow_name> [args ...]"
+  exit 1
+fi
+
+# get the rest of the args (skip the first one which is the workflow name)
+shift
+args=("$@")
+
+# Only needed when running against GKE
+SA_KEY_JSON=$(cat "$GOOGLE_APPLICATION_CREDENTIALS")
+
+mkdir -p $REPO_ROOT/.github/.act-tool-cache
+
+act -j $workflow_name \
+  --env RUNNER_TOOL_CACHE=/work/toolcache \
+  -s GITHUB_TOKEN="$(gh auth token)" \
+  -s GCP_SA_KEY="$SA_KEY_JSON" \
+  -s KUBECONFIG_B64="$(cat $HOME/.kube/config | base64 -w0)" \
+  --container-options "-v $REPO_ROOT/.github/.act-tool-cache:/work/toolcache --user $(id -u):$(id -g)" \
+  --bind \
+  --directory $REPO_ROOT "${args[@]}"

.github/release-please-v2.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "simple",
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "group-pull-request-title-pattern": "chore(v2): Release ${version}",
+  "pull-request-header": "Pending Aztec Packages v2 release",
+  "versioning": "always-bump-patch",
+  "include-component-in-tag": false,
+  "changelog-sections": [
+    { "type": "feat", "section": "Features", "hidden": false },
+    { "type": "fix", "section": "Bug Fixes", "hidden": false },
+    { "type": "chore", "section": "Miscellaneous", "hidden": false },
+    { "type": "test", "section": "Miscellaneous", "hidden": false },
+    { "type": "refactor", "section": "Miscellaneous", "hidden": false },
+    { "type": "docs", "section": "Documentation", "hidden": false }
+  ],
+  "packages": {
+    ".": {
+      "release-type": "simple"
+    }
+  }
+}

.github/workflows/ci3-external.yml

@@ -31,6 +31,7 @@ jobs:
         with:
           # The commit to checkout.  We want our actual commit, and not the result of merging the PR to the target.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       # NOTE: in ci3.yml we just rely on draft mode not being mergable.
       # Here we are a little more careful than just skipping the worklfow, in case of an edge case allowing merge.
@@ -43,7 +44,7 @@ jobs:
         run: |
           set -o pipefail
           git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1 &>/dev/null
-          forbidden_changes=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }} HEAD -- ci3 .github ci.sh)
+          forbidden_changes=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }} HEAD -- ci3 .github ci.sh scripts)
           if echo "$forbidden_changes" | grep -q .; then
             echo "Error: External PRs can't contain CI changes (forbidden files: $forbidden_changes)."
             exit 1
@@ -63,6 +64,10 @@ jobs:
           # Remove any ci-external-once labels.
           GITHUB_TOKEN=${{ secrets.AZTEC_BOT_GITHUB_TOKEN }} gh pr edit ${{ github.event.pull_request.number }} --remove-label "ci-external-once"
 
+      - name: CI Merge Queue Override (grind on PR)
+        if: contains(github.event.pull_request.labels.*.name, 'ci-merge-queue')
+        run: echo "CI_MERGE_QUEUE=1" >> $GITHUB_ENV
+
       - name: CI Full Override
         if: contains(github.event.pull_request.labels.*.name, 'ci-full')
         run: echo "CI_FULL=1" >> $GITHUB_ENV
@@ -82,10 +87,21 @@ jobs:
           echo ${{ secrets.BUILD_INSTANCE_SSH_KEY }} | base64 --decode > ~/.ssh/build_instance_key
           chmod 600 ~/.ssh/build_instance_key
 
+      - name: Get Tree Hash
+        run: echo "TREE_HASH=$(git rev-parse HEAD^{tree})" >> $GITHUB_ENV
+
+      - name: Check CI Cache
+        id: ci_cache
+        uses: actions/cache@v3
+        with:
+          path: ci-success.txt
+          key: ci-external-${{ env.TREE_HASH }}
+
       #############
       # Run
       #############
       - name: Run
+        if: steps.ci_cache.outputs.cache-hit != 'true'
         env:
           # We need to pass these creds to start the AWS ec2 instance.
           # They are not injected into that instance. Instead, it has minimal
@@ -97,8 +113,32 @@ jobs:
           ARCH: amd64
           RUN_ID: ${{ github.run_id }}
         run: |
-          if [ "${CI_FULL:-0}" -eq 1 ]; then
+          if [ "${CI_MERGE_QUEUE:-0}" -eq 1 ]; then
             exec ./ci.sh merge-queue
+          elif [ "${CI_FULL:-0}" -eq 1 ]; then
+            exec ./ci.sh full
           else
             exec ./ci.sh fast
           fi
+
+      - name: Save CI Success
+        if: steps.ci_cache.outputs.cache-hit != 'true'
+        run: echo "success" > ci-success.txt
+
+      # If we have passed CI and labelled with ci-squash-and-merge, squash the PR.
+      # This will rerun CI on the squash commit - but is intended to be a no-op due to caching.
+      - name: CI Squash and Merge
+        if: contains(github.event.pull_request.labels.*.name, 'ci-squash-and-merge')
+        env:
+          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+        run: |
+          # Reauth the git repo with our GITHUB_TOKEN
+          git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}
+          # Get the base commit (merge-base) for the PR
+          ./scripts/merge-train/squash-pr.sh \
+            "${{ github.event.pull_request.number }}" \
+            "${{ github.event.pull_request.head.ref }}" \
+            "${{ github.event.pull_request.base.ref }}" \
+            "${{ github.event.pull_request.base.sha }}"
+          gh pr edit "${{ github.event.pull_request.number }}" --remove-label "ci-squash-and-merge"
+          gh pr merge "${{ github.event.pull_request.number }}" --auto -m || true

.github/workflows/ci3.yml

@@ -25,6 +25,8 @@ jobs:
     # (github.event.pull_request.head.repo.fork resolves to nil if not a pull request)
     if: github.event.pull_request.head.repo.fork != true && github.event.pull_request.draft == false
     environment: ${{ startsWith(github.ref, 'refs/tags/v') && 'master' || '' }}
+    env:
+      GOOGLE_APPLICATION_CREDENTIALS: /tmp/gcp-key.json
     steps:
       #############
       # Prepare Env
@@ -36,7 +38,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           # Fetch PR commits depth (we'll deepen by 1 in squash script if needed)
           fetch-depth: ${{ github.event.pull_request.commits || 0 }}
-          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          persist-credentials: false
 
       - name: CI Merge Queue Override (grind on PR)
         if: contains(github.event.pull_request.labels.*.name, 'ci-merge-queue')
@@ -54,10 +56,6 @@ jobs:
         if: contains(github.event.pull_request.labels.*.name, 'ci-no-fail-fast')
         run: echo "NO_FAIL_FAST=1" >> $GITHUB_ENV
 
-      - name: Barretenberg CI Override
-        if: contains(github.event.pull_request.labels.*.name, 'ci-barretenberg')
-        run: echo "CI_BARRETENBERG=1" >> $GITHUB_ENV
-
       - name: Compute Target Branch
         id: target_branch
         run: |
@@ -91,15 +89,16 @@ jobs:
           mkdir -p ~/.ssh
           echo ${{ secrets.BUILD_INSTANCE_SSH_KEY }} | base64 --decode > ~/.ssh/build_instance_key
           chmod 600 ~/.ssh/build_instance_key
-          # Install required packages.
-          sudo apt update && sudo apt install -y redis-tools parallel
+          sudo apt install -y --no-install-recommends redis-tools parallel
 
-      - name: Prepare GCP key
+      - name: Store the GCP key in a file
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
-          echo "$GCP_SA_KEY" | base64 -w 0 > gcp_sa_key.b64
-          echo "GCP_SA_KEY_B64=$(cat gcp_sa_key.b64)" >> $GITHUB_ENV
+          set +x
+          umask 077
+          printf '%s' "$GCP_SA_KEY" > "$GOOGLE_APPLICATION_CREDENTIALS"
+          jq -e . "$GOOGLE_APPLICATION_CREDENTIALS" >/dev/null
 
       - name: Get Tree Hash
         run: echo "TREE_HASH=$(git rev-parse HEAD^{tree})" >> $GITHUB_ENV
@@ -127,7 +126,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
           # Nightly test env vars.
-          GCP_SA_KEY_B64: ${{ env.GCP_SA_KEY_B64 }}
+          GOOGLE_APPLICATION_CREDENTIALS: ${{ env.GOOGLE_APPLICATION_CREDENTIALS }}
           EXTERNAL_ETHEREUM_HOSTS: "https://json-rpc.${{ secrets.GCP_SEPOLIA_URL }}?key=${{ secrets.GCP_SEPOLIA_API_KEY }},${{ secrets.INFURA_SEPOLIA_URL }}"
           EXTERNAL_ETHEREUM_CONSENSUS_HOST: "https://beacon.${{ secrets.GCP_SEPOLIA_URL }}"
           EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY: ${{ secrets.GCP_SEPOLIA_API_KEY }}
@@ -142,7 +141,7 @@ jobs:
             exec ./ci.sh docs
           elif [ "${CI_BARRETENBERG:-0}" -eq 1 ]; then
             exec ./ci.sh barretenberg
-          elif [ "${{ contains(github.ref, '-nightly.') }}" == "true" ]; then
+          elif [ "${{ contains(github.ref, '-nightly.') }}" == "true" ] || [ "${{ contains(github.ref, '-rc.') }}" == "true" ]; then
             exec ./ci.sh nightly
           elif [ "${{ startsWith(github.ref, 'refs/tags/v') }}" == "true" ]; then
             exec ./ci.sh release
@@ -161,21 +160,23 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
         run: |
+          # Reauth the git repo with our GITHUB_TOKEN
+          git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}
           # Get the base commit (merge-base) for the PR
           ./scripts/merge-train/squash-pr.sh \
             "${{ github.event.pull_request.number }}" \
             "${{ github.event.pull_request.head.ref }}" \
             "${{ github.event.pull_request.base.ref }}" \
             "${{ github.event.pull_request.base.sha }}"
           gh pr edit "${{ github.event.pull_request.number }}" --remove-label "ci-squash-and-merge"
-          gh pr ready "${{ github.event.pull_request.number }}" || true
+          gh pr merge "${{ github.event.pull_request.number }}" --auto -m || true
 
       - name: Download benchmarks
-        if: github.event_name == 'merge_group'
+        if: github.event_name == 'merge_group' || env.CI_FULL == '1'
         run: ./ci.sh gh-bench
 
       - name: Upload benchmarks
-        if: github.event_name == 'merge_group'
+        if: github.event_name == 'merge_group' || env.CI_FULL == '1'
         uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29
         with:
           name: Aztec Benchmarks

.github/workflows/create-release-branch.yml

@@ -0,0 +1,66 @@
+name: Create Release Branch
+
+# Take the current version from the release-please-manifest.json file on `next`,
+# and create a release branch for it. Then update the release-please-manifest.json file on `next` to the next version.
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_commit:
+        description: "Source commit SHA from next branch"
+        required: true
+        type: string
+
+env:
+  GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+
+jobs:
+  create-release-branch:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.inputs.source_commit }}
+          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "AztecBot"
+          git config --global user.email "tech@aztecprotocol.com"
+
+      - name: Create release branch
+        run: |
+          # Get the version from the release-please-manifest.json file
+          CURRENT_VERSION=$(jq -r '."."' .release-please-manifest.json)
+
+          # grab major version
+          CURRENT_MAJOR_VERSION="${CURRENT_VERSION%%.*}"
+
+          # create branch name
+          BRANCH_NAME="v${CURRENT_MAJOR_VERSION}"
+
+          # Check if branch already exists
+          if git ls-remote --heads origin "$BRANCH_NAME" | grep -q "$BRANCH_NAME"; then
+            echo "Error: Branch $BRANCH_NAME already exists"
+            exit 1
+          fi
+
+          # Create and push the branch
+          git checkout -b "$BRANCH_NAME"
+          git push origin "$BRANCH_NAME"
+
+          # increment major version
+          NEXT_MAJOR_VERSION=$((CURRENT_MAJOR_VERSION + 1))
+          NEXT_VERSION="${NEXT_MAJOR_VERSION}.0.0"
+
+          # update release-please-manifest.json on `next` branch
+          git fetch origin next
+          git checkout -B next origin/next
+          jq --arg version "$NEXT_VERSION" '.["."] = $version' .release-please-manifest.json > temp.json && mv temp.json .release-please-manifest.json
+          git add .release-please-manifest.json
+          git commit -m "chore(release): update release-please-manifest.json to $NEXT_VERSION"
+          git push origin next