feat: add pinned-build support for protocol contracts in noir-contracts

.github/release-please-v4.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "simple",
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "group-pull-request-title-pattern": "chore(v4): Release ${version}",
+  "pull-request-header": "Pending Aztec Packages v4 release",
+  "versioning": "always-bump-patch",
+  "include-component-in-tag": false,
+  "release-search-depth": 50,
+  "commit-search-depth": 150,
+  "bootstrap-sha": "60d353cded21d7ebeed9bc64b5ae87ebba5f9a38",
+  "sequential-calls": true,
+  "changelog-sections": [
+    { "type": "feat", "section": "Features", "hidden": false },
+    { "type": "fix", "section": "Bug Fixes", "hidden": false },
+    { "type": "chore", "section": "Miscellaneous", "hidden": true },
+    { "type": "test", "section": "Miscellaneous", "hidden": true },
+    { "type": "refactor", "section": "Miscellaneous", "hidden": true },
+    { "type": "docs", "section": "Documentation", "hidden": false }
+  ],
+  "packages": {
+    ".": {
+      "release-type": "simple"
+    }
+  }
+}

.github/workflows/ci3.yml

@@ -111,6 +111,24 @@ jobs:
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: ./.github/ci3_success.sh
 
+      - name: Notify Slack on backport CI failure
+        if: failure() && startsWith(github.event.pull_request.head.ref, 'backport-to-') && endsWith(github.event.pull_request.head.ref, '-staging')
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        run: |
+          if [ -n "${SLACK_BOT_TOKEN}" ]; then
+            read -r -d '' data <<EOF || true
+            {
+              "channel": "#team-alpha",
+              "text": "CI3 failed on backport PR: <${{ github.event.pull_request.html_url }}|#${{ github.event.pull_request.number }} - ${{ github.event.pull_request.title }}>\n<https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
+            }
+          EOF
+            curl -X POST https://slack.com/api/chat.postMessage \
+              -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
+              -H "Content-type: application/json" \
+              --data "$data"
+          fi
+
       - name: Upload benchmarks
         if: env.SHOULD_UPLOAD_BENCHMARKS == '1'
         uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29

.github/workflows/deploy-network.yml

@@ -30,6 +30,10 @@ on:
         required: false
         type: boolean
         default: false
+      source_tag:
+        description: "Source tag that triggered this deploy"
+        required: false
+        type: string
   workflow_dispatch:
     inputs:
       network:
@@ -59,6 +63,10 @@ on:
         required: false
         type: boolean
         default: false
+      source_tag:
+        description: "Source tag that triggered this deploy"
+        required: false
+        type: string
 
 concurrency:
   group: deploy-network-${{ inputs.network }}-${{ inputs.namespace || inputs.network }}-${{ inputs.semver }}-${{ github.ref || github.ref_name }}
@@ -170,6 +178,22 @@ jobs:
             echo "cluster=" >> $GITHUB_OUTPUT
           fi
 
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## Deploy Network"
+            echo ""
+            echo "| Item | Value |"
+            echo "|------|-------|"
+            echo "| Network | \`${{ inputs.network }}\` |"
+            echo "| Semver | \`${{ inputs.semver }}\` |"
+            echo "| Ref | \`${{ steps.checkout-ref.outputs.ref }}\` |"
+            if [[ -n "${{ inputs.source_tag }}" ]]; then
+              echo "| Source Tag | [\`${{ inputs.source_tag }}\`](https://github.com/${{ github.repository }}/releases/tag/${{ inputs.source_tag }}) |"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
       - name: Notify Slack on failure
         if: failure()
         env:

.github/workflows/deploy-staging-public.yml

@@ -0,0 +1,94 @@
+name: Deploy to staging-public
+
+on:
+  push:
+    branches:
+      - v4
+  workflow_dispatch: {}
+
+concurrency:
+  group: deploy-staging-public
+  cancel-in-progress: true
+
+env:
+  GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+
+jobs:
+  determine-tag:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.poll-tag.outputs.tag }}
+      semver: ${{ steps.poll-tag.outputs.semver }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Read version from manifest
+        id: manifest
+        run: |
+          VERSION=$(jq -r '."."' .release-please-manifest.json)
+          echo "version=$VERSION"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Poll for tag at HEAD
+        id: poll-tag
+        run: |
+          # wait for tag to be pushed (either RC or stable release)
+          VERSION="${{ steps.manifest.outputs.version }}"
+          HEAD_SHA=$(git rev-parse HEAD)
+          MAX_ATTEMPTS=60
+          echo "Looking for tag matching v${VERSION} or v${VERSION}-rc.* at HEAD ($HEAD_SHA)"
+
+          for i in $(seq 1 $MAX_ATTEMPTS); do
+            git fetch --tags --force
+
+            TAG=$(git tag --points-at HEAD | grep -E "^v${VERSION}(-rc\.[0-9]+)?$" | sort -V | tail -n 1 || true)
+
+            if [ -n "$TAG" ]; then
+              echo "Found tag: $TAG"
+              SEMVER="${TAG#v}"
+              echo "tag=$TAG" >> $GITHUB_OUTPUT
+              echo "semver=$SEMVER" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+
+            echo "Attempt $i/$MAX_ATTEMPTS: No matching tag yet, waiting 10s..."
+            sleep 10
+          done
+
+          echo "Error: No tag found for v${VERSION} at HEAD after 10 minutes"
+          exit 1
+
+  wait-for-ci3:
+    needs: determine-tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 1
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Wait for CI3
+        run: spartan/scripts/wait_for_ci3.ts "${{ needs.determine-tag.outputs.tag }}"
+
+  deploy:
+    needs: [determine-tag, wait-for-ci3]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger deploy-network on next branch
+        run: |
+          echo "Triggering deploy-network for staging-public with semver=${{ needs.determine-tag.outputs.semver }}"
+          gh workflow run deploy-network.yml \
+            --repo "${{ github.repository }}" \
+            --ref next \
+            -f network=staging-public \
+            -f semver="${{ needs.determine-tag.outputs.semver }}" \
+            -f source_tag="${{ needs.determine-tag.outputs.tag }}"

.github/workflows/release-please.yml

@@ -134,6 +134,74 @@ jobs:
 
           echo "✅ Created tag: $TAG_NAME"
 
+  dedupe-release-notes:
+    name: Deduplicate release notes
+    needs: [release-please]
+    if: ${{ needs.release-please.outputs.release-pr }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Check if release notes branch exists
+        id: check-branch
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+        run: |
+          NOTES_BRANCH="${{ fromJSON(needs.release-please.outputs.release-pr).headBranchName }}--release-notes"
+          if git ls-remote --exit-code "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "refs/heads/$NOTES_BRANCH" >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "branch=$NOTES_BRANCH" >> $GITHUB_OUTPUT
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Release notes branch $NOTES_BRANCH does not exist, skipping deduplication"
+          fi
+
+      - name: Checkout release notes branch
+        if: steps.check-branch.outputs.exists == 'true'
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ steps.check-branch.outputs.branch }}
+          fetch-depth: 1
+          token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+
+      - name: Fetch dedupe script from target branch
+        if: steps.check-branch.outputs.exists == 'true'
+        run: |
+          git fetch origin ${{ github.ref_name }} --depth=1
+          git show origin/${{ github.ref_name }}:scripts/dedupe_release_notes.py > /tmp/dedupe_release_notes.py
+
+      - name: Configure Git
+        if: steps.check-branch.outputs.exists == 'true'
+        run: |
+          git config --global user.name AztecBot
+          git config --global user.email tech@aztecprotocol.com
+
+      - name: Deduplicate release notes
+        if: steps.check-branch.outputs.exists == 'true'
+        run: |
+          if [ -f release-notes.md ]; then
+            python3 /tmp/dedupe_release_notes.py release-notes.md
+            git add release-notes.md
+            if ! git diff --cached --quiet; then
+              git commit -m "chore: deduplicate release notes"
+              git push
+            fi
+          fi
+
+      - name: Update PR body with deduped notes
+        if: steps.check-branch.outputs.exists == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+        run: |
+          if [ -f release-notes.md ]; then
+            PR_NUMBER=${{ fromJSON(needs.release-please.outputs.release-pr).number }}
+            NOTES_SIZE=$(wc -c < release-notes.md)
+            if [ "$NOTES_SIZE" -lt 60000 ]; then
+              gh pr edit "$PR_NUMBER" --body "$(cat release-notes.md)"
+            fi
+          fi
+
   update-docs:
     name: Update docs
     env:

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "4.0.0"
+  ".": "4.0.4"
 }