feat!: Aztec v6 (@aztec-labs), block-duration-ms input, SHA-pinned actions

[alejoamiras]

Moves aztec-benchmark to Aztec v6 and unblocks aztec-standards#38.

Changes

• Aztec v6. v6 renamed its packages from @aztec/* to @aztec-labs/*, and the peers now follow at >=6.0.0-0 <7. The package version becomes 6.0.0-rc.1; v5 users stay on 5.0.1.
• New block-duration-ms input on pr-benchmark.yml and update-baseline.yml. With the local network's default 3 s blocks, a transaction can use at most 55,836 DA gas, and aztec-standards' Vault class publish needs 63,776. Setting "6000" (mainnet's block time) raises the limit to 117,624. Leaving the input empty keeps today's behaviour.
• Every action pinned to a commit SHA. The workflows used floating tags like setup-aztec@v0, so a caller pinning our workflow didn't actually pin what ran.
• Small hardening:
  • the reusable workflows no longer persist the checkout token;
  • pre-release.yml no longer uses secrets: inherit;
  • no ${{ }} inside run: blocks;
  • the action calls npx --no. The unscoped aztec-benchmark npm package belongs to someone else, and plain npx could download and run it.

Testing

• aztec-standards CI: its scratch PR fix: action name defi-wonderland/aztec-benchmark#45 ran against this branch.
  • With "6000", the Vault benchmark passes.
  • With the input omitted, it fails exactly as before, at 55,836.
  • With "6s", it stops in the first step.
  • update-baseline passes.
• Local v6 network: it reports exactly 55,836 and 117,624. The packed 6.0.0-rc.1 ran a benchmark end to end.
• Build output: the built JS is byte-identical to 5.0.1, because the Aztec imports are only used as types.

Notes

• Please squash-merge. Merging also publishes a canary build to npm; that is existing behaviour.
• Follow-ups for separate PRs: npm trusted publishing (OIDC), a CI check that actions stay pinned, and narrower workflow permissions.

Releasing 6.0.0-rc.1 (after merge)

1. Set S to the squash commit on main, then tag it: git tag -s v6.0.0-rc.1 $S -m v6.0.0-rc.1 && git push origin v6.0.0-rc.1.
2. Create the release: gh release create v6.0.0-rc.1 --verify-tag --target main --prerelease --generate-notes. The target must be main, not a SHA, or publish.yml skips publishing.
3. In the publish.yml run, confirm the head SHA is $S, then approve the Publisher environment. It publishes under the rc dist-tag, and latest stays at 5.0.1.
4. If the run was skipped, dispatch it from main instead: gh workflow run publish.yml --ref main -f version=6.0.0-rc.1.

🤖 Generated with Claude Code