feat!: Aztec v6 (@aztec-labs), block-duration-ms input, SHA-pinned actions

.github/workflows/ci.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out github repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Use Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.17.0
           cache: "yarn"

.github/workflows/pr-benchmark.yml

@@ -35,6 +35,10 @@ on:
         description: "Include per-circuit gate breakdown in the report"
         type: boolean
         default: false
+      block-duration-ms:
+        description: "Local-network block duration in ms, exported as SEQ_BLOCK_DURATION_MS. Empty keeps the Aztec default (3000). 6000 matches mainnet's block duration and raises the per-tx DA gas cap from 55836 to 117624."
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -56,14 +60,28 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: ${{ inputs.timeout }}
     steps:
+      - name: Configure block duration
+        if: inputs.block-duration-ms != ''
+        env:
+          BLOCK_DURATION_MS: ${{ inputs.block-duration-ms }}
+        run: |
+          # Aztec parses this with parseFloat ("6s" = 6 ms). Never echo the value: a newline in it would run as a workflow command.
+          if [[ ! "$BLOCK_DURATION_MS" =~ ^[1-9][0-9]*$ ]]; then
+            echo "::error::block-duration-ms must be a positive integer number of milliseconds"
+            exit 1
+          fi
+          echo "SEQ_BLOCK_DURATION_MS=$BLOCK_DURATION_MS" >> "$GITHUB_ENV"
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
+          # PR code and third-party installers run in this job; keep the write-scoped token off disk.
+          persist-credentials: false
 
       - name: Setup Aztec environment
-        uses: AztecProtocol/aztec-ci-actions/actions/setup-aztec@v0
+        uses: AztecProtocol/aztec-ci-actions/actions/setup-aztec@431859e477234b8690eb1f80d1305d2e34f10f1b # v0.1.1
         with:
           start-pxe: "true"
           run-codegen: "true"
@@ -77,11 +95,11 @@ jobs:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
           encoded=$(echo "${BASE_REF}" | sed 's/\//-/g')
-          echo "base-ref-encoded=${encoded}" >> $GITHUB_OUTPUT
+          echo "base-ref-encoded=${encoded}" >> "$GITHUB_OUTPUT"
           if [[ "${BASE_REF}" == "main" ]]; then
-            echo "workflow=${BASELINE_WORKFLOW}" >> $GITHUB_OUTPUT
+            echo "workflow=${BASELINE_WORKFLOW}" >> "$GITHUB_OUTPUT"
           else
-            echo "workflow=${PR_WORKFLOW}" >> $GITHUB_OUTPUT
+            echo "workflow=${PR_WORKFLOW}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Download baseline artifact
@@ -128,10 +146,13 @@ jobs:
         continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          node_ids=$(gh api "/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
+          node_ids=$(gh api "/repos/${REPO}/issues/${PR_NUMBER}/comments" \
             --paginate --jq '.[] | select(.body | contains("<!-- benchmark-diff -->")) | .node_id')
           for node_id in $node_ids; do
+            # shellcheck disable=SC2016 # $id is a GraphQL variable, not shell
             gh api graphql -f query='
               mutation($id: ID!) {
                 minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
@@ -141,7 +162,7 @@ jobs:
           done
 
       - name: Comment diff on PR
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body-path: benchmark-comparison.md
@@ -159,10 +180,10 @@ jobs:
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
           encoded=$(echo "${HEAD_REF}" | sed 's/\//-/g')
-          echo "head-ref-encoded=${encoded}" >> $GITHUB_OUTPUT
+          echo "head-ref-encoded=${encoded}" >> "$GITHUB_OUTPUT"
 
       - name: Upload baseline
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: benchmark-baseline-${{ steps.encode-head.outputs.head-ref-encoded }}
           path: ${{ env.BENCH_DIR }}/*${{ env.CURRENT_SUFFIX }}.benchmark.json

.github/workflows/pre-release.yml

@@ -8,8 +8,7 @@ permissions:
 
 jobs:
   pre-release:
-    uses: AztecProtocol/aztec-ci-actions/.github/workflows/pre-release.yml@v0
+    uses: AztecProtocol/aztec-ci-actions/.github/workflows/pre-release.yml@431859e477234b8690eb1f80d1305d2e34f10f1b # v0.1.1
     with:
       run-compile: false
       run-codegen: false
-    secrets: inherit

.github/workflows/publish.yml

@@ -33,10 +33,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out github repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Use Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.17.0
           cache: "yarn"
@@ -76,19 +76,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out github repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Use Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.17.0
           cache: "yarn"
           registry-url: "https://registry.npmjs.org"
 
       - name: Validate input version matches package.json
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.version != ''
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
         run: |
-          INPUT_VERSION="${{ github.event.inputs.version }}"
           PKG_VERSION=$(node -p "require('./package.json').version")
           echo "Input version: $INPUT_VERSION"
           echo "package.json version: $PKG_VERSION"
@@ -99,9 +100,10 @@ jobs:
 
       - name: Validate release tag matches package.json
         if: github.event_name == 'release'
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          TAG_VERSION="${{ github.event.release.tag_name }}"
-          TAG_VERSION="${TAG_VERSION#v}"   # Strip an optional leading "v"
+          TAG_VERSION="${RELEASE_TAG#v}"   # Strip an optional leading "v"
           PKG_VERSION=$(node -p "require('./package.json').version")
           echo "Release tag version: $TAG_VERSION"
           echo "package.json version: $PKG_VERSION"

.github/workflows/update-baseline.yml

@@ -19,6 +19,10 @@ on:
         description: "Suffix for benchmark report files"
         type: string
         default: "_latest"
+      block-duration-ms:
+        description: "Local-network block duration in ms, exported as SEQ_BLOCK_DURATION_MS. Empty keeps the Aztec default (3000). 6000 matches mainnet's block duration and raises the per-tx DA gas cap from 55836 to 117624."
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -34,13 +38,27 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: ${{ inputs.timeout }}
     steps:
+      - name: Configure block duration
+        if: inputs.block-duration-ms != ''
+        env:
+          BLOCK_DURATION_MS: ${{ inputs.block-duration-ms }}
+        run: |
+          # Aztec parses this with parseFloat ("6s" = 6 ms). Never echo the value: a newline in it would run as a workflow command.
+          if [[ ! "$BLOCK_DURATION_MS" =~ ^[1-9][0-9]*$ ]]; then
+            echo "::error::block-duration-ms must be a positive integer number of milliseconds"
+            exit 1
+          fi
+          echo "SEQ_BLOCK_DURATION_MS=$BLOCK_DURATION_MS" >> "$GITHUB_ENV"
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
+          # Dependency scripts and third-party installers run in this job; keep the write-scoped token off disk.
+          persist-credentials: false
 
       - name: Setup Aztec environment
-        uses: AztecProtocol/aztec-ci-actions/actions/setup-aztec@v0
+        uses: AztecProtocol/aztec-ci-actions/actions/setup-aztec@431859e477234b8690eb1f80d1305d2e34f10f1b # v0.1.1
         with:
           start-pxe: "true"
           run-codegen: "true"
@@ -61,10 +79,10 @@ jobs:
           BRANCH_NAME: ${{ github.ref_name }}
         run: |
           encoded=$(echo "${BRANCH_NAME}" | sed 's/\//-/g')
-          echo "branch-encoded=${encoded}" >> $GITHUB_OUTPUT
+          echo "branch-encoded=${encoded}" >> "$GITHUB_OUTPUT"
 
       - name: Upload baseline artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: benchmark-baseline-${{ steps.encode.outputs.branch-encoded }}
           path: ${{ env.BENCH_DIR }}/*${{ env.BENCH_SUFFIX }}.benchmark.json