ci.yml

name: CI
on:
  push:
    branches:
      - master
      - provernet ./bootstrap.sh
      - "*/ci-push*"
  merge_group:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
      - labeled
    branches-ignore: [devnet]
  workflow_dispatch:
    inputs: {}

concurrency:
  # allow parallelism in master and merge queue
  group: ci-${{ (contains(github.ref_name, 'gh-readonly-queue') || github.ref_name == 'master') && github.run_id || github.ref_name }}
  cancel-in-progress: true

env:
  CI: 1
  DOCKERHUB_PASSWORD: "${{ secrets.DOCKERHUB_PASSWORD }}"
  RUN_ID: ${{ github.run_id }}
  RUN_ATTEMPT: ${{ github.run_attempt }}
  GITHUB_TOKEN: ${{ github.token }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
  GITHUB_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}"
  GIT_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
  RUNNER_CONCURRENCY: 0
jobs:
  configure:
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false
    # Required permissions.
    permissions:
      pull-requests: read
    # Set job outputs to values from filter step.
    # Set username to a value derived from our github username.
    outputs:
      username: ${{ steps.compute_username.outputs.username }}
      base-images: ${{ steps.filter.outputs.base-images }}
      noir: ${{ steps.filter.outputs.noir }}
      noir-projects: ${{ steps.filter.outputs.noir-projects }}
      bb: ${{ steps.filter.outputs.bb }}
      yarn-project: ${{ steps.filter.outputs.yarn-project }}
      non-docs: ${{ steps.filter.outputs.non-docs }}
      non-bb: ${{ steps.filter.outputs.non-bb }}
      # Test flags:
      e2e-all: ${{ github.ref_name == 'master' || contains(github.event.pull_request.labels.*.name, 'e2e-all') || github.event_name == 'merge_group' }}
      network-all: ${{ github.ref_name == 'master' || contains(github.event.pull_request.labels.*.name, 'network-all') }}
      e2e-list: ${{ steps.e2e_list.outputs.e2e-list }}
      bench-list: ${{ steps.e2e_list.outputs.bench-list }}
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: Compute Username
        id: compute_username
        shell: bash
        env:
          REPO: "${{ github.repository }}"
          BRANCH: ${{ github.event.pull_request.head.ref || github.ref_name }}
        run: |
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            instance_name="${BRANCH//\//_}"
            echo "username=$instance_name"
            echo "username=$instance_name" >> $GITHUB_OUTPUT
          else
            echo "username=${{ github.sha }}""
            echo "username=${{ github.sha }}"" >> $GITHUB_OUTPUT
          fi
      - name: Create Job Lists
        id: e2e_list
        run: |
          set -eu
          LABELS=""
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            LABELS=$(jq -r '.pull_request.labels | map(.name) | join(",")' "${{ github.event_path }}")
          fi
          echo Labels: $LABELS
          set -x
          echo "e2e-list=$(./scripts/ci/get_e2e_jobs.sh ${{github.ref_name}} "$LABELS")" >> $GITHUB_OUTPUT
          echo "bench-list=$(./scripts/ci/get_bench_jobs.sh ${{github.ref_name}} "$LABELS")" >> $GITHUB_OUTPUT
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
        id: filter
        with:
          filters: |
            noir:
              - 'noir/noir-repo/**'
            bb:
              - 'barretenberg/cpp/**'
            noir-projects:
              - 'noir-projects/**'
            yarn-project:
              - 'yarn-project/**'
            non-bb:
              - '!(barretenberg/cpp/**)'
              # don't consider AVM stuff 'core bb'
              - barretenberg/cpp/pil/**
              - barretenberg/cpp/src/barretenberg/vm/**
              - barretenberg/cpp/src/barretenberg/**/generated/*
              - barretenberg/cpp/src/barretenberg/client_ivc/client_ivc.{hpp,cpp}
              - barretenberg/cpp/src/barretenberg/bb/main.cpp
            non-docs:
              - '!(docs/**)'

  # Used by CI build as a base image.
  base-images:
    needs: [configure]
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "Build Images"
        if: needs.configure.outputs.base-images == 'true'
        uses: ./.github/ensure-builder
        timeout-minutes: 120
        with:
          runner_type: builder-x86
          username: ${{ needs.configure.outputs.username }}
          run: |
            echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u aztecprotocolci --password-stdin
            ./build-images/bootstrap.sh ci

  # CI for noir and bb.
  ci-noir-bb:
    needs: [base-images, configure]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "CI (noir and bb)"
        uses: ./.github/ensure-builder
        # we place this here as ci-noir-bb is a dependency for rest of chain
        if: needs.configure.outputs.noir == 'true' || needs.configure.outputs.bb == 'true'
        timeout-minutes: 40
        with:
          runner_type: builder-x86
          username: ${{ needs.configure.outputs.username }}
          run: scripts/earthly-ci +ci-noir-bb

  bootstrap:
    needs: [ci-noir-bb, configure]
    runs-on: ubuntu-latest
    if: needs.configure.outputs.e2e-all == 'true' || needs.configure.outputs.non-bb == 'true'
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "Bootstrap (l1-contracts, avm-transpiler, noir-projects, yarn-project)"
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          runner_type: builder-x86
          username: ${{ needs.configure.outputs.username }}
          run: scripts/earthly-ci +bootstrap

  ci-rest:
    needs: [bootstrap, configure]
    runs-on: ubuntu-latest
    if: needs.configure.outputs.e2e-all == 'true' || (needs.configure.outputs.non-bb == 'true' && needs.configure.outputs.non-docs == 'true')
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "CI (l1-contracts, avm-transpiler, noir-projects, yarn-project)"
        uses: ./.github/ensure-builder
        timeout-minutes: 80
        with:
          runner_type: builder-x86
          username: ${{ needs.configure.outputs.username }}
          run: scripts/earthly-ci +ci-rest

  images-e2e:
    needs: [bootstrap, configure]
    if: needs.configure.outputs.e2e-all == 'true' || (needs.configure.outputs.non-docs == 'true' && needs.configure.outputs.non-bb == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "E2E Images"
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          runner_type: builder-x86
          username: ${{ needs.configure.outputs.username }}
          run: ./bootstrap.sh image-e2e

  docs:
    needs: [bootstrap, configure]
    runs-on: ubuntu-latest
    if: needs.configure.outputs.e2e-all == 'true' || needs.configure.outputs.non-bb == 'true'
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "Docs"
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          runner_type: builder-x86
          username: ${{ needs.configure.outputs.username }}
          run:
            scripts/earthly-ci +docs-with-cache --ENV=staging --PR=${{ github.event.number }} \
            --AZTEC_BOT_COMMENTER_GITHUB_TOKEN=${{ secrets.AZTEC_BOT_GITHUB_TOKEN }} \
            --NETLIFY_AUTH_TOKEN=${{ secrets.NETLIFY_AUTH_TOKEN }} \
            --NETLIFY_SITE_ID=${{ secrets.NETLIFY_SITE_ID }}

  e2e:
    needs: [images-e2e, configure]
    if: needs.configure.outputs.e2e-all == 'true' || (needs.configure.outputs.non-docs == 'true' && needs.configure.outputs.non-bb == 'true')
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        test: ${{ fromJson( needs.configure.outputs.e2e-list )}}
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: Test
        timeout-minutes: 40
        run: |
          echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u aztecprotocolci --password-stdin
          export CI=1 USE_CACHE=1
          artifact="e2e-${{matrix.test}}-$(./yarn-project/bootstrap.sh hash)"
          if ci3/test_should_run "$artifact"; then
            docker pull aztecprotocol/aztec:${{ env.GIT_COMMIT }}
            docker pull aztecprotocol/end-to-end:${{ env.GIT_COMMIT }}
            FORCE_COLOR=1 ./yarn-project/end-to-end/scripts/e2e_test.sh ${{ matrix.test }}
            ci3/cache_upload_flag "$artifact"
          fi

  # all the benchmarking end-to-end integration tests for aztec (not required to merge)
  bench-e2e:
    needs: [images-e2e, configure]
    if: needs.configure.outputs.e2e-all == 'true' || needs.configure.outputs.bench-list != '[]'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        test: ${{ fromJson( needs.configure.outputs.bench-list )}}
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: Test
        timeout-minutes: 40
        run: |
          echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u aztecprotocolci --password-stdin
          export CI=1 USE_CACHE=1
          artifact="bench-${{matrix.test}}-$(./yarn-project/bootstrap.sh hash)"
          if ci3/test_should_run "$artifact"; then
            docker pull aztecprotocol/aztec:${{ env.GIT_COMMIT }}
            docker pull aztecprotocol/end-to-end:${{ env.GIT_COMMIT }}
            export FORCE_COLOR=1
            export EARTHLY_BUILD_ARGS="${{ env.EARTHLY_BUILD_ARGS }}"
            ./yarn-project/end-to-end/scripts/e2e_test.sh ${{ matrix.test }}
            export COMMIT_HASH=${{ env.GIT_COMMIT }}
            export PULL_REQUEST=${{ github.event.pull_request.number }}
            export BRANCH=${{ github.ref_name }}
            scripts/logs/upload_logs_to_s3.sh /usr/var/log
            ci3/cache_upload_flag "$artifact"
          fi

  # Only e2e test that can't run on standard github runner
  e2e-prover-full:
    runs-on: ubuntu-latest
    needs: [images-e2e, configure]
    if: needs.configure.outputs.e2e-all == 'true'
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - uses: ./.github/ci-setup-action
      - name: "Setup and Test"
        uses: ./.github/ensure-tester
        env:
          USERNAME: ${{ needs.configure.outputs.username }}
        timeout-minutes: 50
        with:
          ttl: 50
          runner_type: 32core-tester-x86
          run: |
            export CI=1 USE_CACHE=1
            artifact="e2e-prover-full-$(./yarn-project/bootstrap.sh hash)"
            if ci3/test_should_run "$artifact"; then
              docker pull aztecprotocol/aztec:${{ env.GIT_COMMIT }}
              docker pull aztecprotocol/end-to-end:${{ env.GIT_COMMIT }}
              FORCE_COLOR=1 ./yarn-project/end-to-end/scripts/e2e_test.sh e2e_prover_full
              ci3/cache_upload_flag "$artifact"
            fi

  acir-bench:
    runs-on: ubuntu-latest
    needs: [ci-noir-bb, configure]
    if: needs.configure.outputs.e2e-all == 'true'
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - uses: ./.github/ci-setup-action
      - name: "Setup and Test"
        uses: ./.github/ensure-tester
        env:
          USERNAME: ${{ needs.configure.outputs.username }}
        timeout-minutes: 30
        with:
          runner_type: 16core-tester-x86
          run: |
            echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u aztecprotocolci --password-stdin
            export CI=1 USE_CACHE=1
            if ci3/test_should_run acir-bench-$(./barretenberg/acir_tests/bootstrap.sh hash); then
              scripts/earthly-ci ./barretenberg/acir_tests+bench-publish
              ci3/cache_upload_flag acir-bench-$(./barretenberg/acir_tests/bootstrap.sh hash)
            fi

  # TODO(ci3) fix and reinstate
  # bench-summary:
  #   if: needs.configure.outputs.e2e-all == 'true'
  #   needs:
  #     - acir-bench
  #     - bench-e2e
  #     - configure
  #   runs-on: ubuntu-latest
  #   steps:
  #     - uses: actions/checkout@v4
  #       with:
  #         fetch-depth: 100 # Downloading base benchmark from master requires access to history
  #         ref: "${{ github.event.pull_request.head.sha }}"
  #     - uses: ./.github/ci-setup-action
  #     - name: "Build and upload bench aggregate file"
  #       uses: ./.github/ensure-builder
  #       with:
  #         runner_type: builder-x86
  #         username: ${{ needs.configure.outputs.username }}
  #         run: scripts/earthly-ci ./yarn-project/scripts/+bench-aggregate
  #     - name: "Download base benchmark and package into earthly"
  #       if: github.event_name == 'pull_request'
  #       uses: ./.github/run-on-builder
  #       env:
  #         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  #         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  #         BENCH_FOLDER: "./scripts/logs/tmp/bench"
  #         PULL_REQUEST: "${{ github.event.pull_request.number }}"
  #       with:
  #         run: |
  #           # Download the base benchmark locally (requires AWS creds and .git history)
  #           mkdir -p $BENCH_FOLDER
  #           ./scripts/logs/download_base_benchmark_from_s3.sh
  #           # Package it into an earthly artifact to read from bench-comment
  #           scripts/earthly-ci ./scripts/logs+pack-base-benchmark
  #     - name: "Generate summary comment if pull request"
  #       if: github.event_name == 'pull_request'
  #       uses: ./.github/run-on-builder
  #       env:
  #         AZTEC_BOT_GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
  #       with:
  #         run: scripts/earthly-ci ./yarn-project/scripts/+bench-comment

  # barretenberg (prover) native, AVM (public VM) and Merkle tree (world state) tests
  # ran on own runner for resource reasons (memory x cpu intensive)
  bb-native-tests:
    runs-on: ubuntu-latest
    needs: [base-images, configure]
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "Setup"
        run: |
          # Ensure we can SSH into the spot instances we request
          mkdir -p ~/.ssh
          echo ${{ secrets.BUILD_INSTANCE_SSH_KEY }} | base64 --decode > ~/.ssh/build_instance_key
          chmod 600 ~/.ssh/build_instance_key
          echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u aztecprotocolci --password-stdin
      - name: "Native Prover Tests"
        env:
          GITHUB_LOG: 1
          CI: 1
          USE_CACHE: 1
        run: |
          export BRANCH=${{ needs.configure.outputs.username }}-bb-native-tests
          if ci3/test_should_run barretenberg-test-$(./barretenberg/cpp/bootstrap.sh hash); then
            ci3/bootstrap_ec2 "GITHUB_RUN_URL=$GITHUB_RUN_URL ./barretenberg/cpp/bootstrap.sh ci"
          fi

  kind-network-smoke:
    needs: [images-e2e, configure]
    if: needs.configure.outputs.e2e-all == 'true' || needs.configure.outputs.yarn-project == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: Setup and KIND Network Test
        timeout-minutes: 60
        uses: ./.github/ensure-tester
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: 8core-tester-x86
          ttl: 60
          run: |
            docker pull aztecprotocol/aztec:${{ env.GIT_COMMIT }}
            docker pull aztecprotocol/end-to-end:${{ env.GIT_COMMIT }}
            echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u aztecprotocolci --password-stdin
            cd yarn-project/end-to-end
            NAMESPACE=smoke FRESH_INSTALL=true VALUES_FILE=ci-smoke.yaml ./scripts/network_test.sh ./src/spartan/smoke.test.ts

  kind-network-test:
    needs: [images-e2e, configure]
    if: needs.configure.outputs.network-all == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        config:
          - test: reorg.test.ts
            values: ci
            runner_type: 16core-tester-x86-high-memory
            timeout: 60
          - test: 4epochs.test.ts
            values: ci
            runner_type: 16core-tester-x86
            timeout: 40
          # - test: gating-passive.test.ts
          #   values: ci
          #   runner_type: 16core-tester-x86
          #   timeout: 40
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: Setup and KIND Network Test
        timeout-minutes: ${{ matrix.config.timeout }}
        uses: ./.github/ensure-tester
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: ${{ matrix.config.runner_type }}
          spot_strategy: None # use on-demand machines
          ttl: ${{ matrix.config.timeout }}
          run: |
            export CI=1 USE_CACHE=1
            artifact="kind-network-${{matrix.config.test}}-$(./yarn-project/bootstrap.sh hash)"
            if ci3/test_should_run "$artifact"; then
              docker pull aztecprotocol/aztec:${{ env.GIT_COMMIT }}
              docker pull aztecprotocol/end-to-end:${{ env.GIT_COMMIT }}
              ./ci.sh test-kind-network ${{ matrix.config.test }} ${{ matrix.config.values }}
              ci3/cache_upload_flag "$artifact"
            fi
      - name: Copy Network Logs
        if: always()
        run: scripts/copy_from_tester yarn-project/end-to-end/scripts/network-test.log network-test.log || true

      - name: Upload Network Logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: kind-network-test-${{ matrix.config.values }}-${{ matrix.config.test }}.log
          path: network-test.log

  bb-bench:
    runs-on: ubuntu-latest
    needs: [ci-noir-bb, configure]
    if: needs.configure.outputs.bb == 'true'
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: Build Bench Binaries
        uses: ./.github/ensure-builder
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: builder-x86
          run: |
            export CI=1
            export USE_CACHE=1
            # We gate the build with this
            if ci3/test_should_run bb-bench-$(./barretenberg/cpp/bootstrap.sh hash); then
              scripts/earthly-ci --push ./barretenberg/cpp/+bench-binaries
            fi
      - name: Run Bench
        uses: ./.github/ensure-tester
        timeout-minutes: 40
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: 16core-tester-x86
          run: |
            HASH=$(ci3/cache_content_hash ./barretenberg/cpp/.rebuild_patterns)-${{ github.ref }}
            export CI=1 USE_CACHE=1
            if ci3/test_should_run bb-bench-$HASH; then
              scripts/earthly-ci --artifact ./barretenberg/cpp/+bench/bench.json --bench_mode=cache
              ci3/cache_upload_flag bb-bench-$HASH
            fi
      - name: Copy Bench.json
        run: scripts/copy_from_tester barretenberg/cpp/bench.json bench.json || true
      - name: Store benchmark result
        if: github.ref == 'refs/heads/master'
        continue-on-error: true
        uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29
        with:
          name: C++ Benchmark
          tool: "googlecpp"
          output-file-path: bench.json
          github-token: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
          auto-push: true
          alert-threshold: "105%"
          comment-on-alert: true
          fail-on-alert: false
          alert-comment-cc-users: "@ludamad @codygunton"
          max-items-in-chart: 50

  boxes-test:
    needs: [ci-rest, configure]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ github.event.pull_request.head.sha }}" }
      - uses: ./.github/ci-setup-action
      - name: Build Bench Binaries
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: builder-x86
          run: |
            export CI=1 USE_CACHE=1
            if ci3/test_should_run "boxes-test-$(./boxes/bootstrap.sh hash)"; then
              ./bootstrap.sh test-boxes
            fi

  prover-client-test:
    needs: [ci-rest, configure]
    runs-on: ubuntu-latest
    if: needs.configure.outputs.e2e-all == 'true' || needs.configure.outputs.noir == 'true' || needs.configure.outputs.bb == 'true' || needs.configure.outputs.noir-projects == 'true'
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ github.event.pull_request.head.sha }}" }
      - uses: ./.github/ci-setup-action
      - name: Test
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: builder-x86
          run: |
            export CI=1 USE_CACHE=1
            scripts/earthly-ci +prover-client-with-cache

  rough-rhino-installer:
    needs: [bootstrap, configure]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ github.event.pull_request.head.sha }}" }
      - uses: ./.github/ci-setup-action
      - name: Rough Rhino Installer Helper Script
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: builder-x86
          run: |
            scripts/earthly-ci ./spartan/releases/rough-rhino/+test-all

  protocol-circuits-gates-report:
    needs: [ci-rest, configure]
    if: needs.configure.outputs.non-docs == 'true' && needs.configure.outputs.non-bb == 'true'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "Noir Protocol Circuits Report"
        uses: ./.github/ensure-builder
        timeout-minutes: 40
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: builder-x86
          run: |
            scripts/earthly-ci --artifact ./noir-projects/+gates-report/gates_report.json
      - name: Copy Report
        run: |
          scripts/copy_from_builder ./noir-projects/gates_report.json protocol_circuits_report.json
      - name: Compare gates reports
        id: gates_diff
        uses: noir-lang/noir-gates-diff@84ada11295b9a1e1da7325af4e45e2db9f775175
        continue-on-error: true
        timeout-minutes: 1
        with:
          report: protocol_circuits_report.json
          summaryQuantile: 0 # Display any diff in gate count

      - name: Add gates diff to sticky comment
        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
        uses: marocchino/sticky-pull-request-comment@v2
        continue-on-error: true
        with:
          # delete the comment in case changes no longer impact circuit sizes
          delete: ${{ !steps.gates_diff.outputs.markdown }}
          message: ${{ steps.gates_diff.outputs.markdown }}

  public-functions-size-report:
    needs: [ci-rest, configure]
    if: needs.configure.outputs.non-docs == 'true'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with: { ref: "${{ env.GIT_COMMIT }}" }
      - name: "Aztec Public Functions Bytecode Size Report"
        timeout-minutes: 40
        uses: ./.github/ensure-builder
        with:
          username: ${{ needs.configure.outputs.username }}
          runner_type: builder-x86
          run: |
            scripts/earthly-ci --artifact ./noir-projects/+public-functions-report/public_functions_report.json
      - name: Copy Report
        run: |
          scripts/copy_from_builder noir-projects/public_functions_report.json public_functions_report.json
      - name: Compare public functions bytecode size reports
        id: public_functions_sizes_diff
        uses: noir-lang/noir-gates-diff@84ada11295b9a1e1da7325af4e45e2db9f775175
        continue-on-error: true
        timeout-minutes: 1
        with:
          report: public_functions_report.json
          header: |
            # Changes to public function bytecode sizes
          brillig_report: true
          brillig_report_bytes: true
          summaryQuantile: 0 # Display any diff in bytecode size count

      - name: Add bytecode size diff to sticky comment
        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
        uses: marocchino/sticky-pull-request-comment@v2
        continue-on-error: true
        timeout-minutes: 1
        with:
          header: public_functions_size
          delete: ${{ !steps.public_functions_sizes_diff.outputs.markdown }}
          message: ${{ steps.public_functions_sizes_diff.outputs.markdown }}

  merge-check:
    runs-on: ubuntu-latest
    needs:
      - configure
      - base-images
      - bootstrap
      - ci-noir-bb
      - ci-rest
      - images-e2e
      - docs
      - e2e
      - e2e-prover-full
      - bb-native-tests
      - kind-network-smoke
      - kind-network-test
      - boxes-test
      - rough-rhino-installer
    if: always()
    outputs:
      failure: ${{ steps.set_failed_jobs.outputs.failure }}
      failed_jobs: ${{ steps.set_failed_jobs.outputs.failed_jobs }}
    steps:
      - name: Check for Failures and Set Output
        id: set_failed_jobs
        env:
          NEEDS_JOBS_JSON: ${{ toJson(needs) }}
        run: |
          echo "Processing failed jobs..."
          failed_jobs=$(echo "$NEEDS_JOBS_JSON" | jq -r 'to_entries[] | select(.value.result == "failure") | .key' | paste -sd "," -)
          echo "$failed_jobs" > .failed
          echo "failure=${{contains(needs.*.result, 'failure')}}" >> $GITHUB_OUTPUT
          echo "failed_jobs=$failed_jobs" >> $GITHUB_OUTPUT

      - name: Report overall success (non-draft)
        if: github.event.pull_request.draft == false
        env:
          # We treat any skipped or failing jobs as a failure for the workflow as a whole.
          FAIL: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: |
          if [[ $FAIL == true ]]; then
              echo "Jobs failed: $(cat .failed), merging not allowed."
              exit 1
          else
              echo "All jobs succeeded, merge allowed."
              exit 0
          fi
      - name: Block merge (draft)
        if: github.event.pull_request.draft
        run: echo "Can't merge drafts." && exit 1

  notify:
    runs-on: ubuntu-latest
    needs:
      - merge-check
    if: github.event.pull_request.draft == false && github.ref == 'refs/heads/master' && failure()
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Get Authors of Recent Commit
        id: get_authors
        run: |
          git fetch --depth=1 origin ${{ github.sha }}
          authors=$(git log -1 --pretty=format:'%an <%ae>' ${{ github.sha }})
          echo "authors=${authors}" >> $GITHUB_OUTPUT

      - name: Send notification to aztec3-ci channel if workflow failed on master
        uses: slackapi/slack-github-action@v1.25.0
        with:
          payload: |
            {
              "text": "Master Github Actions failure",
              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
              "authors": "${{ steps.get_authors.outputs.authors }}",
              "failed_jobs": "${{ needs.merge-check.outputs.failed_jobs }}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFY_WORKFLOW_TRIGGER_URL2 }}