refactor(ci3): consume ci3 as a shared submodule - #25516

Replaces this repo's in-tree ci3/ with the shared repo aztec-labs-eng/ci3, which was split out of aztec-node's copy with its full history (531 commits).

Why

The two copies had drifted: 43 files differed, and this repo's version was months behind on the logic both share. Examples of what this repo picks up:

• cache_content_hash: ordered include/exclude patterns, where !-negation and last-match-wins are supported.
• docker_isolate: the container-name reclaim race fix (a same-name sibling is waited out instead of killed mid-run).
• source_refname: ci_default_branch / ci_dashboard_section, replacing a hardcoded master.
• deploy_npm: per-channel npm dist-tags instead of everything sharing prerelease.
• release_prep_package_json: --check validation and scoped-resolutions mode.
• log_ci_run: dashboard sections scoped by <org>/<repo>, which is what makes this repo's runs show up on the dashboard landing page at all — today they land in the legacy unscoped ci-run-prs key and are invisible there.

What is in this PR

• ci3/ becomes a submodule pinned to main, declared shallow = true.
• Scripts this repo uses move to scripts/: assert_public_release, gcp_artifact_login, publish_npm_release, and merge_train_failure_slack_notify as scripts/merge-train/slack-notify.sh. Call sites are updated. publish_npm_release moves into the shared ci3 with feat: pack mode for deploy_npm and a trusted-publishing publisher aztec-labs-eng/ci3#2. Removed because nothing calls them: merge_train_stale_check, release_canary_slack_notify (hardcoded to a canary branch) and npm/.npmrc. merge-queue-dequeue-notify.yml loses its dequeued job (there is no merge queue) and becomes merge-train-notify.yml, which keeps the post when a merge-train PR merges.
• ci.sh and bootstrap.sh check the submodule is initialised and say how to fix it, since both source ci3 on their first line. bootstrap.sh still owns pulling the remaining submodules.
• Every checkout of this repository is followed by a step that initialises only the ci3 submodule (21 checkouts across 19 workflows). Workflows can use ci3 without naming it, through a repo script that sources it, so this does not try to track which ones do. submodules: true is deliberately not used: here it would also clone noir-repo and the contract libraries into every job. The step is a no-op on refs from before ci3 became a submodule, which the sync and port workflows check out.
• ci.sh and the two barretenberg benchmark scripts stop re-sourcing source_redis, source_refname and source_cache, which ci3/source already includes.
• In the shared repo, bootstrap_ec2 initialises the ci3 submodule on the remote EC2 instance (its shallow fetch does not bring submodules) and derives the checkout directory from GITHUB_REPOSITORY rather than hardcoding a repo name.

Known deltas to work through

This is a draft because adopting the shared version changes behaviour that was repo-specific here:

1. Merge-train hooks in bootstrap_ec2. The old copy called merge_train_failure_slack_notify and release_canary_slack_notify from bootstrap_ec2; the shared version has no such calls. The scripts still exist in ci3-local/ and the merge-queue-dequeue-notify.yml path still works, but these two call sites are currently dropped. Resolved: the canary notifier had no live use and is removed. Merge-train failures now post from a Notify merge-train failure step in ci3.yml, which links the build log (CI_LOG_ID).
2. Merge-train and merge-queue policy in run_test_cmd. The shared version tracks history and notifies flakes for main-branch runs; this repo's keyed off gh-readonly-queue/, backport-to-v2-staging and the spartan trains. Needs a config knob rather than a hardcoded branch list.
3. master vs the default branch. CI_FULL now comes from ci_default_branch. Checked: it reads the remote's default branch, so next here.
4. GCP secret name. The shared bootstrap_ec2 exports GCP_HELM_SA_KEY_B64; this repo previously exported GCP_PRIVATE_NPM_DEPLOY_B64. Checked: only bootstrap_ec2 uses the name, to pass the key from the runner to the instance, so the rename is self-contained.
5. npm auth path. The shared deploy_npm sources source_npm_auth; this repo used NPM_CONFIG_GLOBALCONFIG with ci3/npm/.npmrc. That file was unreferenced and is removed. To confirm with a ci-release-pr run.
6. Instance naming. Merge-train PRs previously got a commit-sha suffix so concurrent trains did not reap each other; the shared bootstrap_ec2 does not do that. Likely covered: .github/ci3.sh already sets INSTANCE_POSTFIX to the PR's commit count for merge-train PRs, which separates their instances.

Each is a candidate for a per-repo config file in the shared repo rather than a fork of the script.

Depends on

The matching aztec-node PR, which is the pilot consumer and will land first.

Rebuilt on next (latest: 2026-11-05)

Rebased onto current next, and ci3 pinned to ci3 main (a379ffc).

• docs: move the docs site back into aztec-packages, with v6.0.0 for mainnet and testnet #25691 changed this repo's in-tree ci3/run_compose_test: a failed docker compose up now fails the test. The in-tree copy is dropped here; the change was ported to the shared ci3 in fix: a failed docker compose up fails run_compose_test aztec-labs-eng/ci3#9, which the pin includes.
• Explicit test retries (feat(ci3)!: explicit test retries and per-entry Slack routing aztec-labs-eng/ci3#3, breaking): the shared ci3 retries a failing test only when a matching .test_patterns.yml entry sets retry: true; owners no longer grant a retry. All 43 entries with owners now set it, so the same tests stay tolerated as flakes. aztec-node made the same change in its bump.
• Picked up from ci3 since the last pin:
  • runner logs published to S3, which fixes the dead "Parent Log" links;
  • one log_publish for every log write;
  • no SSH tunnel to the CI Redis;
  • the dashboard's server API removed;
  • bench_upload;
  • CURRENT_VERSION dropped (unused here: only the docs version scripts have a local variable of that name);
  • build instances init only the ci3 submodule, without ./bootstrap.sh init.
• The 2026-10-22 CI failure was labs-patches patch 0020 not applying to the labs pin. next has since fixed that (e63137d).

Earlier rebuild (2026-10-22)

Rebuilt on current next with the same net effect, pinned to ci3 b505e87, which carries aztec-node's ci3/ changes since the split. Changes to this repo's ci3/ since the original base, and where they went:

• chore(ci): remove claudebox.yml and backport.yml; ports run through ClaudeBox port-to-* labels #25533 (ClaudeBox kickoffs removed from the merge-train and canary notifiers): carried with those scripts into ci3-local/. Its run_test_cmd flake-list edit applies to policy this repo no longer controls; see delta 2 above. The shared slack_notify_with_claudebox_kickoff stays, since aztec-node still uses it.
• refactor(native-packages): publish wsdb and kvdb under the @aztec-labs npm scope #25545 (publish_npm_release accepts @aztec-labs): carried into ci3-local/.
• feat(ci3): scope dashboard sections by repository #25561 (dashboard sections scoped by repository): already in the shared ci3, which it was ported from.
• chore: bump Foundry to 1.8.5 #25602, feat(bb)!: build wasm with exception handling; node 26, wasi-sdk 34 #25669 (Foundry 1.8.5; node 26 and wasi-sdk 34 build images): the shared ci3 is on the same devbox:3.2/build:3.2 images, and pins this repo's rebuilt AMIs, so this repo's AMIs carry over unchanged. chore: bump Foundry to 1.8.5 #25602's ami_update.sh fix for the newer aws_request_instance interface is adopted there too.

ipc-runtime/bootstrap.sh has since started calling assert_public_release, which is updated to the ci3-local/ path along with the other callers.

Also fixed in an earlier rebuild: merge-queue-dequeue-notify.yml runs ci3-local/merge_train_failure_slack_notify, which calls ci3/slack_notify, but its checkouts were not getting the submodule, so dequeue notifications would have failed.

next no longer has a merge queue (the last merge_group run was 2026-09-17), so deltas 1 and 2 above matter less than when they were written: they describe merge-queue and merge-train behaviour.