refactor: aztec l1 contracts deployed w/ forge (#18622)

Part of
https://linear.app/aztec-labs/issue/A-316/consolidate-contract-deployments

This PR refactors the deployment pipeline for governance and rollup
contracts. The typescript deployment mechanism is fully replaced with
Forge. The forge scripts take configuration using environment variables.
They write their deployed contract addresses to a JSON file, parsed by
the caller. The results are intended to be exactly the same, barring
minor things (e.g. deploying the mock zkpassport verifier in more
cases).

Core files added:
    - DeployAztecL1Contracts.s.sol - Full deployment (fresh network)
    - DeployRollupForUpgrade.s.sol - Upgrade-only deployment
    - DeployRollupLib.sol - Shared rollup deployment library
- DeploymentConfiguration.sol - Full deployment config. Reads env vars,
provides defaults based on network label
- RollupConfiguration.sol - Rollup-specific config (genesis state,
staking stuff, initial validators etc.)

Then lots of work making sure the right glue was in place for the
typescript side.

#
Why move to Forge for deployments?

L1 contract deployment was being done in TypeScript but clearly from the
network launching using foundry scripts, this was not ideal.

Benefits:
- forge --verify automatically posts to etherscan for us, avoiding the
complicated custom logic we had to implement
- forge simulation means we catch any problems in the entire deployment
flow early. Stuff like the previous validateConfig() that guarded
against reverts are now redundant.
- forge is able to broadcast these in transaction batches, I got 2-3
slots on Sepolia for a deploy (24-40s)
- better separation of concerns, l1-contracts now can fully own the
deployment
- foundry tests are very effective at asserting things about our
deployments under different conditions

Weirdness:
- we work around a problem in solidity where MockBlobLib was not
deployable through forge but it feels a bit hacky. I think it's
preferable to needing to rebuild with a different forge profile like
ignition-monorepo did.

Cut features:
- Deploying with a salt is no longer supported. While nice for
deterministic deployments, the reason the salt was useful before was
mainly to batch deployments. We do this with Forge, so forego the
complexity of supporting this.
This is feasible to bring back if it comes up, just would add a bunch of
conditionality to the script.

Comments on future work:
- It feels like the definition of networks is a bit sprawling and a bit
hard to analyze, as the env vars that trigger deployment can be set very
high up in the stack, in e.g. test scenario YAMLs. It would be best IMO
to make each value only defined in a specific module. Given our limited
set of distinct scenarios, we could lean in to the network label
approach like in previous ethereum/config.ts (and now
DeploymentConfiguration).

In that world, l1-contracts would choose the parameters based on a
network label and no other part of the stack could inject values thru
env vars, making analysis easier. This would be more like the
ignition-monorepo deploys (but they had fewer variations to contend
with).

For now it is a bit of a mix as network-specific governance
configuration definitions (local, staging, testnet, mainnet) from
TypeScript's config.ts have been moved to DeploymentConfiguration.sol
but it allows for a lot to be overridden with env variables.

Author: ludamad

.github/ci3.sh

@@ -134,7 +134,7 @@ function main {
     exit 0
   fi
   check_cache
-  echo_header "Run CI"
+  echo_header "Run ${CI_MODE} CI"
   exec ./ci.sh "${CI_MODE}"
 }
 

docs/developer_versioned_docs/version-v3.0.0-nightly.20251212/docs/aztec-cli/cli_reference.md

@@ -1418,10 +1418,6 @@ Options:
   Mnemonic for L1 accounts. Will be used
   *Environment: `$MNEMONIC`*
 
-- `--local-network.deployAztecContractsSalt <value>`
-  Numeric salt for deploying L1 Aztec contracts before starting the local network. Needs mnemonic or private key to be set.
-  *Environment: `$DEPLOY_AZTEC_CONTRACTS_SALT`*
-
 **API**
 
 - `--port <value>` (default: `8080`)

docs/docs-developers/docs/aztec-cli/cli_reference.md

@@ -617,7 +617,6 @@ Options:
                                      deployment (default: 0)
   -c, --l1-chain-id <number>         Chain ID of the ethereum host (default:
                                      31337, env: L1_CHAIN_ID)
-  --salt <number>                    The optional salt to use in deployment
   --json                             Output the contract addresses in JSON
                                      format
   --test-accounts                    Populate genesis state with initial fee
@@ -1418,10 +1417,6 @@ Options:
   Mnemonic for L1 accounts. Will be used
   *Environment: `$MNEMONIC`*
 
-- `--local-network.deployAztecContractsSalt <value>`
-  Numeric salt for deploying L1 Aztec contracts before starting the local network. Needs mnemonic or private key to be set.
-  *Environment: `$DEPLOY_AZTEC_CONTRACTS_SALT`*
-
 **API**
 
 - `--port <value>` (default: `8080`)

docs/docs-network/reference/cli_reference.md

@@ -57,9 +57,6 @@ tags:
     --local-network.l1Mnemonic <value>                                             (default: test test test test test test test test test test test junk)($MNEMONIC)
           Mnemonic for L1 accounts. Will be used
 
-    --local-network.deployAztecContractsSalt <value>                                                                                             ($DEPLOY_AZTEC_CONTRACTS_SALT)
-          Numeric salt for deploying L1 Aztec contracts before starting the local network. Needs mnemonic or private key to be set.
-
   API
 
     --port <value>                                                           (default: 8080)                                               ($AZTEC_PORT)

l1-contracts/bootstrap.sh

@@ -61,13 +61,13 @@ function build_src {
     git submodule update --init --recursive ./lib
 
     # Compile contracts
-    # Build everything in src and test (except tests that need generated verifier).
-    forge build $(find src test -name '*.sol' ! -name 'shouting.t.sol')
+    # Build everything in src and test (except scripts that need generated verifier).
+    forge build $(find src test -name '*.sol' ! -name 'shouting.t.sol' ! -path 'test/script/*' )
 
     # Output storage information for the rollup contract.
     forge inspect --json src/core/Rollup.sol:Rollup storage > ./out/Rollup.sol/storage.json
 
-    cache_upload $artifact out
+    cache_upload $artifact out cache
   fi
 }
 
@@ -87,15 +87,14 @@ function build_verifier {
     fi
 
     # Build the generated verifier contract with optimization.
-    forge build $(find generated -name '*.sol') \
-      --optimize \
-      --optimizer-runs 1 \
-      --no-metadata
-
-    # Build the one test that imports the verifier.
-    forge build test/shouting.t.sol
-
-    cache_upload $artifact out generated
+    # Build the scripts that rely on the verifier. These are mutually exclusive with the build in build_src.
+    forge build \
+      $(find generated -name '*.sol') \
+      test/shouting.t.sol \
+      script/deploy/*.s.sol \
+      tests/scripts/*.t.sol
+
+    cache_upload $artifact out cache generated
   fi
 }
 

l1-contracts/foundry.toml

@@ -9,7 +9,6 @@ libs = ['lib']
 solc = "./solc-0.8.27"
 evm_version = 'prague'
 optimizer = true
-
 match_path = "test/**/*.t.sol"
 # Helper to get all the contract names in the src/governance and src/core directories
 # find ./src/governance ./src/core -type f -name "*.sol" -exec grep -h "^contract [A-Za-z]" {} \; | sed -E 's/contract ([A-Za-z0-9_]+).*/"\1"/' | tr "\n" ", "
@@ -60,9 +59,8 @@ fs_permissions = [
   { access = "read", path = "./test/staking_asset_handler/zkpassport/fixtures/valid_public_inputs.json" },
   { access = "read", path = "./test/fixtures/boosted_rewards/shares.json" },
   { access = "read", path = "./test/fixtures/boosted_rewards/activity_scores.json" },
-  { access = "read", path = "./script/registration_data.json" },
+  { access = "read", path = "./script/registration_data.json" }
 ]
-
 no_match_contract = "(ScreamAndShoutTest|UniswapPortalTest|MerkleCheck)"
 
 [fmt]
@@ -78,7 +76,6 @@ ignore = ["./lib/**"]
 exclude_lints = [
   "unused-import",   # Mostly in test code
   "incorrect-shift", # Throws warnings on construction of bitmasks
-
   "asm-keccak256", # https://github.com/AztecProtocol/aztec-packages/issues/16808
 
   # Silencing due to just being style changes
@@ -91,7 +88,6 @@ exclude_lints = [
 [rpc_endpoints]
 mainnet_fork = "https://mainnet.infura.io/v3/9928b52099854248b3a096be07a6b23c"
 
-
 [profile.production]
 remappings = [
   "@oz/=lib/openzeppelin-contracts/contracts/",