chore: devnet fixes (#20403)

More fixes needed for devnet

Author: alexghr

.github/workflows/devnet-deploys.yml

@@ -80,3 +80,13 @@ jobs:
       namespace: ${{ needs.tag.outputs.namespace }}
       ref: ${{ needs.tag.outputs.ref }}
       deploy_contracts: ${{ needs.tag.outputs.patch == '0' }}
+
+  fund:
+    needs: [tag, deploy]
+    uses: ./.github/workflows/ensure-funded-environment.yml
+    secrets: inherit
+    with:
+      environment: devnet
+      namespace: ${{ needs.tag.outputs.namespace }}
+      low_watermark: '5.0'
+      high_watermark: '10.0'

.github/workflows/ensure-funded-environment.yml

@@ -19,6 +19,10 @@ on:
         required: false
         type: string
         default: '1.0'
+      namespace:
+        description: 'Kubernetes namespace override (e.g., v4-devnet-1). Sets NAMESPACE before sourcing env file.'
+        required: false
+        type: string
   workflow_dispatch:
     inputs:
       environment:
@@ -42,6 +46,10 @@ on:
         required: false
         type: string
         default: '1.0'
+      namespace:
+        description: 'Kubernetes namespace override (e.g., v4-devnet-1)'
+        required: false
+        type: string
 
 concurrency:
   group: ensure-funded-environment-${{ inputs.environment }}
@@ -103,6 +111,7 @@ jobs:
         env:
           FUNDING_PRIVATE_KEY: ${{ env.FUNDING_PRIVATE_KEY }}
           GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          NAMESPACE: ${{ inputs.namespace }}
         run: |
           cd spartan/scripts
 

.github/workflows/ensure-funded-environments.yml

@@ -30,17 +30,20 @@ jobs:
       max-parallel: 1
       fail-fast: false
       matrix:
-        environment: 
+        environment:
           - staging-public
           - staging-ignition
           - next-net
           - tps-scenario
           - testnet
           - devnet
-          - devnet-next
+        include:
+          - environment: devnet
+            namespace: v4-devnet-1
     uses: ./.github/workflows/ensure-funded-environment.yml
     with:
       environment: ${{ matrix.environment }}
+      namespace: ${{ matrix.namespace }}
       low_watermark: ${{ inputs.low_watermark || '5.0' }}
       high_watermark: ${{ inputs.high_watermark || '10.0' }}
     secrets: inherit

spartan/environments/devnet.env

@@ -1,9 +1,17 @@
 GCP_REGION=us-west1-a
 CLUSTER=aztec-gke-private
 
-NETWORK=${NETWORK:-$NAMESPACE}
+NETWORK="devnet"
 NAMESPACE=${NAMESPACE:-devnet}
 
+# Compute mnemonic index offset from namespace to avoid nonce conflicts
+# between concurrent devnets sharing the same mnemonic on the same L1.
+# Namespace format: v<MAJOR>-devnet-<ITERATION> (e.g., v4-devnet-2)
+MNEMONIC_INDEX_OFFSET=0
+if [[ "${NAMESPACE}" =~ ^v([0-9]+)-devnet-([0-9]+)$ ]]; then
+  MNEMONIC_INDEX_OFFSET=$(( ${BASH_REMATCH[1]} * 100000 + (${BASH_REMATCH[2]} - 1) * 10000 ))
+fi
+
 CREATE_ETH_DEVNET=false
 ETHEREUM_CHAIN_ID=11155111
 ETHEREUM_RPC_URLS=REPLACE_WITH_GCP_SECRET
@@ -13,17 +21,18 @@ ETHEREUM_CONSENSUS_HOST_API_KEY_HEADERS=REPLACE_WITH_GCP_SECRET
 
 FUNDING_PRIVATE_KEY=REPLACE_WITH_GCP_SECRET
 LABS_INFRA_MNEMONIC=REPLACE_WITH_GCP_SECRET
+LABS_INFRA_MNEMONIC_SECRET_NAME=sepolia-labs-devnet-mnemonic
 ROLLUP_DEPLOYMENT_PRIVATE_KEY=REPLACE_WITH_GCP_SECRET
 OTEL_COLLECTOR_ENDPOINT=REPLACE_WITH_GCP_SECRET
 
-SNAPSHOT_BUCKET_DIRECTORY=${SNAPSHOT_BUCKET_DIRECTORY:-"devnet/$NETWORK/snapshots"}
-BLOB_BUCKET_DIRECTORY=${BLOB_BUCKET_DIRECTORY:-"devnet/$NETWORK/blobs"}
+SNAPSHOT_BUCKET_DIRECTORY=${SNAPSHOT_BUCKET_DIRECTORY:-"devnet/$NAMESPACE/snapshots"}
+BLOB_BUCKET_DIRECTORY=${BLOB_BUCKET_DIRECTORY:-"devnet/$NAMESPACE/blobs"}
 R2_ACCESS_KEY_ID=REPLACE_WITH_GCP_SECRET
 R2_SECRET_ACCESS_KEY=REPLACE_WITH_GCP_SECRET
 
 CREATE_ROLLUP_CONTRACTS=${CREATE_ROLLUP_CONTRACTS:-false}
 VERIFY_CONTRACTS=false
-REDEPLOY_ROLLUP_CONTRACTS=false
+REDEPLOY_ROLLUP_CONTRACTS=${REDEPLOY_ROLLUP_CONTRACTS:-false}
 USE_NETWORK_CONFIG=${USE_NETWORK_CONFIG:-true}
 
 DEPLOY_INTERNAL_BOOTNODE=false
@@ -39,14 +48,17 @@ FLUSH_ENTRY_QUEUE=true
 VALIDATOR_REPLICAS=1
 VALIDATORS_PER_NODE=1
 TOTAL_VALIDATORS=$((VALIDATOR_REPLICAS * VALIDATORS_PER_NODE))
-VALIDATOR_INDICES=$(seq -s ',' 1 $TOTAL_VALIDATORS)
+AZTEC_TARGET_COMMITTEE_SIZE=1
+
+VALIDATOR_MNEMONIC_START_INDEX=$((1 + MNEMONIC_INDEX_OFFSET))
+VALIDATOR_INDICES=$(seq -s ',' $VALIDATOR_MNEMONIC_START_INDEX $((VALIDATOR_MNEMONIC_START_INDEX + TOTAL_VALIDATORS - 1)))
+VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=$((5000 + MNEMONIC_INDEX_OFFSET))
 PUBLISHERS_PER_VALIDATOR_KEY=1
-VALIDATOR_PUBLISHER_MNEMONIC_START_INDEX=5000
 SEQ_MIN_TX_PER_BLOCK=0
 SEQ_MAX_TX_PER_BLOCK=32
 
+PROVER_PUBLISHER_MNEMONIC_START_INDEX=$((8000 + MNEMONIC_INDEX_OFFSET))
 PUBLISHERS_PER_PROVER=1
-PROVER_PUBLISHER_MNEMONIC_START_INDEX=8000
 PROVER_REPLICAS=1
 PROVER_AGENTS_PER_PROVER=4
 
@@ -58,8 +70,8 @@ PROVER_RESOURCE_PROFILE="dev"
 DEBUG_FORCE_TX_PROOF_VERIFICATION=true
 
 RPC_INGRESS_ENABLED=true
-RPC_INGRESS_HOSTS="["$NETWORK.aztec-labs.com"]"
-RPC_INGRESS_STATIC_IP_NAME=$NETWORK-rpc-ip
-RPC_INGRESS_SSL_CERT_NAMES="["$NETWORK-rpc-cert"]"
+RPC_INGRESS_HOSTS="[\"$NAMESPACE.aztec-labs.com\"]"
+RPC_INGRESS_STATIC_IP_NAME=$NAMESPACE-rpc-ip
+RPC_INGRESS_SSL_CERT_NAMES="[\"$NAMESPACE-rpc-cert\"]"
 
 WS_NUM_HISTORIC_BLOCKS=300

spartan/scripts/wait_for_ci3.ts

@@ -38,23 +38,35 @@ function sleep(ms: number): Promise<void> {
 }
 
 async function main(): Promise<void> {
-  // 1. Resolve tag SHA
-  const tagSha = execSync(
-    `gh api repos/${repo}/git/ref/tags/${tag} --jq '.object.sha'`,
-    {
-      encoding: "utf-8",
-    },
-  ).trim();
+  // 1. Resolve tag SHA (dereference annotated tags to the underlying commit)
+  const ref = JSON.parse(
+    execSync(
+      `gh api repos/${repo}/git/ref/tags/${tag}`,
+      { encoding: "utf-8" },
+    ),
+  );
+
+  let commitSha: string = ref.object.sha;
+  if (ref.object.type === "tag") {
+    // Annotated tag — resolve the tag object to its commit
+    const tagObj = JSON.parse(
+      execSync(
+        `gh api repos/${repo}/git/tags/${ref.object.sha}`,
+        { encoding: "utf-8" },
+      ),
+    );
+    commitSha = tagObj.object.sha;
+  }
 
-  console.log(`Waiting for CI3 run for tag ${tag} (sha: ${tagSha})`);
+  console.log(`Waiting for CI3 run for tag ${tag} (commit: ${commitSha})`);
 
   // 2. Poll for the CI3 run (up to 10 minutes, checking every 10s)
   const maxAttempts = 60;
   let runId = "";
 
   for (let i = 1; i <= maxAttempts; i++) {
     const result = execSync(
-      `gh run list --repo ${repo} --workflow ci3.yml --json headSha,databaseId --jq '.[] | select(.headSha == "${tagSha}") | .databaseId'`,
+      `gh run list --repo ${repo} --workflow ci3.yml --json headSha,databaseId --jq '.[] | select(.headSha == "${commitSha}") | .databaseId'`,
       { encoding: "utf-8" },
     ).trim();