chore: cherry-pick 14 upstream commits

.github/workflows/ci.yml

@@ -12,20 +12,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: package.json
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
 
       - name: Cache Bun and Turbo
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.bun/install/cache
@@ -35,7 +35,7 @@ jobs:
             ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
@@ -78,15 +78,15 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: package.json
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
 

.github/workflows/pr-size.yml

@@ -1,36 +1,31 @@
 name: PR Size
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/pr-size.yml
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
-  label:
-    name: Label PR size
+  prepare-config:
+    name: Prepare PR size config
     runs-on: ubuntu-24.04
-    concurrency:
-      group: pr-size-${{ github.event.pull_request.number }}
-      cancel-in-progress: true
+    outputs:
+      labels_json: ${{ steps.config.outputs.labels_json }}
     steps:
-      - name: Sync PR size label
+      - id: config
+        name: Build PR size label config
         uses: actions/github-script@v7
         with:
+          result-encoding: string
           script: |
-            const issueNumber = context.payload.pull_request.number;
-            const additions = context.payload.pull_request.additions ?? 0;
-            const deletions = context.payload.pull_request.deletions ?? 0;
-            const changedLines = additions + deletions;
-            const isIntegrationPermissionError = (error) =>
-              error?.status === 403 &&
-              (error?.response?.data?.message ?? error?.message ?? "").includes(
-                "Resource not accessible by integration",
-              );
-
             const managedLabels = [
               {
                 name: "size:XS",
@@ -64,31 +59,23 @@ jobs:
               },
             ];
 
-            const managedLabelNames = new Set(managedLabels.map((label) => label.name));
-
-            const resolveSizeLabel = (totalChangedLines) => {
-              if (totalChangedLines < 10) {
-                return "size:XS";
-              }
-
-              if (totalChangedLines < 30) {
-                return "size:S";
-              }
-
-              if (totalChangedLines < 100) {
-                return "size:M";
-              }
-
-              if (totalChangedLines < 500) {
-                return "size:L";
-              }
-
-              if (totalChangedLines < 1000) {
-                return "size:XL";
-              }
-
-              return "size:XXL";
-            };
+            core.setOutput("labels_json", JSON.stringify(managedLabels));
+  sync-label-definitions:
+    name: Sync PR size label definitions
+    needs: prepare-config
+    if: github.event_name != 'pull_request_target'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Ensure PR size labels exist
+        uses: actions/github-script@v7
+        env:
+          PR_SIZE_LABELS_JSON: ${{ needs.prepare-config.outputs.labels_json }}
+        with:
+          script: |
+            const managedLabels = JSON.parse(process.env.PR_SIZE_LABELS_JSON ?? "[]");
 
             for (const label of managedLabels) {
               try {
@@ -111,13 +98,6 @@ jobs:
                   });
                 }
               } catch (error) {
-                if (isIntegrationPermissionError(error)) {
-                  core.warning(
-                    `Skipping PR size label definition sync: ${error.message}`,
-                  );
-                  return;
-                }
-
                 if (error.status !== 404) {
                   throw error;
                 }
@@ -131,19 +111,62 @@ jobs:
                     description: label.description,
                   });
                 } catch (createError) {
-                  if (isIntegrationPermissionError(createError)) {
-                    core.warning(
-                      `Skipping PR size label definition sync: ${createError.message}`,
-                    );
-                    return;
-                  }
-
                   if (createError.status !== 422) {
                     throw createError;
                   }
                 }
               }
             }
+  label:
+    name: Label PR size
+    needs: prepare-config
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: write
+    concurrency:
+      group: pr-size-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    steps:
+      - name: Sync PR size label
+        uses: actions/github-script@v7
+        env:
+          PR_SIZE_LABELS_JSON: ${{ needs.prepare-config.outputs.labels_json }}
+        with:
+          script: |
+            const issueNumber = context.payload.pull_request.number;
+            const additions = context.payload.pull_request.additions ?? 0;
+            const deletions = context.payload.pull_request.deletions ?? 0;
+            const changedLines = additions + deletions;
+            const managedLabels = JSON.parse(process.env.PR_SIZE_LABELS_JSON ?? "[]");
+
+            const managedLabelNames = new Set(managedLabels.map((label) => label.name));
+
+            const resolveSizeLabel = (totalChangedLines) => {
+              if (totalChangedLines < 10) {
+                return "size:XS";
+              }
+
+              if (totalChangedLines < 30) {
+                return "size:S";
+              }
+
+              if (totalChangedLines < 100) {
+                return "size:M";
+              }
+
+              if (totalChangedLines < 500) {
+                return "size:L";
+              }
+
+              if (totalChangedLines < 1000) {
+                return "size:XL";
+              }
+
+              return "size:XXL";
+            };
 
             const nextLabelName = resolveSizeLabel(changedLines);
 
@@ -167,37 +190,19 @@ jobs:
                   name: label.name,
                 });
               } catch (removeError) {
-                if (isIntegrationPermissionError(removeError)) {
-                  core.warning(
-                    `Skipping PR size label sync for #${issueNumber}: ${removeError.message}`,
-                  );
-                  return;
-                }
-
                 if (removeError.status !== 404) {
                   throw removeError;
                 }
               }
             }
 
             if (!currentLabels.some((label) => label.name === nextLabelName)) {
-              try {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: issueNumber,
-                  labels: [nextLabelName],
-                });
-              } catch (addError) {
-                if (isIntegrationPermissionError(addError)) {
-                  core.warning(
-                    `Skipping PR size label sync for #${issueNumber}: ${addError.message}`,
-                  );
-                  return;
-                }
-
-                throw addError;
-              }
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueNumber,
+                labels: [nextLabelName],
+              });
             }
 
             core.info(`PR #${issueNumber}: ${changedLines} changed lines -> ${nextLabelName}`);

.github/workflows/pr-vouch.yml

@@ -25,7 +25,7 @@ jobs:
       targets: ${{ steps.collect.outputs.targets }}
     steps:
       - id: collect
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             if (context.eventName === "pull_request") {
@@ -85,7 +85,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Sync PR labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         env:
           PR_NUMBER: ${{ matrix.target.number }}
           VOUCH_STATUS: ${{ steps.vouch.outputs.status }}

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
       ref: ${{ github.sha }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - id: release_meta
         name: Resolve release version
@@ -61,7 +61,7 @@ jobs:
           bun-version-file: package.json
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
 
@@ -107,7 +107,7 @@ jobs:
             arch: x64
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
           fetch-depth: 0
@@ -118,7 +118,7 @@ jobs:
           bun-version-file: package.json
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
 
@@ -217,7 +217,7 @@ jobs:
           fi
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
           path: release-publish/*
@@ -229,7 +229,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
 
@@ -239,7 +239,7 @@ jobs:
           bun-version-file: package.json
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
           registry-url: https://registry.npmjs.org
@@ -262,17 +262,17 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
 
       - name: Download all desktop artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: desktop-*
           merge-multiple: true
@@ -309,7 +309,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: main
           fetch-depth: 0
@@ -320,7 +320,7 @@ jobs:
           bun-version-file: package.json
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json