Merge branch 'develop' into hs/new-quick-settings-menu

Author: Half-Shot

.github/actions/download-verify-element-tarball/action.yml

@@ -11,7 +11,7 @@ runs:
     using: composite
     steps:
         - name: Download release tarball
-          uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1
+          uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1
           with:
               tag: ${{ inputs.tag }}
               fileName: element-*.tar.gz*

.github/renovate.json

@@ -2,25 +2,39 @@
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
     "extends": ["github>matrix-org/renovate-config-element-web"],
     "postUpdateOptions": ["pnpmDedupe"],
+    "stopUpdatingLabel": "X-Blocked",
     "packageRules": [
         {
+            "description": "Group all testcontainers docker digests",
             "groupName": "testcontainers docker digests",
             "groupSlug": "testcontainers-docker",
             "matchDepTypes": ["testcontainers-docker"],
             "matchPackageNames": ["*"]
+        },
+        {
+            "description": "Separate updates to overrides from other groups",
+            "matchDepTypes": ["pnpm.overrides"],
+            "groupSlug": null
+        },
+        {
+            "description": "Disable any major updates to overrides as this almost always is wrong",
+            "matchDepTypes": ["pnpm.overrides"],
+            "matchUpdateTypes": ["major"],
+            "enabled": false
         }
     ],
     "customManagers": [
         {
+            "description": "Update testcontainers docker digests",
             "customType": "regex",
             "datasourceTemplate": "docker",
             "versioningTemplate": "loose",
-            "description": "Update testcontainers docker digests",
             "managerFilePatterns": ["**/testcontainers/*.ts"],
             "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""],
             "depTypeTemplate": "testcontainers-docker"
         },
         {
+            "description": "Update element-desktop hakDependencies",
             "customType": "jsonata",
             "managerFilePatterns": ["/(^|/)package\\.json$/"],
             "fileFormat": "json",

.github/workflows/build-and-test.yaml

@@ -206,6 +206,8 @@ jobs:
         needs: prepare_ed
         name: "Desktop Windows"
         uses: ./.github/workflows/build_desktop_windows.yaml
+        # Skip Windows builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
+        if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
         strategy:
             matrix:
                 arch: [x64, ia32, arm64]
@@ -223,10 +225,13 @@ jobs:
                 arch: [amd64, arm64]
                 runAllTests:
                     - ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests') }}
-                # We ship static sqlcipher builds, so delegate testing the system builds to the merge queue
                 exclude:
+                    # We ship static sqlcipher builds, so delegate testing the system builds to the merge queue
                     - runAllTests: false
                       sqlcipher: system
+                    # Additionally skip arm64 system builds on PRs, as the amd64 test is enough for a smoke test and includes the screenshot tests
+                    - runAllTests: false
+                      arch: arm64
         with:
             sqlcipher: ${{ matrix.sqlcipher }}
             arch: ${{ matrix.arch }}
@@ -236,6 +241,9 @@ jobs:
         needs: prepare_ed
         name: "Desktop macOS"
         uses: ./.github/workflows/build_desktop_macos.yaml
+        # Skip macOS builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
+        # and we have a very low limit of concurrent macos runners (5) across the Github org.
+        if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
         with:
             blob_report: true
 

.github/workflows/build_desktop_linux.yaml

@@ -126,7 +126,7 @@ jobs:
             - name: "Get modified files"
               id: changed_files
               if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-web'
-              uses: tj-actions/changed-files@823fcebdb31bb35fdf2229d9f769b400309430d0 # v46
+              uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47
               with:
                   files: |
                       apps/desktop/dockerbuild/**

.github/workflows/cd.yaml

@@ -31,7 +31,7 @@ jobs:
                   persist-credentials: false
 
             - name: Install Cosign
-              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
 
             - name: Set up QEMU
               uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

.github/workflows/docker.yaml

@@ -26,7 +26,7 @@ jobs:
                   persist-credentials: false
 
             - name: Install Cosign
-              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
               if: github.event_name != 'pull_request'
 
             - name: Set up QEMU

.github/workflows/shared-component-visual-tests-netlify.yaml

@@ -25,9 +25,6 @@ jobs:
             actions: read
             deployments: write
         steps:
-            - name: Install tree
-              run: "sudo apt-get install -y tree"
-
             - name: Download Diffs
               uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
               with:

.github/workflows/shared-component-visual-tests.yaml

@@ -45,11 +45,12 @@ jobs:
               working-directory: packages/shared-components
               run: "pnpm test:storybook --run"
 
-            # Workaround for vis silently adding new baselines if they didn't exist
-            # Can be removed once https://github.com/repobuddy/visual-testing/issues/516 is released
-            - run: |
-                  git add -N .
-                  git diff --exit-code
+            - name: Detect stale screenshots
+              run: |
+                  if diff -rq __baselines__ __results__ | grep "^Only in __baselines__"; then
+                      exit 1
+                  fi
+              working-directory: packages/shared-components/__vis__/linux
 
             - name: Upload received images & diffs
               if: always()

.github/workflows/static_analysis.yaml

@@ -103,7 +103,7 @@ jobs:
                           voip|element_call
                           error|invalid_json
                           error|misconfigured
-                          welcome_to_element
+                          welcome|title_element
                           devtools|settings|elementCallUrl
                           labs|sliding_sync_description
                           settings|voip|noise_suppression_description

.github/workflows/update-jitsi.yml

@@ -27,7 +27,7 @@ jobs:
               run: "pnpm vendor:jitsi"
 
             - name: Create Pull Request
-              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
+              uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
               with:
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                   branch: actions/jitsi-update