Add Sidecar to official OpenStation 1.1.0

.github/workflows/ci.yml

@@ -17,15 +17,15 @@ jobs:
     name: Lint · Types · Vitest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           # Don't leave the GITHUB_TOKEN in .git/config; later steps run
           # PR-authored code (npm scripts, build) and this job never needs
           # git auth after checkout.
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'
@@ -58,6 +58,26 @@ jobs:
           npm --prefix extensions/desktop-mode-feed-buddy run build
           git diff --exit-code -- extensions/desktop-mode-feed-buddy/assets/js
 
+      - name: Electron adapter extension checks
+        env:
+          # Nothing in this job launches Electron — this is lint, types,
+          # unit tests and the bundles. The `electron` package still
+          # installs (its type definitions are what `app/tsconfig.json`
+          # compiles against); only the ~100 MB binary download is
+          # skipped.
+          ELECTRON_SKIP_BINARY_DOWNLOAD: '1'
+        run: |
+          npm --prefix extensions/openstation-electron-adapter ci
+          # The package's own `verify`, rather than a sequence spelled
+          # out again here. It builds BEFORE it tests, and that order is
+          # load-bearing: `connect-bundle.test.ts` asserts against
+          # `app/dist/renderer/connect.js`, so a run that tests first
+          # passes only on a machine that happens to have built already.
+          # Deferring to `verify` also means a developer running it
+          # locally is running what CI runs.
+          npm --prefix extensions/openstation-electron-adapter run verify
+          git diff --exit-code -- extensions/openstation-electron-adapter/assets/js
+
   php:
     name: PHPUnit · PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
@@ -67,15 +87,15 @@ jobs:
         php: [ '8.3', '8.4' ]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           # Don't leave the GITHUB_TOKEN in .git/config; later steps run
           # PR-authored code (npm scripts, build) and this job never needs
           # git auth after checkout.
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'
@@ -130,15 +150,15 @@ jobs:
     name: Plugin Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           # Don't leave the GITHUB_TOKEN in .git/config; later steps run
           # PR-authored code (npm scripts, build) and this job never needs
           # git auth after checkout.
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'

.github/workflows/claude.yml

@@ -33,13 +33,13 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1.0.165
+        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/pr-preview-build.yml

@@ -22,10 +22,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'

.github/workflows/pr-preview-publish.yml

@@ -34,33 +34,65 @@ jobs:
     if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
 
       - name: Resolve PR from trusted workflow_run data
         id: meta
         uses: actions/github-script@v9
         with:
           script: |
-            // The `pr-meta` artifact is written by the fork-controlled build
-            // run, so its contents are untrusted — a malicious PR could point
-            // the preview comment at any PR. Derive the identity from the
-            // `workflow_run` event instead: GitHub sets `head_sha` and it
-            // cannot be spoofed by PR code. `workflow_run.pull_requests` is
-            // empty for fork PRs, so resolve the PR number via the API and
-            // require its head SHA to match before publishing anything.
-            const headSha = context.payload.workflow_run.head_sha;
+            // PR identity is never taken from the build run's artifacts — that
+            // run executes fork-controlled code and can write whatever it
+            // likes, so a malicious PR could aim the preview comment at any
+            // PR. Derive it from the `workflow_run` event instead: GitHub sets
+            // `head_sha`, `head_repository` and `head_branch`, and PR code
+            // cannot spoof any of them.
+            //
+            // Resolve the PR by head repo + branch. `workflow_run.pull_requests`
+            // is empty for fork PRs, and so is
+            // `listPullRequestsAssociatedWithCommit` — that endpoint does not
+            // resolve commits living in a fork, which left every fork PR
+            // without a preview.
+            //
+            // The `head` filter is server-side and fails open: a value GitHub
+            // does not recognise is ignored rather than rejected, and the call
+            // then returns every PR. Re-check owner, branch and SHA against the
+            // payload below so ownership is an invariant enforced here, not a
+            // bet on that filter's behaviour.
+            const run = context.payload.workflow_run;
+            const headSha = run.head_sha;
             if (!/^[0-9a-f]{40}$/.test(headSha)) {
               core.setFailed(`Unexpected workflow_run head SHA: ${headSha}`);
               return;
             }
-            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+            const headOwner = run.head_repository?.owner?.login;
+            const headBranch = run.head_branch;
+            if (!headOwner || !headBranch) {
+              core.setFailed(`Incomplete workflow_run head data: owner=${headOwner} branch=${headBranch}`);
+              return;
+            }
+            // `state: 'all'` because a PR can merge between the build finishing
+            // and this run starting; the old lookup published in that window
+            // and there's no reason to start failing there. A branch reused
+            // across several PRs can match more than once, so prefer the open
+            // one.
+            const prs = await github.paginate(github.rest.pulls.list, {
               owner: context.repo.owner,
               repo: context.repo.repo,
-              commit_sha: headSha,
+              state: 'all',
+              head: `${headOwner}:${headBranch}`,
+              per_page: 100,
             });
-            const pr = prs.find((p) => p.head.sha === headSha);
+            // `head.repo` is null when the head fork has been deleted.
+            const matches = prs.filter(
+              (p) =>
+                p.head.sha === headSha &&
+                p.head.repo?.owner?.login === headOwner &&
+                p.head.ref === headBranch
+            );
+            const pr = matches.find((p) => p.state === 'open') ?? matches[0];
             if (!pr) {
-              core.setFailed(`No pull request found with head SHA ${headSha}; refusing to publish a preview.`);
+              core.setFailed(`No pull request for ${headOwner}:${headBranch} at head SHA ${headSha}; refusing to publish a preview.`);
               return;
             }
             core.setOutput('pr-number', String(pr.number));

.github/workflows/release.yml

@@ -1,13 +1,30 @@
 name: Release
 
-# Triggered by pushing a vX.Y.Z tag. Builds the plugin zip and creates a
-# GitHub Release with it attached. Use `bin/release.sh` locally to cut a
-# release end-to-end (bump + commit + tag + push).
+# Triggered by pushing a vX.Y.Z tag. Builds the plugin zip, creates a GitHub
+# Release with it attached, then deploys stable tags to WordPress.org. Use
+# `bin/release.sh` locally to cut a release end-to-end (bump + commit + tag
+# + push).
+#
+# Also runnable manually against an already-published tag, which re-attempts
+# the WordPress.org deploy and leaves the GitHub Release untouched:
+#
+#     gh workflow run release.yml --ref trunk -f tag=v1.0.0
+#
+# That exists because a tag push runs the workflow definition frozen into
+# that tag's commit, so a deploy that fails for a workflow-level reason can
+# never be fixed by re-running it. Dispatching from trunk runs the current
+# definition instead.
 
 on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Published tag to deploy to WordPress.org (e.g. v1.0.0)'
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -16,11 +33,18 @@ jobs:
   release:
     name: Build & publish release
     runs-on: ubuntu-latest
+    env:
+      # The tag being released: the pushed ref, or the dispatch input.
+      # Consumed as a shell variable rather than interpolated into `run:`
+      # bodies, so the dispatch input can't inject into the script.
+      TAG: ${{ inputs.tag || github.ref_name }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.tag || github.ref_name }}
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -31,8 +55,7 @@ jobs:
 
       - name: Verify tag matches plugin version
         run: |
-          tag="${{ github.ref_name }}"
-          tag="${tag#v}"
+          tag="${TAG#v}"
           pkg=$(node -p "require('./package.json').version")
           header=$(grep -oP '^\s*\*\s*Version:\s*\K\S+' desktop-mode.php)
           constant=$(grep -oP "OPENSTATION_VERSION',\s*'\K[^']+" desktop-mode.php)
@@ -41,36 +64,55 @@ jobs:
             echo "::error::Version mismatch — tag '$tag' vs package.json=$pkg header=$header OPENSTATION_VERSION=$constant readme.txt Stable tag=$stable"
             exit 1
           fi
+          # The deploy action derives VERSION from GITHUB_REF, which is only a
+          # tag ref on a tag push — on a dispatch it resolves to the branch ref
+          # and the SVN tag copy becomes `tags/refs/heads/trunk`. Publish the
+          # version that was just checked against all four locations, so the
+          # deploy uses a verified value however the workflow was triggered.
+          echo "VERSION=$tag" >> "$GITHUB_ENV"
 
       - name: Build
         run: npm run build
 
       - name: Package plugin zip
         run: bin/package.sh
 
+      # Skipped on a manual dispatch: the Release already exists, and
+      # `gh release create` is not idempotent — it would fail the job
+      # before it ever reached the deploy.
       - name: Create GitHub Release
+        if: github.event_name == 'push'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          tag="${{ github.ref_name }}"
           flags=()
-          if [[ "$tag" == *-* ]]; then
+          if [[ "$TAG" == *-* ]]; then
             flags+=(--prerelease)
           fi
-          gh release create "$tag" \
-            --title "$tag" \
+          gh release create "$TAG" \
+            --title "$TAG" \
             --generate-notes \
             "${flags[@]}" \
             openstation.zip
 
       - name: Unpack zip for wp.org deploy
-        if: ${{ !contains(github.ref_name, '-') }}
+        if: ${{ !contains(env.TAG, '-') }}
         run: unzip -q openstation.zip -d build/
 
       - name: Deploy to WordPress.org
-        if: ${{ !contains(github.ref_name, '-') }}
+        if: ${{ !contains(env.TAG, '-') }}
         uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0
         env:
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
+          # The wp.org slug is frozen at `desktop-mode` (see AGENTS.md) — it is
+          # the published plugin's SVN path and install directory, and renaming
+          # it would orphan every existing install's update check. Set it
+          # explicitly: the action otherwise defaults SLUG to the GitHub repo
+          # name, which used to coincide with the wp.org slug and stopped
+          # doing so when this repo was renamed to `openstation`.
+          SLUG: desktop-mode
           BUILD_DIR: ./build/desktop-mode
+          # VERSION comes from the verify step via $GITHUB_ENV — see the note
+          # there. Both it and SLUG default off a GitHub context that is only
+          # correct for a tag push, so neither is left implicit.