sync: upstream aedb9305cd into swaplabs/main

.github/actions/install-node-dependencies/action.yml

@@ -2,6 +2,10 @@ name: Install Node dependencies
 description: Installs the Node toolchain and repository dependencies for CI jobs, with optional Electron archive caching.
 
 inputs:
+  cache-pnpm-verification:
+    description: Restore pnpm's policy-checked lockfile verification record on Linux.
+    required: false
+    default: 'true'
   native-runtime:
     description: Native runtime to prepare after the script-free install (none, node, or electron).
     required: false
@@ -24,6 +28,15 @@ inputs:
     default: 'false'
 
 outputs:
+  verification-cache-hit:
+    description: Whether pnpm's verification record was restored.
+    value: ${{ steps.verification-cache-restore.outputs.cache-hit }}
+  verification-cache-path:
+    description: The small pnpm-owned verification record, without registry metadata.
+    value: ${{ steps.verification-cache.outputs.path }}
+  verification-cache-key:
+    description: Exact verification record key, also used by the isolated PR benchmark.
+    value: ${{ steps.verification-cache.outputs.key }}
   node-version:
     description: Resolved Node.js version used for the install.
     value: ${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}
@@ -50,17 +63,60 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: package.json
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
 
     - name: Setup requested Node.js
       id: requested-node
       if: inputs.node-version != ''
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
+
+    # PR-local stores compete with reusable build caches for the repository quota.
+    - name: Resolve pnpm download store
+      id: pnpm-store
+      if: github.event_name == 'pull_request'
+      shell: bash
+      env:
+        LOCKFILE_HASH: ${{ hashFiles(inputs.cache-dependency-path) }}
+      run: |
+        test -n "$LOCKFILE_HASH"
+        cache_path="$(pnpm store path --silent)"
+        test -n "$cache_path"
+        printf 'path=%s\n' "$cache_path" >> "$GITHUB_OUTPUT"
+        printf 'arch=%s\n' "$(node -p 'require("node:os").arch()')" >> "$GITHUB_OUTPUT"
+
+    # Match setup-node's key and path so existing default-branch stores remain reusable.
+    - name: Restore pnpm download store without saving
+      if: github.event_name == 'pull_request'
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.pnpm-store.outputs.path }}
+        key: node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}
+
+    - name: Resolve pnpm verification cache
+      id: verification-cache
+      if: runner.os == 'Linux' && inputs.cache-pnpm-verification == 'true'
+      shell: bash
+      env:
+        POLICY_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc') }}
+      run: |
+        printf 'path=%s/lockfile-verified.jsonl\n' "$(pnpm cache path)" >> "$GITHUB_OUTPUT"
+        printf 'key=pnpm-verification-v1-%s-%s-%s-%s\n' "$RUNNER_OS" "$RUNNER_ARCH" "$(pnpm --version)" "$POLICY_HASH" >> "$GITHUB_OUTPUT"
+
+    - name: Restore pnpm verification record
+      id: verification-cache-restore
+      if: steps.verification-cache.outputs.key != ''
+      continue-on-error: true
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}
 
     - name: Validate native runtime
       shell: bash
@@ -96,6 +152,15 @@ runs:
           git -C "$GITHUB_WORKSPACE" diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
         fi
 
+    # pnpm checks the cached record's policy and validity; never bypass verification.
+    - name: Save pnpm verification record on main
+      if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.verification-cache.outputs.key != '' && steps.verification-cache-restore.outputs.cache-hit != 'true'
+      continue-on-error: true
+      uses: actions/cache/save@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}
+
     - name: Resolve Electron package cache
       id: electron-package-cache
       if: inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'
@@ -116,12 +181,19 @@ runs:
         printf 'version=%s\n' "$(node -p "require('./node_modules/electron/package.json').version")" >> "$GITHUB_OUTPUT"
 
     - name: Cache Electron package archive
-      if: inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'
+      if: (github.event_name != 'pull_request' || runner.os != 'Linux') && steps.electron-package-cache.outputs.version != ''
       uses: actions/cache@v5
       with:
         path: ${{ steps.electron-package-cache.outputs.cache-root }}
         key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
 
+    - name: Restore Electron package archive without saving
+      if: github.event_name == 'pull_request' && runner.os == 'Linux' && steps.electron-package-cache.outputs.version != ''
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.electron-package-cache.outputs.cache-root }}
+        key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
+
     # Why cached: `--ignore-scripts` leaves node-pty without build/Release, so
     # ensure-native-runtime node-gyp-compiles it in every job that asks for a runtime.
     # The artifacts are ABI-bound, so the key carries the target runtime, the resolved

.github/actions/prepare-git-compatibility/action.yml

@@ -0,0 +1,32 @@
+name: Prepare baseline Git compatibility binary
+description: Restore or build the pinned Linux Git binary for the compatibility contract.
+
+runs:
+  using: composite
+  steps:
+    # The default-branch warmer shares this key across PRs; a PR save is private to its merge ref.
+    # Cache eviction remains possible, so keep the checksum-verified cold build below.
+    - name: Cache baseline Git build
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/orca-git-compat/git-2.25.5
+        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
+
+    # Finish the CPU-heavy build before any timed compatibility lanes start.
+    - name: Build the baseline Git binary
+      shell: bash
+      run: |
+        archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
+        source="$HOME/.cache/orca-git-compat/git-2.25.5"
+        if [ -x "$source/git" ]; then
+          exit 0
+        fi
+        curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
+        echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
+          | sha256sum --check
+        mkdir -p "$source"
+        tar -xzf "$archive" -C "$source" --strip-components=1
+        make -C "$source" -j"$(nproc)" \
+          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+        # Object files are no longer needed after linking the cached binary.
+        find "$source" -name '*.o' -delete

.github/actions/prepare-linux-package-fixture/action.yml

@@ -0,0 +1,63 @@
+name: Prepare cached Linux package fixture
+description: Restore Docker build layers; only the main warmer builds and saves missing images.
+inputs:
+  fixture:
+    description: Directory name below config/docker.
+    required: true
+  save-cache:
+    description: Build and save a missing fixture on the default branch.
+    default: 'false'
+outputs:
+  image:
+    description: Loaded image to use as a Docker build cache, or empty on a cache miss.
+    value: ${{ steps.image.outputs.image }}
+runs:
+  using: composite
+  steps:
+    - name: Restore fixture image
+      id: cache
+      uses: actions/cache/restore@v5
+      continue-on-error: true
+      with:
+        path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
+        key: linux-package-fixture-v1-${{ runner.os }}-${{ runner.arch }}-linux-amd64-${{ inputs.fixture }}-${{ hashFiles(format('config/docker/{0}/**', inputs.fixture), '.github/actions/prepare-linux-package-fixture/action.yml') }}
+
+    - name: Load or seed fixture build cache
+      id: image
+      shell: bash
+      env:
+        FIXTURE: ${{ inputs.fixture }}
+        SAVE_CACHE: ${{ inputs.save-cache }}
+        CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
+      run: |
+        set -euo pipefail
+        case "$FIXTURE" in
+          headless-serve-shutdown|cli-launch-contract) ;;
+          *) echo "Unsupported package fixture: $FIXTURE" >&2; exit 1 ;;
+        esac
+        archive="$RUNNER_TEMP/orca-package-fixtures/$FIXTURE.tar"
+        image="orca-package-fixture-$FIXTURE:cache"
+        if [[ "$CACHE_HIT" == true ]] && docker load --input "$archive"; then
+          if docker image inspect "$image" > /dev/null; then
+            echo "image=$image" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+        fi
+        if [[ "$SAVE_CACHE" != true ]]; then
+          echo 'No usable fixture cache; the package runner will build normally.'
+          exit 0
+        fi
+        docker build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1 \
+          --tag "$image" --file "config/docker/$FIXTURE/Dockerfile" "config/docker/$FIXTURE"
+        mkdir -p "$(dirname "$archive")"
+        docker save --output "$archive" "$image"
+        echo "image=$image" >> "$GITHUB_OUTPUT"
+        echo 'built=true' >> "$GITHUB_OUTPUT"
+
+    - name: Save fixture image
+      if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && steps.image.outputs.built == 'true'
+      uses: actions/cache/save@v5
+      continue-on-error: true
+      with:
+        path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
+        key: ${{ steps.cache.outputs.cache-primary-key }}

.github/actions/prepare-xterm-dependencies/action.yml

@@ -0,0 +1,33 @@
+name: Restore xterm build dependencies
+description: Reuse installed dependencies for the pinned upstream checkout.
+outputs:
+  cache-key:
+    description: Exact dependency cache key.
+    value: ${{ steps.restore.outputs.cache-primary-key }}
+  cache-hit:
+    description: Whether the exact installed dependency cache was restored.
+    value: ${{ steps.restore.outputs.cache-hit }}
+runs:
+  using: composite
+  steps:
+    - id: runtime
+      shell: bash
+      run: |
+        . /etc/os-release
+        echo "image=$ID-$VERSION_ID" >> "$GITHUB_OUTPUT"
+        echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+    - id: restore
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          ${{ runner.temp }}/xterm-patch-build/upstream/.git
+          ${{ runner.temp }}/xterm-patch-build/upstream/node_modules
+        key: xterm-dependencies-v1-${{ runner.os }}-${{ steps.runtime.outputs.image }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-${{ hashFiles('config/patches/xterm-upstream.json', 'config/scripts/regenerate-xterm-patches.mjs', 'config/scripts/xterm-patch-text.mjs', '.github/actions/prepare-xterm-dependencies/action.yml') }}
+    - name: Restore download cache on an installed-dependency miss
+      if: steps.restore.outputs.cache-hit != 'true'
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          ~/.npm
+          ${{ runner.temp }}/xterm-patch-build/upstream/.git
+        key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}

.github/pull_request_template.md

@@ -12,7 +12,8 @@
 
 ## Linked Issue
 
-<!-- Link the issue this PR addresses, there should ALWAYS be one -->
+<!-- Link the issue this PR addresses, there should ALWAYS be one (for outside contributors) -->
+<!-- SPECIAL CASE: If you are a maintainer (member of stablyai org) AVOID opening needless issues. Only attach pre-existing ones -->
 
 Fixes #