sync: upstream 30733ac703 into swaplabs/main

.github/actions/install-node-dependencies/action.yml

@@ -67,6 +67,32 @@ outputs:
 runs:
   using: composite
   steps:
+    # The image resets HOME during login; shell fixtures intentionally use temporary homes.
+    - name: Preserve explicit login-shell homes on Blacksmith
+      if: runner.os == 'Linux' && startsWith(runner.name, 'blacksmith-') && job.container.id == ''
+      shell: bash
+      run: |
+        sudo python3 - <<'PYTHON'
+        from pathlib import Path
+        profile = Path('/etc/profile.d/blacksmith.sh')
+        if profile.exists():
+            original = profile.read_text()
+            updated = original.replace('export HOME="$RUNNER_HOME"', 'export HOME="${HOME:-$RUNNER_HOME}"')
+            if updated != original:
+                profile.write_text(updated)
+        PYTHON
+        fixture_home="$(mktemp -d)"
+        trap 'rm -rf "$fixture_home"' EXIT
+        printf 'export ORCA_CI_PROFILE_LOADED=1\n' > "$fixture_home/.bash_profile"
+        HOME="$fixture_home" ORCA_CI_FIXTURE_HOME="$fixture_home" /bin/bash -lc '
+          test "$HOME" = "$ORCA_CI_FIXTURE_HOME" && test "$ORCA_CI_PROFILE_LOADED" = 1
+        ' || {
+          echo '::error::Runner login profile overrides fixture HOME'
+          grep -nH 'HOME' /etc/profile /etc/profile.d/*.sh || true
+          HOME="$fixture_home" /bin/bash -lc 'printf "Observed HOME=%s\n" "$HOME"'
+          exit 1
+        }
+
     - name: Resolve pnpm store mode
       id: pnpm-store-mode
       if: >-

.github/actions/prepare-dependency-audit/action.yml

@@ -18,7 +18,7 @@ runs:
           pnpm-lock.yaml pnpm-workspace.yaml mobile/pnpm-lock.yaml mobile/pnpm-workspace.yaml \
           native config/patches mobile/patches | \
           awk '$1 ~ /^100(644|755)$/ {sub(/^[^\t]*\t/, ""); print}' | \
-          rg '(^|/)(pnpm-lock.yaml|pnpm-workspace.yaml)$|^native/[^/]+/Cargo\.(toml|lock)$|^(config|mobile)/patches/.*\.patch$')
+          grep -E '(^|/)(pnpm-lock.yaml|pnpm-workspace.yaml)$|^native/[^/]+/Cargo\.(toml|lock)$|^(config|mobile)/patches/.*\.patch$')
         test "${#files[@]}" -gt 0
         mkdir candidate
         git archive --worktree-attributes FETCH_HEAD -- "${files[@]}" | tar -x -C candidate

.github/workflows/ci-cache-warmup-platform-jobs.yml

@@ -15,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [ubuntu-24.04-arm, blacksmith-4vcpu-ubuntu-2404]
+        runner: [blacksmith-4vcpu-ubuntu-2404-arm, blacksmith-8vcpu-ubuntu-2404]
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 10
     env:
@@ -42,7 +42,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-2022, windows-11-arm]
+        os: [windows-2022, windows-11-arm, windows-2025]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
     env:
@@ -60,7 +60,7 @@ jobs:
         run: node config/scripts/ensure-native-runtime.mjs --check-only
 
       - name: Cache Windows CLI launcher
-        if: runner.arch == 'X64'
+        if: runner.arch == 'X64' && matrix.os != 'windows-2025'
         uses: actions/cache@v5
         with:
           path: |
@@ -72,7 +72,7 @@ jobs:
           key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'native/windows-agent-hook/**', 'config/scripts/build-windows-cli-launcher.mjs', 'config/scripts/build-windows-agent-hook.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
 
       - name: Build the Windows native executables
-        if: runner.arch == 'X64'
+        if: runner.arch == 'X64' && matrix.os != 'windows-2025'
         shell: pwsh
         run: |
           if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
@@ -95,7 +95,7 @@ jobs:
     concurrency:
       group: ci-cache-warmup-linux-package-fixtures-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: ${{ github.event_name != 'schedule' }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     env:
       ORCA_BACKGROUND_LAUNCH: '1'

.github/workflows/ci-cache-warmup.yml

@@ -68,7 +68,7 @@ jobs:
     concurrency:
       group: ci-cache-warmup-linux-x64-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: ${{ github.event_name != 'schedule' }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     env:
       ORCA_BACKGROUND_LAUNCH: '1'

.github/workflows/ci-runner-demand.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   report:
-    runs-on: ubuntu-slim
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci-xterm-cache.yml

@@ -23,7 +23,7 @@ env:
 jobs:
   seed:
     if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04-arm
+    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6

.github/workflows/cloud-verify.yml

@@ -34,7 +34,7 @@ jobs:
   security:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     name: Secret scan
-    runs-on: ubuntu-22.04
+    runs-on: blacksmith-4vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
         with:
@@ -84,7 +84,7 @@ jobs:
   # database, and the service container costs ~13s of startup.
   build:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: ubuntu-22.04
+    runs-on: blacksmith-4vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
 
@@ -112,7 +112,7 @@ jobs:
   containers:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     name: Container security (${{ matrix.app }})
-    runs-on: ubuntu-22.04
+    runs-on: blacksmith-4vcpu-ubuntu-2204
     strategy:
       fail-fast: false
       matrix:
@@ -172,7 +172,7 @@ jobs:
   # `pnpm build` having run.
   test:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: ubuntu-22.04
+    runs-on: blacksmith-4vcpu-ubuntu-2204
     services:
       postgres:
         image: postgres:16-alpine

.github/workflows/computer-e2e.yml

@@ -80,7 +80,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-22.04, windows-latest]
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ fromJSON('{"ubuntu-22.04":"blacksmith-4vcpu-ubuntu-2204"}')[matrix.os] || matrix.os }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -150,7 +150,7 @@ jobs:
   # grants. Keep the real native build/owner-loss checks on every trigger instead.
   mac-native-owner-smoke:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: macos-15
+    runs-on: blacksmith-6vcpu-macos-15
     permissions:
       contents: read
     steps:
@@ -178,7 +178,7 @@ jobs:
 
   linux:
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-22.04
+    runs-on: blacksmith-4vcpu-ubuntu-2204
     env:
       ORCA_COMPUTER_E2E: '1'
       ACCESSIBILITY_ENABLED: '1'

.github/workflows/daily-mac-build.yml

@@ -73,7 +73,7 @@ jobs:
   # Why: the app and the orcad template it ships must come from one commit, so resolve main once.
   resolve-main:
     if: github.repository == 'stablyai/orca'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 5
     outputs:
       head_sha: ${{ steps.resolve.outputs.head_sha }}
@@ -99,6 +99,7 @@ jobs:
     with:
       ref: ${{ needs.resolve-main.outputs.head_sha }}
       build_template: true
+      fast_runners: true
 
   build-daily-mac:
     needs:
@@ -566,7 +567,7 @@ jobs:
   post-daily-e2e:
     needs: build-daily-mac
     if: ${{ needs.build-daily-mac.outputs.published == 'true' && needs.build-daily-mac.outputs.head_sha != '' }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       actions: write
     steps:
@@ -614,3 +615,4 @@ jobs:
       ref: ${{ needs.build-daily-mac.outputs.head_sha }}
       version: ${{ needs.build-daily-mac.outputs.version }}
       orcad_template: true
+      fast_release: true

.github/workflows/dependency-security.yml

@@ -27,6 +27,14 @@ on:
         description: Exact release tag to audit using the workflow commit's tooling
         required: true
         type: string
+      runner:
+        description: Runner override for GitHub-hosted signing provenance.
+        type: string
+        default: blacksmith-4vcpu-ubuntu-2404
+    secrets:
+      SLACK_WEBHOOK_URL:
+        description: Existing orca-releases incoming webhook
+        required: false
   workflow_dispatch:
 
 permissions:
@@ -42,8 +50,10 @@ env:
 jobs:
   javascript:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner || 'blacksmith-4vcpu-ubuntu-2404' }}
     timeout-minutes: 15
+    outputs:
+      audit_result: ${{ steps.audit.outcome }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -55,6 +65,8 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
       - name: Audit JavaScript lockfiles
+        id: audit
+        continue-on-error: true
         shell: bash
         env:
           RELEASE_REF: ${{ inputs.ref }}
@@ -73,8 +85,10 @@ jobs:
 
   rust:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner || 'blacksmith-4vcpu-ubuntu-2404' }}
     timeout-minutes: 20
+    outputs:
+      audit_result: ${{ steps.audit.outcome }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -92,6 +106,8 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
       - name: Audit native Rust lockfiles
+        id: audit
+        continue-on-error: true
         shell: bash
         working-directory: ${{ inputs.ref != '' && 'candidate' || '.' }}
         run: |
@@ -110,3 +126,53 @@ jobs:
           name: dependency-security-rust
           path: tmp/dependency-security/*.log
           if-no-files-found: error
+
+  notify:
+    needs: [javascript, rust]
+    if: >-
+      !cancelled() && github.repository == 'stablyai/orca' &&
+      (needs.javascript.outputs.audit_result == 'failure' ||
+      needs.rust.outputs.audit_result == 'failure' ||
+      needs.javascript.result == 'failure' || needs.rust.result == 'failure')
+    runs-on: ${{ inputs.runner || 'blacksmith-4vcpu-ubuntu-2404' }}
+    timeout-minutes: 5
+    steps:
+      - name: Send dependency review to orca-releases
+        uses: actions/github-script@v8
+        continue-on-error: true
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          RELEASE_REF: ${{ inputs.ref }}
+          AUDIT_RESULTS: ${{ toJSON(needs) }}
+        with:
+          script: |
+            if (!process.env.SLACK_WEBHOOK_URL) {
+              core.notice('Slack notification unavailable for this run; see the dependency reports in Actions.')
+              return
+            }
+            const results = JSON.parse(process.env.AUDIT_RESULTS)
+            const checks = [['javascript', 'JavaScript'], ['rust', 'Rust']].map(([job, label]) => {
+              const result = results[job]
+              const status = result.result !== 'success' ? 'scan incomplete'
+                : result.outputs.audit_result === 'success' ? 'passed' : 'review suggested'
+              return `${label}: ${status}`
+            })
+            const target = context.payload.pull_request
+              ? `PR #${context.payload.pull_request.number}`
+              : process.env.RELEASE_REF || context.ref
+            const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
+            const text = `Orca dependency review for ${target}\n${checks.join(' · ')}\nReports and logs: ${runUrl}`
+            let response
+            try {
+              response = await fetch(process.env.SLACK_WEBHOOK_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ text, mrkdwn: false, unfurl_links: false, unfurl_media: false }),
+                signal: AbortSignal.timeout(15000)
+              })
+            } catch {
+              throw new Error('Slack dependency review notification could not be sent')
+            }
+            if (!response.ok) {
+              throw new Error(`Slack dependency review notification returned HTTP ${response.status}`)
+            }

.github/workflows/dev-channel-win-build.yml

@@ -62,7 +62,7 @@ on:
       fast_release:
         description: Use the faster unsigned-build runner outside signing provenance
         type: boolean
-        default: false
+        default: true
       javascript_source_sha:
         description: Restore this run's shared dev JavaScript instead of rebuilding it
         type: string
@@ -95,6 +95,11 @@ on:
         required: true
         type: string
 
+      fast_release:
+        description: Use Blacksmith for unsigned Windows builds
+        type: boolean
+        default: true
+
 permissions:
   contents: read
 

.github/workflows/docs.yml

@@ -38,7 +38,7 @@ jobs:
   check:
     name: Build and test
     if: github.event_name == 'pull_request' && github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - name: Checkout pull request
@@ -80,7 +80,7 @@ jobs:
     if: >-
       github.repository == 'stablyai/orca' &&
       (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 5
     outputs:
       deploy: ${{ steps.validate.outputs.deploy }}
@@ -205,7 +205,7 @@ jobs:
       needs.release_gate.result == 'success' &&
       needs.release_gate.outputs.deploy == 'true'
     needs: release_gate
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     environment:
       name: docs-production