Upstream sync needs review

.github/workflows/fork-budget.yml

@@ -0,0 +1,30 @@
+name: Fork job budget
+
+# Fails a run before it spends runners once the fork has run too many jobs in
+# the last 24 hours (fork/scripts/job-budget.sh). Fork release runs the same
+# script inside its settle job instead, so a blocked release costs one job.
+# Raise or lower the limit with the FORK_JOB_BUDGET repository variable.
+
+on:
+  workflow_call:
+
+permissions:
+  actions: read
+  # Reads fork/scripts/job-budget.sh.
+  contents: read
+
+jobs:
+  budget:
+    name: Check job budget
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ github.token }}
+      LIMIT: ${{ vars.FORK_JOB_BUDGET || 150 }}
+    steps:
+      # Fetches only the script instead of checking out the repository.
+      - run: |
+          set -euo pipefail
+          gh api -H "Accept: application/vnd.github.raw" \
+            "repos/$GITHUB_REPOSITORY/contents/fork/scripts/job-budget.sh?ref=$GITHUB_SHA" > "$RUNNER_TEMP/job-budget.sh"
+          bash "$RUNNER_TEMP/job-budget.sh"

.github/workflows/fork-checks.yml

@@ -0,0 +1,182 @@
+name: Fork checks
+
+# The release gate from upstream's release.yml (quality, tests, sharded server
+# tests) on GitHub-hosted runners, which this fork has instead of Blacksmith.
+# Called by fork-sync.yml before promoting a sync, by fork-pr-checks.yml, and
+# by fork-release.yml before publishing.
+#
+# When every check passes on a ref given as a full commit SHA, the record job
+# sets a `fork-checks` commit status on that commit, naming the commit this
+# workflow file came from. Fork
+# release skips its checks when that status is on the commit it releases and
+# this file is unchanged there (a promoted sync candidate, or a branch checked
+# with Fork PR checks and pushed to main unchanged). Only the record job can
+# write statuses: the check jobs run the checked ref's code, which could
+# otherwise forge a pass. Callers grant statuses: write.
+
+on:
+  workflow_call:
+    inputs:
+      repository:
+        default: ${{ github.repository }}
+        type: string
+      ref:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
+      - name: Check
+        run: vp check
+
+      - name: Typecheck
+        run: vp run typecheck
+
+  test:
+    name: Tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
+      - name: Install browser secret helper build libraries
+        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config build-essential
+
+      - name: Test
+        run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' --filter '!@t3tools/web' test
+
+      - name: Test fork scripts
+        if: hashFiles('fork/scripts/*.test.cjs') != ''
+        run: node --test 'fork/scripts/*.test.cjs'
+
+  # The web suite gets its own job, as in upstream's ci.yml: sharing a 4-vCPU
+  # runner with the other packages starved its 30 s import hooks into timeouts.
+  test_web:
+    name: Web tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      # Upstream runs React tests in headless Chromium. Older upstream bases
+      # have no web Playwright dependency and no browser tests.
+      - name: Install Chromium for web browser tests
+        run: |
+          if [[ -f apps/web/node_modules/playwright/cli.js ]]; then
+            node apps/web/node_modules/playwright/cli.js install --with-deps --only-shell chromium
+          fi
+
+      # Document layout needs the runner without competing browser or unit files.
+      - name: Test attachment previews
+        run: vp run --filter @t3tools/web test src/components/files/AttachmentFilePreview.browser.test.tsx --no-file-parallelism
+
+      - name: Test
+        if: ${{ !cancelled() }}
+        run: vp run --filter @t3tools/web test --exclude '**/AttachmentFilePreview.browser.test.tsx'
+
+  test_server:
+    name: Server tests ${{ matrix.shard }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install Chromium for server browser integration tests
+        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+
+      - name: Test
+        run: vp run --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }}
+
+  record:
+    name: Record pass
+    needs: [quality, test, test_web, test_server]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      statuses: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REF: ${{ inputs.ref }}
+    steps:
+      # Only a full commit SHA proves every job checked the same commit; a
+      # branch can move between their checkouts. A local reusable workflow
+      # comes from the caller's commit, GITHUB_SHA.
+      - run: |
+          if [[ ! $REF =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Checked ref $REF is not a full commit SHA; not recording a reusable pass."
+            exit 0
+          fi
+          gh api "repos/$GITHUB_REPOSITORY/statuses/$REF" -f state=success -f context=fork-checks \
+            -f "description=checks@$GITHUB_SHA" \
+            -f "target_url=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > /dev/null

.github/workflows/fork-pr-checks.yml

@@ -0,0 +1,42 @@
+name: Fork PR checks
+
+# Runs upstream's release gate (fork-checks.yml) on a branch prepared for an
+# upstream pull request. Upstream holds CI on PRs from unvouched contributors
+# at "action required" until a maintainer approves the run, so this is the
+# fork's own evidence that the branch passes.
+#
+# Upstream PR branches start from upstream main and don't contain this file,
+# so pushes to them can't trigger it. Start it from main instead:
+#   gh workflow run fork-pr-checks.yml -R Alb11747/t3code -f ref=<branch-or-sha>
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Branch or commit to check
+        required: true
+        type: string
+
+concurrency:
+  group: fork-pr-checks-${{ inputs.ref }}
+  cancel-in-progress: true
+
+permissions:
+  # The job budget reads the repository's recent runs.
+  actions: read
+  contents: read
+
+jobs:
+  budget:
+    name: Job budget
+    uses: ./.github/workflows/fork-budget.yml
+
+  checks:
+    name: Checks
+    needs: [budget]
+    permissions:
+      contents: read
+      statuses: write
+    uses: ./.github/workflows/fork-checks.yml
+    with:
+      ref: ${{ inputs.ref }}