snapshot of https://github.com/makeplane/plane.git @ d868349a55de79979eb8b98701bf1702c67ad634 (2026-09-15)

2026-09-15 15:14:58 +05:00
commit 23059a1de3
5252 changed files with 573834 additions and 0 deletions
--- a/.github/workflows/build-branch.yml
+++ b/.github/workflows/build-branch.yml
@@ -0,0 +1,652 @@
+name: Branch Build CE
+
+on:
+  workflow_dispatch:
+    inputs:
+      build_type:
+        description: "Type of build to run"
+        required: true
+        type: choice
+        default: "Build"
+        options:
+          - "Build"
+          - "Release"
+      releaseVersion:
+        description: "Release Version"
+        type: string
+        default: v0.0.0
+      isPrerelease:
+        description: "Is Pre-release"
+        type: boolean
+        default: false
+        required: true
+      arm64:
+        description: "Build for ARM64 architecture"
+        required: false
+        default: false
+        type: boolean
+      aio_build:
+        description: "Build for AIO docker image"
+        required: false
+        default: false
+        type: boolean
+  push:
+    branches:
+      - preview
+      - canary
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  TARGET_BRANCH: ${{ github.ref_name }}
+  ARM64_BUILD: ${{ github.event.inputs.arm64 }}
+  BUILD_TYPE: ${{ github.event.inputs.build_type }}
+  RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
+  IS_PRERELEASE: ${{ github.event.inputs.isPrerelease }}
+  AIO_BUILD: ${{ github.event.inputs.aio_build }}
+
+jobs:
+  branch_build_setup:
+    name: Build Setup
+    runs-on: ubuntu-24.04
+    outputs:
+      gh_branch_name: ${{ steps.set_env_variables.outputs.TARGET_BRANCH }}
+      # Per-architecture native build matrix. Every image builds one platform per
+      # job on a runner native to it, so there is no single buildx driver/platform
+      # pair for the run and no Docker Build Cloud endpoint.
+      gh_build_matrix: ${{ steps.set_env_variables.outputs.BUILD_MATRIX }}
+      gh_expected_platforms: ${{ steps.set_env_variables.outputs.EXPECTED_PLATFORMS }}
+
+      dh_img_web: ${{ steps.set_env_variables.outputs.DH_IMG_WEB }}
+      dh_img_space: ${{ steps.set_env_variables.outputs.DH_IMG_SPACE }}
+      dh_img_admin: ${{ steps.set_env_variables.outputs.DH_IMG_ADMIN }}
+      dh_img_live: ${{ steps.set_env_variables.outputs.DH_IMG_LIVE }}
+      dh_img_backend: ${{ steps.set_env_variables.outputs.DH_IMG_BACKEND }}
+      dh_img_proxy: ${{ steps.set_env_variables.outputs.DH_IMG_PROXY }}
+      dh_img_aio: ${{ steps.set_env_variables.outputs.DH_IMG_AIO }}
+
+      build_type: ${{steps.set_env_variables.outputs.BUILD_TYPE}}
+      build_release: ${{ steps.set_env_variables.outputs.BUILD_RELEASE }}
+      build_prerelease: ${{ steps.set_env_variables.outputs.BUILD_PRERELEASE }}
+      release_version: ${{ steps.set_env_variables.outputs.RELEASE_VERSION }}
+      aio_build: ${{ steps.set_env_variables.outputs.AIO_BUILD }}
+
+    steps:
+      - id: set_env_variables
+        name: Set Environment Variables
+        run: |
+          # One runner per architecture. arm64 is built natively rather than under
+          # emulation, so there is no cloud builder and no QEMU leg. Both labels are
+          # GitHub-hosted 4 vCPU / 16 GB instances, so a single matrix covers the
+          # JS monorepo images as well as the light ones.
+          AMD64='{"arch":"amd64","platform":"linux/amd64","runner":"ubuntu-24.04"}'
+          ARM64='{"arch":"arm64","platform":"linux/arm64","runner":"ubuntu-24.04-arm"}'
+
+          if [ "${{ env.ARM64_BUILD }}" == "true" ] || ([ "${{ env.BUILD_TYPE }}" == "Release" ] && [ "${{ env.IS_PRERELEASE }}" != "true" ]); then
+            echo "BUILD_MATRIX=[${AMD64},${ARM64}]" >> $GITHUB_OUTPUT
+            echo "EXPECTED_PLATFORMS=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+          else
+            echo "BUILD_MATRIX=[${AMD64}]" >> $GITHUB_OUTPUT
+            echo "EXPECTED_PLATFORMS=linux/amd64" >> $GITHUB_OUTPUT
+          fi
+
+          BR_NAME=$( echo "${{ env.TARGET_BRANCH }}" |sed 's/[^a-zA-Z0-9.-]//g')
+          echo "TARGET_BRANCH=$BR_NAME" >> $GITHUB_OUTPUT
+
+          echo "DH_IMG_WEB=plane-frontend" >> $GITHUB_OUTPUT
+          echo "DH_IMG_SPACE=plane-space" >> $GITHUB_OUTPUT
+          echo "DH_IMG_ADMIN=plane-admin" >> $GITHUB_OUTPUT
+          echo "DH_IMG_LIVE=plane-live" >> $GITHUB_OUTPUT
+          echo "DH_IMG_BACKEND=plane-backend" >> $GITHUB_OUTPUT
+          echo "DH_IMG_PROXY=plane-proxy" >> $GITHUB_OUTPUT
+          echo "DH_IMG_AIO=plane-aio-community" >> $GITHUB_OUTPUT
+
+          echo "BUILD_TYPE=${{env.BUILD_TYPE}}" >> $GITHUB_OUTPUT
+          BUILD_RELEASE=false
+          BUILD_PRERELEASE=false
+          RELVERSION="latest"
+
+          BUILD_AIO=${{ env.AIO_BUILD }}
+
+          if [ "${{ env.BUILD_TYPE }}" == "Release" ]; then
+            FLAT_RELEASE_VERSION=$(echo "${{ env.RELEASE_VERSION }}" | sed 's/[^a-zA-Z0-9.-]//g')
+            echo "FLAT_RELEASE_VERSION=${FLAT_RELEASE_VERSION}" >> $GITHUB_OUTPUT
+
+            semver_regex="^v([0-9]+)\.([0-9]+)\.([0-9]+)(-[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)?$"
+            if [[ ! $FLAT_RELEASE_VERSION =~ $semver_regex ]]; then
+              echo "Invalid Release Version Format : $FLAT_RELEASE_VERSION"
+              echo "Please provide a valid SemVer version"
+              echo "e.g. v1.2.3 or v1.2.3-alpha-1"
+              echo "Exiting the build process"
+              exit 1  # Exit with status 1 to fail the step
+            fi
+            BUILD_RELEASE=true
+            RELVERSION=$FLAT_RELEASE_VERSION
+
+            if [ "${{ env.IS_PRERELEASE }}" == "true" ]; then
+              BUILD_PRERELEASE=true
+            fi
+
+            BUILD_AIO=true
+          fi
+
+          echo "BUILD_RELEASE=${BUILD_RELEASE}" >> $GITHUB_OUTPUT
+          echo "BUILD_PRERELEASE=${BUILD_PRERELEASE}" >> $GITHUB_OUTPUT
+          echo "RELEASE_VERSION=${RELVERSION}" >> $GITHUB_OUTPUT
+          echo "AIO_BUILD=${BUILD_AIO}" >> $GITHUB_OUTPUT
+
+      - id: checkout_files
+        name: Checkout Files
+        uses: actions/checkout@v6
+
+  # Native per-architecture image builds.
+  #
+  # Each branch_build_push_<image> job below builds ONE platform on a runner
+  # native to it and pushes an untagged manifest addressed only by its digest.
+  # The paired branch_merge_<image> job stitches those digests into the
+  # multi-arch manifest and applies the tags -- so any job consuming an image BY
+  # TAG must depend on the merge job, never the build job. GitHub does not warn
+  # when a needs: entry is missing; the dependent job simply runs early.
+  #
+  # buildx-driver is pinned to the local docker-container driver: each leg builds
+  # its own architecture natively, so a remote builder buys nothing. The Docker
+  # Build Cloud path (makeplane/plane-dev) is gone from this workflow rather than
+  # left as a no-op switch.
+  branch_build_push_admin:
+    name: Build-Push Admin Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    needs: [branch_build_setup]
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    steps:
+      - name: Admin Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_admin }}
+          build-context: .
+          dockerfile-path: ./apps/admin/Dockerfile.admin
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          # Without a per-arch cache ref the two legs overwrite each other's
+          # buildcache tag, since it is not platform-indexed.
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-admin-${{ matrix.arch }}
+
+  branch_merge_admin:
+    name: Merge Admin Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_admin]
+    steps:
+      - name: Merge Admin Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_admin }}
+          digest-artifact-pattern: digest-admin-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  branch_build_push_web:
+    name: Build-Push Web Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    needs: [branch_build_setup]
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    steps:
+      - name: Web Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_web }}
+          build-context: .
+          dockerfile-path: ./apps/web/Dockerfile.web
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          # Without a per-arch cache ref the two legs overwrite each other's
+          # buildcache tag, since it is not platform-indexed.
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-web-${{ matrix.arch }}
+
+  branch_merge_web:
+    name: Merge Web Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_web]
+    steps:
+      - name: Merge Web Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_web }}
+          digest-artifact-pattern: digest-web-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  branch_build_push_space:
+    name: Build-Push Space Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    needs: [branch_build_setup]
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    steps:
+      - name: Space Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_space }}
+          build-context: .
+          dockerfile-path: ./apps/space/Dockerfile.space
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          # Without a per-arch cache ref the two legs overwrite each other's
+          # buildcache tag, since it is not platform-indexed.
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-space-${{ matrix.arch }}
+
+  branch_merge_space:
+    name: Merge Space Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_space]
+    steps:
+      - name: Merge Space Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_space }}
+          digest-artifact-pattern: digest-space-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  branch_build_push_live:
+    name: Build-Push Live Collaboration Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    needs: [branch_build_setup]
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    steps:
+      - name: Live Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_live }}
+          build-context: .
+          dockerfile-path: ./apps/live/Dockerfile.live
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          # Without a per-arch cache ref the two legs overwrite each other's
+          # buildcache tag, since it is not platform-indexed.
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-live-${{ matrix.arch }}
+
+  branch_merge_live:
+    name: Merge Live Collaboration Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_live]
+    steps:
+      - name: Merge Live Collaboration Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_live }}
+          digest-artifact-pattern: digest-live-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  branch_build_push_api:
+    name: Build-Push API Server Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    needs: [branch_build_setup]
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    steps:
+      - name: Backend Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_backend }}
+          build-context: ./apps/api
+          dockerfile-path: ./apps/api/Dockerfile.api
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          # Without a per-arch cache ref the two legs overwrite each other's
+          # buildcache tag, since it is not platform-indexed.
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-api-${{ matrix.arch }}
+
+  branch_merge_api:
+    name: Merge API Server Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_api]
+    steps:
+      - name: Merge API Server Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_backend }}
+          digest-artifact-pattern: digest-api-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  branch_build_push_proxy:
+    name: Build-Push Proxy Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    needs: [branch_build_setup]
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    steps:
+      - name: Proxy Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_proxy }}
+          build-context: ./apps/proxy
+          dockerfile-path: ./apps/proxy/Dockerfile.ce
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          # Without a per-arch cache ref the two legs overwrite each other's
+          # buildcache tag, since it is not platform-indexed.
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-proxy-${{ matrix.arch }}
+
+  branch_merge_proxy:
+    name: Merge Proxy Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_proxy]
+    steps:
+      - name: Merge Proxy Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_proxy }}
+          digest-artifact-pattern: digest-proxy-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  # Split out of branch_build_push_aio: build.sh generates the dist/ assets and
+  # uploads them as one artifact. Run inside a matrix, both legs would collide on
+  # that artifact name and could embed different generated content under a single
+  # manifest tag. Generate once, consume twice.
+  prepare_aio_assets:
+    if: ${{ needs.branch_build_setup.outputs.aio_build == 'true' }}
+    name: Prepare AIO Assets
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    needs: [branch_build_setup]
+    outputs:
+      aio_build_version: ${{ steps.prepare_aio_assets.outputs.AIO_BUILD_VERSION }}
+    steps:
+      - name: Checkout Files
+        uses: actions/checkout@v6
+
+      - name: Prepare AIO Assets
+        id: prepare_aio_assets
+        run: |
+          cd deployments/aio/community
+
+          if [ "${{ needs.branch_build_setup.outputs.build_type }}" == "Release" ]; then
+            aio_version=${{ needs.branch_build_setup.outputs.release_version }}
+          else
+            aio_version=${{ needs.branch_build_setup.outputs.gh_branch_name }}
+          fi
+          bash ./build.sh --release $aio_version
+          echo "AIO_BUILD_VERSION=${aio_version}" >> $GITHUB_OUTPUT
+
+      - name: Upload AIO Assets
+        uses: actions/upload-artifact@v7
+        with:
+          path: ./deployments/aio/community/dist
+          name: aio-assets-dist
+
+  # AIO pulls the other images in by tag, so it needs the merge jobs -- the tags
+  # do not exist until the merges run.
+  branch_build_push_aio:
+    if: ${{ needs.branch_build_setup.outputs.aio_build == 'true' }}
+    name: Build-Push AIO Docker Image (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.branch_build_setup.outputs.gh_build_matrix) }}
+    needs:
+      - branch_build_setup
+      - prepare_aio_assets
+      - branch_merge_admin
+      - branch_merge_web
+      - branch_merge_space
+      - branch_merge_live
+      - branch_merge_api
+      - branch_merge_proxy
+    steps:
+      - name: AIO Build and Push
+        uses: makeplane/actions/build-push@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_aio }}
+          build-context: ./deployments/aio/community
+          dockerfile-path: ./deployments/aio/community/Dockerfile
+          buildx-driver: docker-container
+          buildx-version: latest
+          buildx-platforms: ${{ matrix.platform }}
+          buildx-endpoint: ""
+          push-by-digest: "true"
+          cache-scope-suffix: -${{ matrix.arch }}
+          digest-artifact-name: digest-aio-${{ matrix.arch }}
+          additional-assets: aio-assets-dist
+          additional-assets-dir: ./deployments/aio/community/dist
+          build-args: |
+            PLANE_VERSION=${{ needs.prepare_aio_assets.outputs.aio_build_version }}
+
+  branch_merge_aio:
+    name: Merge AIO Manifest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    needs: [branch_build_setup, branch_build_push_aio]
+    steps:
+      - name: Merge AIO Manifest
+        uses: makeplane/actions/merge-manifest@v1.6.0
+        with:
+          build-release: ${{ needs.branch_build_setup.outputs.build_release }}
+          build-prerelease: ${{ needs.branch_build_setup.outputs.build_prerelease }}
+          release-version: ${{ needs.branch_build_setup.outputs.release_version }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          docker-image-owner: makeplane
+          docker-image-name: ${{ needs.branch_build_setup.outputs.dh_img_aio }}
+          digest-artifact-pattern: digest-aio-*
+          expected-platforms: ${{ needs.branch_build_setup.outputs.gh_expected_platforms }}
+
+  upload_build_assets:
+    name: Upload Build Assets
+    runs-on: ubuntu-24.04
+    needs:
+      - branch_build_setup
+      - branch_merge_admin
+      - branch_merge_web
+      - branch_merge_space
+      - branch_merge_live
+      - branch_merge_api
+      - branch_merge_proxy
+    steps:
+      - name: Checkout Files
+        uses: actions/checkout@v6
+
+      - name: Update Assets
+        run: |
+          if [ "${{ needs.branch_build_setup.outputs.build_type }}" == "Release" ]; then
+            REL_VERSION=${{ needs.branch_build_setup.outputs.release_version }}
+          else
+            REL_VERSION=${{ needs.branch_build_setup.outputs.gh_branch_name }}
+          fi
+
+          cp ./deployments/cli/community/install.sh deployments/cli/community/setup.sh
+          sed -i 's/${APP_RELEASE:-stable}/${APP_RELEASE:-'${REL_VERSION}'}/g' deployments/cli/community/docker-compose.yml
+          # sed -i 's/APP_RELEASE=stable/APP_RELEASE='${REL_VERSION}'/g' deployments/cli/community/variables.env
+
+      - name: Upload Assets
+        uses: actions/upload-artifact@v7
+        with:
+          name: community-assets
+          path: |
+            ./deployments/cli/community/setup.sh
+            ./deployments/cli/community/restore.sh
+            ./deployments/cli/community/restore-airgapped.sh
+            ./deployments/cli/community/docker-compose.yml
+            ./deployments/cli/community/variables.env
+            ./deployments/swarm/community/swarm.sh
+
+  publish_release:
+    # Deliberately NO status function here. The default success() gate is what
+    # stops a release when any image fails: a failed build leg skips its
+    # branch_merge_* job, and success() rejects a skipped need.
+    #
+    # That is also why branch_merge_aio is NOT in needs below. AIO runs last (it
+    # needs every other merge), the GitHub release ships no AIO artifact, and
+    # gating on it would let one flaky AIO leg silently discard a finished release.
+    if: ${{ needs.branch_build_setup.outputs.build_type == 'Release' }}
+    name: Build Release
+    runs-on: ubuntu-24.04
+    needs:
+      [
+        branch_build_setup,
+        branch_merge_admin,
+        branch_merge_web,
+        branch_merge_space,
+        branch_merge_live,
+        branch_merge_api,
+        branch_merge_proxy,
+      ]
+    env:
+      REL_VERSION: ${{ needs.branch_build_setup.outputs.release_version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Update Assets
+        run: |
+          cp ./deployments/cli/community/install.sh deployments/cli/community/setup.sh
+          sed -i 's/${APP_RELEASE:-stable}/${APP_RELEASE:-'${REL_VERSION}'}/g' deployments/cli/community/docker-compose.yml
+          # sed -i 's/APP_RELEASE=stable/APP_RELEASE='${REL_VERSION}'/g' deployments/cli/community/variables.env
+
+      - name: Create Release
+        id: create_release
+        uses: softprops/action-gh-release@v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
+        with:
+          tag_name: ${{ env.REL_VERSION }}
+          name: ${{ env.REL_VERSION }}
+          target_commitish: ${{ github.sha }}
+          draft: false
+          prerelease: ${{ env.IS_PRERELEASE }}
+          generate_release_notes: true
+          files: |
+            ${{ github.workspace }}/deployments/cli/community/setup.sh
+            ${{ github.workspace }}/deployments/cli/community/restore.sh
+            ${{ github.workspace }}/deployments/cli/community/restore-airgapped.sh
+            ${{ github.workspace }}/deployments/cli/community/docker-compose.yml
+            ${{ github.workspace }}/deployments/cli/community/variables.env
+            ${{ github.workspace }}/deployments/swarm/community/swarm.sh
--- a/.github/workflows/check-version.yml
+++ b/.github/workflows/check-version.yml
@@ -0,0 +1,45 @@
+name: Version Change Before Release
+
+on:
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+
+      - name: Get PR Branch version
+        run: echo "PR_VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
+
+      - name: Fetch base branch
+        run: git fetch origin master:master
+
+      - name: Get Master Branch version
+        run: |
+          git checkout master
+          echo "MASTER_VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
+
+      - name: Get master branch version and compare
+        run: |
+          echo "Comparing versions: PR version is $PR_VERSION, Master version is $MASTER_VERSION"
+          if [ "$PR_VERSION" == "$MASTER_VERSION" ]; then
+            echo "Version in PR branch is the same as in master. Failing the CI."
+            exit 1
+          else
+            echo "Version check passed. Versions are different."
+          fi
+        env:
+          PR_VERSION: ${{ env.PR_VERSION }}
+          MASTER_VERSION: ${{ env.MASTER_VERSION }}
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,42 @@
+name: "CodeQL"
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["preview", "canary", "master"]
+  pull_request:
+    branches: ["preview", "canary", "master"]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    env:
+      CODEQL_ACTION_FILE_COVERAGE_ON_PRS: "false"
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python", "javascript"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"
--- a/.github/workflows/copyright-check.yml
+++ b/.github/workflows/copyright-check.yml
@@ -0,0 +1,45 @@
+name: Copy Right Check
+
+on:
+    workflow_dispatch:
+    pull_request:
+        branches:
+            - "preview"
+        types:
+            - "opened"
+            - "synchronize"
+            - "ready_for_review"
+            - "review_requested"
+            - "reopened"
+
+jobs:
+    license-check:
+        name: Copy Right Check
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+
+            - name: Set up Go
+              uses: actions/setup-go@v6
+              with:
+                  go-version: "1.22"
+
+            - name: Install addlicense
+              run: |
+                  go install github.com/google/addlicense@latest
+                  echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
+
+            - name: Check Copyright For Python Files
+              run: |
+                  set -e
+                  echo "Running copyright check..."
+                  addlicense -check -f COPYRIGHT.txt -ignore "**/migrations/**" $(git ls-files '*.py')
+                  echo "Copyright check passed."
+
+            - name: Check Copyright For TypeScript Files
+              run: |
+                  set -e
+                  echo "Running copyright check..."
+                  addlicense -check -f COPYRIGHT.txt -ignore "**/*.config.ts" -ignore "**/*.d.ts" $(git ls-files '*.ts' '*.tsx')
+                  echo "Copyright check passed."
--- a/.github/workflows/feature-deployment.yml
+++ b/.github/workflows/feature-deployment.yml
@@ -0,0 +1,178 @@
+name: Feature Preview
+
+on:
+  workflow_dispatch:
+    inputs:
+      base_tag_name:
+        description: 'Base Tag Name'
+        required: false
+        default: 'preview'
+
+env:
+  TARGET_BRANCH: ${{ github.ref_name }}
+
+jobs:
+  branch_build_setup:
+    name: Build Setup
+    runs-on: ubuntu-latest
+    outputs:
+      gh_branch_name: ${{ steps.set_env_variables.outputs.TARGET_BRANCH }}
+      flat_branch_name: ${{ steps.set_env_variables.outputs.FLAT_BRANCH_NAME }}
+      gh_buildx_driver: ${{ steps.set_env_variables.outputs.BUILDX_DRIVER }}
+      gh_buildx_version: ${{ steps.set_env_variables.outputs.BUILDX_VERSION }}
+      gh_buildx_platforms: ${{ steps.set_env_variables.outputs.BUILDX_PLATFORMS }}
+      gh_buildx_endpoint: ${{ steps.set_env_variables.outputs.BUILDX_ENDPOINT }}
+      aio_base_tag: ${{ steps.set_env_variables.outputs.AIO_BASE_TAG }}
+      do_full_build: ${{ steps.set_env_variables.outputs.DO_FULL_BUILD }}
+      do_slim_build: ${{ steps.set_env_variables.outputs.DO_SLIM_BUILD }}
+
+    steps:
+      - id: set_env_variables
+        name: Set Environment Variables
+        env:
+          # Bind user-controlled workflow inputs and branch refs to env vars so
+          # they are never string-interpolated into the shell script by GitHub
+          # Actions (prevents expression-injection / shell-injection).
+          INPUT_BASE_TAG_NAME: ${{ github.event.inputs.base_tag_name }}
+          GH_TARGET_BRANCH: ${{ env.TARGET_BRANCH }}
+        run: |
+          # Strip CR/LF from user-supplied input to prevent $GITHUB_OUTPUT
+          # injection: a newline in the value would forge extra output keys.
+          SAFE_BASE_TAG=$(printf '%s' "$INPUT_BASE_TAG_NAME" | tr -d '\r\n')
+
+          echo "BUILDX_DRIVER=docker-container" >> $GITHUB_OUTPUT
+          echo "BUILDX_VERSION=latest" >> $GITHUB_OUTPUT
+          echo "BUILDX_PLATFORMS=linux/amd64" >> $GITHUB_OUTPUT
+          echo "BUILDX_ENDPOINT=" >> $GITHUB_OUTPUT
+
+          if [ "$SAFE_BASE_TAG" != "" ]; then
+            echo "AIO_BASE_TAG=$SAFE_BASE_TAG" >> $GITHUB_OUTPUT
+          else
+            echo "AIO_BASE_TAG=develop" >> $GITHUB_OUTPUT
+          fi
+
+          echo "TARGET_BRANCH=$GH_TARGET_BRANCH" >> $GITHUB_OUTPUT
+
+          FLAT_BRANCH_NAME=$(echo "$GH_TARGET_BRANCH" | sed 's/[^a-zA-Z0-9]/-/g')
+          echo "FLAT_BRANCH_NAME=$FLAT_BRANCH_NAME" >> $GITHUB_OUTPUT
+
+      - id: checkout_files
+        name: Checkout Files
+        uses: actions/checkout@v6
+
+  full_build_push:
+    runs-on: ubuntu-22.04
+    needs: [branch_build_setup]
+    env:
+      BUILD_TYPE: full
+      AIO_BASE_TAG: ${{ needs.branch_build_setup.outputs.aio_base_tag }}
+      AIO_IMAGE_TAGS: makeplane/plane-aio-feature:${{ needs.branch_build_setup.outputs.flat_branch_name }}
+      BUILDX_DRIVER: ${{ needs.branch_build_setup.outputs.gh_buildx_driver }}
+      BUILDX_VERSION: ${{ needs.branch_build_setup.outputs.gh_buildx_version }}
+      BUILDX_PLATFORMS: ${{ needs.branch_build_setup.outputs.gh_buildx_platforms }}
+      BUILDX_ENDPOINT: ${{ needs.branch_build_setup.outputs.gh_buildx_endpoint }}
+    steps:
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        with:
+          driver: ${{ env.BUILDX_DRIVER }}
+          version: ${{ env.BUILDX_VERSION }}
+          endpoint: ${{ env.BUILDX_ENDPOINT }}
+
+      - name: Check out the repo
+        uses: actions/checkout@v6
+
+      - name: Build and Push to Docker Hub
+        uses: docker/build-push-action@v7.0.0
+        with:
+          context: .
+          file: ./aio/Dockerfile-app
+          platforms: ${{ env.BUILDX_PLATFORMS }}
+          tags: ${{ env.AIO_IMAGE_TAGS }}
+          push: true
+          build-args: 
+            BUILD_TAG=${{ env.AIO_BASE_TAG }}
+            BUILD_TYPE=${{env.BUILD_TYPE}}
+          # cache-from: type=gha
+          # cache-to: type=gha,mode=max
+        env:
+          DOCKER_BUILDKIT: 1
+          DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
+    outputs:
+      AIO_IMAGE_TAGS: ${{ env.AIO_IMAGE_TAGS }}
+
+  feature-deploy:
+    needs: [branch_build_setup, full_build_push]
+    name: Feature Deploy
+    runs-on: ubuntu-latest
+    env:
+      KUBE_CONFIG_FILE: ${{ secrets.FEATURE_PREVIEW_KUBE_CONFIG }}
+      DEPLOYMENT_NAME: ${{ needs.branch_build_setup.outputs.flat_branch_name }}
+    steps:
+      - name: Install AWS cli
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3-pip
+          pip3 install awscli
+      - name: Tailscale
+        uses: tailscale/github-action@v4
+        with:
+          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+      - name: Kubectl Setup
+        run: |
+          curl -LO "https://dl.k8s.io/release/${{ vars.FEATURE_PREVIEW_KUBE_VERSION }}/bin/linux/amd64/kubectl"
+          chmod +x kubectl
+
+          mkdir -p ~/.kube
+          echo "$KUBE_CONFIG_FILE" > ~/.kube/config
+          chmod 600 ~/.kube/config
+      - name: HELM Setup
+        run: |
+          curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
+          chmod 700 get_helm.sh
+          ./get_helm.sh
+      - name: App Deploy
+        run: |
+          helm --kube-insecure-skip-tls-verify repo add feature-preview ${{ vars.FEATURE_PREVIEW_HELM_CHART_URL }} 
+
+          APP_NAMESPACE="${{ vars.FEATURE_PREVIEW_NAMESPACE }}"
+
+          helm --kube-insecure-skip-tls-verify  uninstall \
+            ${{ env.DEPLOYMENT_NAME }} \
+            --namespace $APP_NAMESPACE \
+            --timeout 10m0s \
+            --wait \
+            --ignore-not-found
+
+          METADATA=$(helm --kube-insecure-skip-tls-verify upgrade \
+              --install=true \
+              --namespace $APP_NAMESPACE \
+              --set dockerhub.loginid=${{ secrets.DOCKERHUB_USERNAME }} \
+              --set dockerhub.password=${{ secrets.DOCKERHUB_TOKEN_RO}} \
+              --set config.feature_branch=${{ env.DEPLOYMENT_NAME }} \
+              --set ingress.primaryDomain=${{vars.FEATURE_PREVIEW_PRIMARY_DOMAIN || 'feature.plane.tools' }} \
+              --set ingress.tls_secret=${{vars.FEATURE_PREVIEW_INGRESS_TLS_SECRET || '' }} \
+              --output json \
+              --timeout 10m0s \
+              --wait \
+              ${{ env.DEPLOYMENT_NAME }}  feature-preview/${{ vars.FEATURE_PREVIEW_HELM_CHART_NAME }} )
+
+          APP_NAME=$(echo $METADATA | jq -r '.name')
+
+          INGRESS_HOSTNAME=$(kubectl get ingress -n $APP_NAMESPACE --insecure-skip-tls-verify \
+              -o jsonpath='{.items[?(@.metadata.annotations.meta\.helm\.sh\/release-name=="'$APP_NAME'")]}' | \
+              jq -r '.spec.rules[0].host')
+
+          echo "****************************************"
+          echo "APP NAME ::: $APP_NAME"
+          echo "INGRESS HOSTNAME ::: $INGRESS_HOSTNAME"
+          echo "****************************************"
--- a/.github/workflows/i18n-sync-check.yml
+++ b/.github/workflows/i18n-sync-check.yml
@@ -0,0 +1,51 @@
+name: i18n sync check
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "preview"
+    types:
+      - "opened"
+      - "synchronize"
+      - "reopened"
+      - "ready_for_review"
+    paths:
+      - "packages/i18n/**"
+      - ".github/workflows/i18n-sync-check.yml"
+  push:
+    branches:
+      - "preview"
+    paths:
+      - "packages/i18n/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-check:
+    name: check:sync
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.event_name == 'push' || github.event.pull_request.draft == false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+          filter: blob:none
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22.22.0"
+
+      - name: Enable Corepack and pnpm
+        run: corepack enable pnpm
+
+      - name: Run sync check
+        run: pnpm dlx tsx packages/i18n/scripts/sync-check.ts --ci
--- a/.github/workflows/pull-request-build-lint-api.yml
+++ b/.github/workflows/pull-request-build-lint-api.yml
@@ -0,0 +1,42 @@
+name: Build and lint API
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "preview"
+    types:
+      - "opened"
+      - "synchronize"
+      - "ready_for_review"
+      - "review_requested"
+      - "reopened"
+    paths:
+      - "apps/api/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-api:
+    name: Lint API
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.requested_reviewers != null
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12.x"
+          cache: 'pip'
+          cache-dependency-path: 'apps/api/requirements.txt'
+      - name: Install Pylint
+        run: python -m pip install ruff
+      - name: Install API Dependencies
+        run: cd apps/api && pip install -r requirements.txt
+      - name: Lint apps/api
+        run: ruff check --fix apps/api
--- a/.github/workflows/pull-request-build-lint-web-apps.yml
+++ b/.github/workflows/pull-request-build-lint-web-apps.yml
@@ -0,0 +1,213 @@
+name: Build and lint web apps
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "preview"
+    types:
+      - "opened"
+      - "synchronize"
+      - "reopened"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Format check has no build dependencies - run immediately in parallel
+  check-format:
+    name: check:format
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.requested_reviewers != null
+    env:
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 50
+          filter: blob:none
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+
+      - name: Enable Corepack and pnpm
+        run: corepack enable pnpm
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting
+        run: pnpm turbo run check:format --affected
+
+  # Build packages - required for lint and type checks
+  build:
+    name: Build packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.requested_reviewers != null
+    env:
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+      NODE_OPTIONS: "--max-old-space-size=4096"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 50
+          filter: blob:none
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+
+      - name: Enable Corepack and pnpm
+        run: corepack enable pnpm
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      - name: Restore Turbo cache
+        uses: actions/cache/restore@v5
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.event.pull_request.base.sha }}-${{ github.sha }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.event.pull_request.base.sha }}-
+            turbo-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm turbo run build --affected
+
+      - name: Save Turbo cache
+        uses: actions/cache/save@v5
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.event.pull_request.base.sha }}-${{ github.sha }}
+
+  # Lint check - no build dependency, OxLint is a standalone Rust binary
+  check-lint:
+    name: check:lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.requested_reviewers != null
+    env:
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 50
+          filter: blob:none
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+
+      - name: Enable Corepack and pnpm
+        run: corepack enable pnpm
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run check:lint
+        run: pnpm turbo run check:lint --affected
+
+  # Type check depends on build artifacts
+  check-types:
+    name: check:types
+    runs-on: ubuntu-latest
+    needs: build
+    timeout-minutes: 15
+    env:
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+      NODE_OPTIONS: "--max-old-space-size=4096"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 50
+          filter: blob:none
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+
+      - name: Enable Corepack and pnpm
+        run: corepack enable pnpm
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      - name: Restore Turbo cache
+        uses: actions/cache/restore@v5
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.event.pull_request.base.sha }}-${{ github.sha }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run check:types
+        run: pnpm turbo run check:types --affected
--- a/.github/workflows/react-doctor.yml
+++ b/.github/workflows/react-doctor.yml
@@ -0,0 +1,72 @@
+# React Doctor — finds security, performance, correctness, accessibility,
+# bundle-size, and architecture issues in React codebases.
+#
+# Docs: https://www.react.doctor/ci
+# Source: https://github.com/millionco/react-doctor
+
+name: React Doctor
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  # Scans `preview` on every push so you get a health-score trend on the
+  # default branch — useful for tracking the overall number commit-by-commit
+  # and catching regressions that slipped past PR review. PR-specific steps
+  # (the sticky summary comment) are skipped automatically on `push` events.
+  # Comment this block out if you only want PR-time scans.
+  push:
+    branches: [preview]
+
+permissions:
+  # `actions/checkout` needs this to read the repo source.
+  contents: read
+  # Two uses: (1) reads the PR's changed-file list so the scan only checks
+  # what the PR touched (faster, scoped to the diff), and (2) posts/updates
+  # the sticky React Doctor summary comment on the PR. Downgrade `write` to
+  # `read` to keep the changed-file scan but disable comment posting.
+  pull-requests: write
+  # The sticky-comment step uses GitHub's `issues.createComment` /
+  # `issues.updateComment` endpoints — those are the same APIs that back PR
+  # comments (PRs are issues under the hood). Not exercised on `push`
+  # events, so safe to drop if you only run on `main`.
+  issues: write
+  # Lets the action publish a commit status with the score + error/warning
+  # counts (links to the run). This is how a `push` to `main` surfaces its
+  # result, since the PR comment is skipped off pull requests. Drop it to
+  # disable the status (or set `commit-status: false` below).
+  statuses: write
+
+# Cancels any in-flight scan for the same PR (or branch, on push) the moment
+# a new commit arrives, so reviewers only ever see the latest run.
+concurrency:
+  group: react-doctor-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  react-doctor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # React Doctor diffs the changed files against the merge base so it
+          # only reports what the PR introduces. The default shallow checkout
+          # has no merge base, which makes it fall back to listing every
+          # pre-existing issue in every changed file.
+          fetch-depth: 0
+          # Don't leave the workflow token in .git/config for the third-party
+          # action that runs next. fetch-depth: 0 has already fetched every ref
+          # it needs, and it talks to the API through its own credentials.
+          persist-credentials: false
+
+      - uses: millionco/react-doctor@v2
+        # Common configuration knobs — uncomment any to override the default.
+        # Full reference: https://www.react.doctor/ci
+        # with:
+        #   blocking: warning        # Gate level: "error" (default) | "warning" | "none" (advisory)
+        #   scope: full              # On PRs, scan the whole project instead of just changed files
+        #   comment: false           # Disable the sticky PR summary comment
+        #   review-comments: false   # Disable inline review comments on changed lines
+        #   commit-status: false     # Disable the commit status (score + counts, links to the run)
+        #   version: "0.4.0"         # Pin to a specific react-doctor version instead of "latest"
+        #   directory: apps/web      # Scan a sub-directory (default: ".")
+        #   project: "web,admin"     # In a monorepo, scan specific workspace project(s)