snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

.github/workflows/auto-close-duplicates.yml

@@ -0,0 +1,33 @@
+name: Auto-close duplicate issues
+
+on:
+  schedule:
+    - cron: '0 9 * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  auto-close-duplicates:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - name: Auto-close duplicate issues
+        run: bun run scripts/auto-close-duplicates.ts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
+          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
+          STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }}

.github/workflows/ci-code-check.yml

@@ -0,0 +1,128 @@
+name: Code Checks
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        required: true
+        type: string
+      deno-version:
+        required: true
+        type: string
+
+env:
+  TOOL_NODE_FLAGS: ${{ vars.TOOL_NODE_FLAGS }}
+
+permissions: {}
+
+jobs:
+  code-check:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+
+    name: ${{ matrix.check == 'ts' && 'TypeScript' || 'Code Lint' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        check: ['ts', 'lint']
+
+    steps:
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # v1.0.0
+        with:
+          swap-size-gb: 4
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          node-version: ${{ inputs.node-version }}
+          deno-version: ${{ inputs.deno-version }}
+          cache-modules: true
+          install: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - uses: ./.github/actions/restore-packages
+
+      - name: Restore TypeScript incremental cache
+        id: restore-typecheck
+        if: matrix.check == 'ts'
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ./apps/meteor/tsconfig.typecheck.tsbuildinfo
+          key: typecheck-cache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+          restore-keys: |
+            typecheck-cache-${{ runner.os }}-
+
+      - name: Cache observability (typecheck)
+        if: matrix.check == 'ts'
+        run: |
+          {
+            echo "### TypeScript incremental cache"
+            echo "- **exact hit**: \`${{ steps.restore-typecheck.outputs.cache-hit }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Install Meteor
+        shell: bash
+        run: |
+          # Restore bin from cache
+          set +e
+          METEOR_SYMLINK_TARGET=$(readlink ~/.meteor/meteor)
+          METEOR_TOOL_DIRECTORY=$(dirname "$METEOR_SYMLINK_TARGET")
+          set -e
+          LAUNCHER=$HOME/.meteor/$METEOR_TOOL_DIRECTORY/scripts/admin/launch-meteor
+          if [ -e "$LAUNCHER" ]
+          then
+            echo "Cached Meteor bin found, restoring it"
+            sudo cp "$LAUNCHER" "/usr/local/bin/meteor"
+          else
+            echo "No cached Meteor bin found."
+          fi
+
+          # only install meteor if bin isn't found
+          command -v meteor >/dev/null 2>&1 || curl https://install.meteor.com | sed s/--progress-bar/-sL/g | /bin/sh
+
+      - name: TS TypeCheck
+        if: matrix.check == 'ts'
+        run: yarn turbo run typecheck --concurrency=5
+
+      - name: Save TypeScript incremental cache
+        if: matrix.check == 'ts' && github.ref == 'refs/heads/develop' && github.event_name == 'push'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ./apps/meteor/tsconfig.typecheck.tsbuildinfo
+          key: typecheck-cache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+
+      - name: Restore ESLint cache
+        id: restore-eslint
+        if: matrix.check == 'lint'
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ./apps/meteor/.eslintcache
+          key: eslintcache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+          restore-keys: |
+            eslintcache-${{ runner.os }}-
+
+      - name: Cache observability (eslint)
+        if: matrix.check == 'lint'
+        run: |
+          {
+            echo "### ESLint cache"
+            echo "- **exact hit**: \`${{ steps.restore-eslint.outputs.cache-hit }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Lint
+        if: matrix.check == 'lint'
+        run: yarn lint
+
+      - name: Save ESLint cache
+        if: matrix.check == 'lint' && github.ref == 'refs/heads/develop' && github.event_name == 'push'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ./apps/meteor/.eslintcache
+          key: eslintcache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}

.github/workflows/ci-deploy-gh-pages.yml

@@ -0,0 +1,42 @@
+# .github/workflows/ci-preview-deploy.yml
+name: Deploy GitHub Pages
+concurrency: preview-deploy-${{ github.ref }}
+on:
+  push:
+    branches:
+      - main
+      - master
+      - develop
+
+permissions: {}
+
+jobs:
+  deploy-preview:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          cache-modules: true
+          install: true
+
+      - name: Build
+        run: |
+          yarn turbo run build-preview
+          yarn turbo run .:build-preview-move
+          npx indexifier .preview --html  --extensions .html  > .preview/index.html
+          mv .preview ${{ github.ref_name }}
+          mkdir .preview
+          mv ${{ github.ref_name }} .preview
+
+      - name: Deploy
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: .preview
+          keep_files: true

.github/workflows/ci-test-e2e.yml

@@ -0,0 +1,344 @@
+name: Tests E2E
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        required: true
+        type: string
+      deno-version:
+        required: true
+        type: string
+      lowercase-repo:
+        required: true
+        type: string
+      gh-docker-tag:
+        required: true
+        type: string
+      enterprise-license:
+        type: string
+      transporter:
+        type: string
+      mongodb-version:
+        default: "['8.0']"
+        required: false
+        type: string
+      release:
+        required: true
+        type: string
+      fips:
+        default: false
+        required: false
+        type: boolean
+      shard:
+        default: '[1]'
+        required: false
+        type: string
+      total-shard:
+        default: 1
+        required: false
+        type: number
+      retries:
+        default: 0
+        required: false
+        type: number
+      type:
+        required: true
+        type: string
+      coverage:
+        required: false
+        type: string
+    secrets:
+      CR_USER:
+        required: true
+      CR_PAT:
+        required: true
+      QASE_API_TOKEN:
+        required: false
+      REPORTER_ROCKETCHAT_URL:
+        required: false
+      REPORTER_ROCKETCHAT_API_KEY:
+        required: false
+      CODECOV_TOKEN:
+        required: false
+      REPORTER_JIRA_ROCKETCHAT_API_KEY:
+        required: false
+      NPM_TOKEN:
+        required: false
+
+env:
+  MONGO_URL: mongodb://localhost:27017/rocketchat?replicaSet=rs0&directConnection=true
+  TOOL_NODE_FLAGS: ${{ vars.TOOL_NODE_FLAGS }}
+  LOWERCASE_REPOSITORY: ${{ inputs.lowercase-repo }}
+  DOCKER_TAG: ${{ inputs.gh-docker-tag }}-amd64
+
+permissions: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+
+    env:
+      # if building for production on develop branch or release, add suffix for coverage images
+      DOCKER_TAG_SUFFIX_ROCKETCHAT: ${{ inputs.coverage == matrix.mongodb-version && (github.event_name == 'release' || github.ref == 'refs/heads/develop') && '-cov' || '' }}
+      MONGODB_VERSION: ${{ matrix.mongodb-version }}
+      COVERAGE_DIR: '/tmp/coverage/${{ startsWith(inputs.type, ''api'') && ''api'' || inputs.type }}'
+      COVERAGE_FILE_NAME: '${{ inputs.type }}-${{ matrix.shard }}.json'
+      COVERAGE_REPORTER: ${{ inputs.coverage == matrix.mongodb-version && 'json' || '' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        mongodb-version: ${{ fromJSON(inputs.mongodb-version) }}
+        shard: ${{ fromJSON(inputs.shard) }}
+
+    name: MongoDB ${{ matrix.mongodb-version }}${{ inputs.coverage == matrix.mongodb-version && ' coverage' || '' }} (${{ matrix.shard }}/${{ inputs.total-shard }})
+
+    steps:
+      - name: Collect Workflow Telemetry
+        if: inputs.type == 'perf'
+        uses: catchpoint/workflow-telemetry-action@94c3c3d9567a0205de6da68a76c428ce4e769af1 # v2.0.0
+        with:
+          theme: dark
+          job_summary: true
+          comment_on_pr: false
+
+      - name: Setup kernel limits
+        run: |
+          echo "500 65535" > sudo tee -a /proc/sys/net/ipv4/ip_local_port_range
+          sudo sysctl -w net.ipv4.tcp_mem="383865   511820   2303190"
+
+          echo fs.file-max=20000500 | sudo tee -a /etc/sysctl.conf
+          echo fs.nr_open=20000500 | sudo tee -a /etc/sysctl.conf
+          sudo sysctl -p
+
+      - name: Login to GitHub Container Registry
+        if: (github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'release' || github.ref == 'refs/heads/develop') && github.actor != 'dependabot[bot]'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.CR_USER }}
+          password: ${{ secrets.CR_PAT }}
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          node-version: ${{ inputs.node-version }}
+          deno-version: ${{ inputs.deno-version }}
+          cache-modules: true
+          install: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - uses: ./.github/actions/restore-packages
+
+      # Download Docker images from build artifacts
+      - name: Download Docker images
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        if: github.event.pull_request.head.repo.full_name != github.repository && github.event_name != 'release' && github.ref != 'refs/heads/develop'
+        with:
+          pattern: ${{ inputs.release == 'ce' && 'docker-image-rocketchat-amd64-coverage' || (inputs.fips && 'docker-image-*-amd64-fips' || 'docker-image-*-amd64-coverage') }}
+          path: /tmp/docker-images
+          merge-multiple: true
+
+      # Load Docker images
+      - name: Load Docker images
+        if: github.event.pull_request.head.repo.full_name != github.repository && github.event_name != 'release' && github.ref != 'refs/heads/develop'
+        shell: bash
+        run: |
+          set -o xtrace
+
+          # Load all downloaded images
+          for image_file in /tmp/docker-images/*.tar; do
+            if [ -f "$image_file" ]; then
+              echo "Loading image from $image_file"
+              docker load -i "$image_file"
+              rm "$image_file"
+            fi
+          done
+
+          # List loaded images
+          docker images
+
+      - name: Set DEBUG_LOG_LEVEL (debug enabled)
+        if: runner.debug == '1'
+        run: echo "DEBUG_LOG_LEVEL=2" >> "$GITHUB_ENV"
+
+      - name: Start httpbin container and wait for it to be ready
+        if: startsWith(inputs.type, 'api')
+        run: |
+          docker compose -f docker-compose-ci.yml up -d httpbin
+
+      - name: Prepare code coverage directory
+        run: |
+          set -o xtrace
+
+          mkdir -p "$COVERAGE_DIR"
+          chmod 777 "$COVERAGE_DIR"
+
+      - name: Start containers for CE
+        if: inputs.release == 'ce'
+        env:
+          # API tests intentionally invoke deprecated DDP methods through
+          # /v1/method.call/:method. TEST_MODE='api' keeps every other test
+          # behavior on (rate-limiter bypass, short cache TTLs) while letting
+          # the deprecation logger log without throwing. Other suites use the
+          # docker-compose default of TEST_MODE='true'.
+          TEST_MODE: ${{ startsWith(inputs.type, 'api') && 'api' || 'true' }}
+          TEST_TYPE: ${{ inputs.type }}
+        run: |
+          # when we are testing CE, we only need to start the rocketchat container (plus mock-server for the api suite)
+          services=(rocketchat)
+          if [ "$TEST_TYPE" == "api" ]; then
+            services+=(mock-server)
+          fi
+          DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose -f docker-compose-ci.yml up -d "${services[@]}" --wait
+
+      - name: Start containers for EE
+        if: inputs.release == 'ee'
+        env:
+          ENTERPRISE_LICENSE: ${{ inputs.enterprise-license }}
+          TRANSPORTER: ${{ inputs.transporter }}
+          COMPOSE_PROFILES: ${{ inputs.type == 'api' && 'api' || '' }}
+          TEST_MODE: ${{ startsWith(inputs.type, 'api') && 'api' || 'true' }}
+          APPS_ENGINE_RUNTIME_BACKEND: ${{ inputs.type == 'api-apps-deno' && 'deno' || '' }}
+          FIPS_OVERRIDE: ${{ inputs.fips && '-f docker-compose-ci.fips.yml' || '' }}
+        run: |
+          read -r -a fips_override <<< "$FIPS_OVERRIDE"
+          DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose -f docker-compose-ci.yml "${fips_override[@]}" up -d --wait
+
+      - uses: ./.github/actions/setup-playwright
+        if: inputs.type == 'ui'
+
+      - name: Wait services to start up
+        if: inputs.release == 'ee'
+        run: |
+          docker ps
+
+          until docker compose -f docker-compose-ci.yml logs ddp-streamer-service | grep -q "NetworkBroker started successfully"; do
+            echo "Waiting 'ddp-streamer' to start up"
+            ((c++)) && ((c==10)) && docker compose -f docker-compose-ci.yml logs ddp-streamer-service && exit 1
+            sleep 10
+          done;
+
+      - name: Remove unused Docker images
+        run: docker system prune -af
+
+      - name: E2E Test API
+        if: inputs.type == 'api'
+        working-directory: ./apps/meteor
+        env:
+          WEBHOOK_TEST_URL: 'http://httpbin'
+          IS_EE: ${{ inputs.release == 'ee' && 'true' || '' }}
+        run: |
+          set -o xtrace
+
+          npm run testapi || s=$?
+
+          docker compose -f ../../docker-compose-ci.yml stop
+
+          ls -la "$COVERAGE_DIR"
+          exit "${s:-0}"
+
+      # This step should be temporary, only here until we remove the deno-runtime
+      - name: E2E Test API (apps + deno-runtime)
+        if: (inputs.type == 'api-apps-deno' && inputs.release == 'ee')
+        working-directory: ./apps/meteor
+        env:
+          WEBHOOK_TEST_URL: 'http://httpbin'
+          IS_EE: 'true'
+        run: |
+          set -o xtrace
+
+          npm run testapi:apps || s=$?
+
+          docker compose -f ../../docker-compose-ci.yml stop
+
+          ls -la "$COVERAGE_DIR"
+          exit "${s:-0}"
+
+      - name: E2E Test API (Livechat)
+        if: inputs.type == 'api-livechat'
+        working-directory: ./apps/meteor
+        env:
+          WEBHOOK_TEST_URL: 'http://httpbin'
+          IS_EE: ${{ inputs.release == 'ee' && 'true' || '' }}
+        run: |
+          set -o xtrace
+
+          npm run testapi:livechat || s=$?
+
+          docker compose -f ../../docker-compose-ci.yml stop
+
+          ls -la "$COVERAGE_DIR"
+          exit "${s:-0}"
+
+      - name: E2E Test UI (${{ matrix.shard }}/${{ inputs.total-shard }})
+        if: inputs.type == 'ui'
+        env:
+          E2E_COVERAGE: ${{ inputs.coverage == matrix.mongodb-version && 'true' || '' }}
+          IS_EE: ${{ inputs.release == 'ee' && 'true' || '' }}
+          REPORTER_ROCKETCHAT_API_KEY: ${{ secrets.REPORTER_ROCKETCHAT_API_KEY }}
+          REPORTER_ROCKETCHAT_URL: ${{ secrets.REPORTER_ROCKETCHAT_URL }}
+          REPORTER_JIRA_ROCKETCHAT_API_KEY: ${{ secrets.REPORTER_JIRA_ROCKETCHAT_API_KEY }}
+          REPORTER_ROCKETCHAT_REPORT: ${{ github.event.pull_request.draft != 'true' && secrets.REPORTER_ROCKETCHAT_URL != '' && 'true' || '' }}
+          REPORTER_ROCKETCHAT_RUN: ${{ github.run_number }}
+          REPORTER_ROCKETCHAT_BRANCH: ${{ github.ref }}
+          REPORTER_ROCKETCHAT_DRAFT: ${{ github.event.pull_request.draft }}
+          REPORTER_ROCKETCHAT_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REPORTER_ROCKETCHAT_AUTHOR: ${{ github.event.pull_request.user.login }}
+          REPORTER_ROCKETCHAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          REPORTER_ROCKETCHAT_PR: ${{ github.event.pull_request.number }}
+          QASE_API_TOKEN: ${{ secrets.QASE_API_TOKEN }}
+          QASE_REPORT: ${{ github.ref == 'refs/heads/develop' && 'true' || '' }}
+          CI: true
+          PLAYWRIGHT_RETRIES: ${{ inputs.retries }}
+          E2E_SHARD: ${{ matrix.shard }}
+          E2E_TOTAL_SHARD: ${{ inputs.total-shard }}
+        working-directory: ./apps/meteor
+        run: |
+          set -o xtrace
+
+          yarn prepare
+          yarn test:e2e --shard="$E2E_SHARD/$E2E_TOTAL_SHARD"
+
+      - name: Merge ui coverage files
+        if: inputs.type == 'ui' && inputs.coverage == matrix.mongodb-version
+        working-directory: ./apps/meteor
+        run: |
+          npx nyc merge .nyc_output "${COVERAGE_DIR}/${COVERAGE_FILE_NAME}"
+          ls -la "$COVERAGE_DIR" || true
+
+      - name: Store playwright test trace
+        if: inputs.type == 'ui' && always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-test-trace-${{ inputs.release }}${{ inputs.fips && '-fips' || '' }}-${{ matrix.mongodb-version }}-${{ matrix.shard }}
+          path: ./apps/meteor/tests/e2e/.playwright*
+          include-hidden-files: true
+
+      - name: Show server logs if E2E test failed
+        if: failure()
+        run: docker compose -f docker-compose-ci.yml logs rocketchat authorization-service queue-worker-service ddp-streamer-service account-service presence-service omnichannel-transcript-service
+
+      - name: Show mongo logs if E2E test failed
+        if: failure()
+        run: docker compose -f docker-compose-ci.yml logs mongo
+
+      - name: Show traefik logs if E2E test failed
+        if: failure()
+        run: docker compose -f docker-compose-ci.yml logs traefik
+
+      - name: Store coverage
+        if: inputs.coverage == matrix.mongodb-version
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-${{ inputs.type }}-${{ matrix.shard }}
+          path: /tmp/coverage
+          include-hidden-files: true

.github/workflows/ci-test-storybook.yml

@@ -0,0 +1,62 @@
+name: Test Storybook
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        required: true
+        type: string
+      deno-version:
+        required: true
+        type: string
+
+    secrets:
+      CODECOV_TOKEN:
+        required: true
+      NPM_TOKEN:
+        required: false
+
+env:
+  TOOL_NODE_FLAGS: ${{ vars.TOOL_NODE_FLAGS }}
+
+permissions: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+
+    name: Test Storybook
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          node-version: ${{ inputs.node-version }}
+          deno-version: ${{ inputs.deno-version }}
+          cache-modules: true
+          install: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - uses: ./.github/actions/restore-packages
+
+      - uses: ./.github/actions/setup-playwright
+
+      - name: Run tests
+        run: yarn test-storybook
+        env:
+          STORYBOOK_DISABLE_TELEMETRY: 1
+
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          flags: unit
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+          # tests don't re-run on the develop push, so the merge queue run (same SHA
+          # that lands on develop) provides the develop coverage baseline
+          override_branch: ${{ github.event_name == 'merge_group' && github.event.merge_group.base_ref == 'refs/heads/develop' && 'develop' || '' }}

.github/workflows/ci-test-unit.yml

@@ -0,0 +1,62 @@
+name: Tests Unit
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        required: true
+        type: string
+      deno-version:
+        required: true
+        type: string
+      enterprise-license:
+        required: false
+        type: string
+    secrets:
+      CODECOV_TOKEN:
+        required: false
+      NPM_TOKEN:
+        required: false
+
+env:
+  MONGO_URL: mongodb://localhost:27017/rocketchat?replicaSet=rs0&directConnection=true
+  TOOL_NODE_FLAGS: ${{ vars.TOOL_NODE_FLAGS }}
+  ENTERPRISE_LICENSE: ${{ inputs.enterprise-license }}
+
+permissions: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+
+    name: Unit Tests
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          node-version: ${{ inputs.node-version }}
+          deno-version: ${{ inputs.deno-version }}
+          cache-modules: true
+          install: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - uses: ./.github/actions/restore-packages
+
+      - name: Unit Test
+        run: yarn testunit --concurrency=1
+
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          flags: unit
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+          # tests don't re-run on the develop push, so the merge queue run (same SHA
+          # that lands on develop) provides the develop coverage baseline
+          override_branch: ${{ github.event_name == 'merge_group' && github.event.merge_group.base_ref == 'refs/heads/develop' && 'develop' || '' }}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,57 @@
+name: 'Code scanning - action'
+
+on:
+  push:
+    branches-ignore:
+      - dependabot/**
+  pull_request:
+  schedule:
+    - cron: '0 13 * * *'
+
+jobs:
+  CodeQL-Build:
+    # CodeQL runs on ubuntu-latest and windows-latest
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # We must fetch at least the immediate parents so that if this is
+          # a pull request then we can checkout the head.
+          fetch-depth: 2
+
+      # If this run was triggered by a pull request event, then checkout
+      # the head of the pull request instead of the merge commit.
+      - run: git checkout HEAD^2
+        if: ${{ github.event_name == 'pull_request' }}
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        # Override language selection by uncommenting this and choosing your languages
+        with:
+          languages: javascript
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4

.github/workflows/dedupe-issues.yml

@@ -0,0 +1,85 @@
+name: Rocket.Chat Issue Dedupe
+
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: 'Issue number to process for duplicate detection'
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  dedupe-issues:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      issues: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run Claude Code slash command
+        uses: anthropics/claude-code-base-action@e8132bc5e637a42c27763fc757faa37e1ee43b34 # v0.0.63beta
+        with:
+          prompt: '/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number || inputs.issue_number }}'
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          model: 'claude-sonnet-4-5-20250929'
+          claude_env: |
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log duplicate comment event to Statsig
+        if: always()
+        env:
+          STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }}
+        run: |
+          ISSUE_NUMBER=${{ github.event.issue.number || inputs.issue_number }}
+          REPO=${{ github.repository }}
+
+          if [ -z "$STATSIG_API_KEY" ]; then
+            echo "STATSIG_API_KEY not found, skipping Statsig logging"
+            exit 0
+          fi
+
+          # Prepare the event payload
+          EVENT_PAYLOAD=$(jq -n \
+            --arg issue_number "$ISSUE_NUMBER" \
+            --arg repo "$REPO" \
+            --arg triggered_by "${{ github.event_name }}" \
+            --arg actor "${{ github.actor }}" \
+            '{
+              events: [{
+                eventName: "github_duplicate_comment_added",
+                value: 1,
+                metadata: {
+                  repository: $repo,
+                  issue_number: ($issue_number | tonumber),
+                  triggered_by: $triggered_by,
+                  workflow_run_id: "${{ github.run_id }}",
+                  actor: $actor
+                },
+                time: (now | floor | tostring)
+              }]
+            }')
+
+          # Send to Statsig API
+          echo "Logging duplicate comment event to Statsig for issue #${ISSUE_NUMBER}"
+
+          RESPONSE=$(curl -s -w "\n%{http_code}" -X POST https://events.statsigapi.net/v1/log_event \
+            -H "Content-Type: application/json" \
+            -H "STATSIG-API-KEY: ${STATSIG_API_KEY}" \
+            -d "$EVENT_PAYLOAD")
+
+          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+          BODY=$(echo "$RESPONSE" | head -n-1)
+
+          if [ "$HTTP_CODE" -eq 200 ] || [ "$HTTP_CODE" -eq 202 ]; then
+            echo "Successfully logged duplicate comment event for issue #${ISSUE_NUMBER}"
+          else
+            echo "Failed to log duplicate comment event for issue #${ISSUE_NUMBER}. HTTP ${HTTP_CODE}: ${BODY}"
+          fi

.github/workflows/pr-update-description.yml

@@ -0,0 +1,42 @@
+name: 'Release PR Description'
+
+on:
+  pull_request:
+    branches:
+      - master
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  update-pr:
+    runs-on: ubuntu-24.04
+    if: startsWith(github.head_ref, 'release-')
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.CI_PAT }}
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          cache-modules: true
+          install: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - name: Build packages
+        run: yarn build
+
+      - name: Update PR description
+        uses: ./packages/release-action
+        with:
+          action: update-pr-description
+        env:
+          GITHUB_TOKEN: ${{ secrets.CI_PAT }}

.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: Release
+
+# Single entry point for every path that publishes to npm. npm allows one trusted
+# publisher per package and validates the entry-point workflow filename, so `cut`,
+# `next` and `publish-final` all have to run from this file.
+on:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: '28 21 20 * *' # run at minute 28 to avoid the chance of delay due to high load on GH
+  workflow_dispatch:
+    inputs:
+      name:
+        type: choice
+        description: Release type
+        default: next
+        required: true
+        options:
+          - next
+          - patch
+          - cut
+      base-ref:
+        description: Base version
+        default: develop
+        required: false
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+env:
+  HUSKY: 0
+
+permissions: {}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # npm trusted publishing (OIDC)
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'schedule' && github.ref_name || github.event_name == 'workflow_dispatch' && inputs.base-ref || '' }}
+          fetch-depth: 0
+          token: ${{ secrets.CI_PAT }}
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          cache-modules: true
+          install: true
+          # Transitional: npm attempts the OIDC exchange first and overrides this token on
+          # success, so it only takes effect when the exchange fails. That keeps releases
+          # alive while packages are registered as trusted publishers one by one. Remove
+          # once every package reports a non-null dist.attestations — see docs/npm-publishing.md.
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      # Node 22 bundles npm 10, trusted publishing needs >= 11.5.1
+      - name: Setup npm
+        run: |
+          npm install -g npm@^11.15.0
+          npm --version
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - name: Build packages
+        run: yarn build
+
+      - name: Release
+        uses: ./packages/release-action
+        with:
+          action: ${{ github.event_name == 'push' && 'publish-final' || github.event_name == 'schedule' && 'next' || inputs.name }}
+          base-ref: ${{ github.event_name == 'schedule' && github.ref_name || github.event_name == 'workflow_dispatch' && inputs.base-ref || '' }}
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }} # transitional, see the Setup NodeJS step
+          GITHUB_TOKEN: ${{ secrets.CI_PAT }}

.github/workflows/stale.yml

@@ -0,0 +1,20 @@
+name: Close inactive issues
+on:
+  schedule:
+    - cron: '0 */6 * * *'
+
+jobs:
+  close-issues:
+    runs-on: ubuntu-24.04
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        with:
+          days-before-issue-stale: 14
+          days-before-issue-close: 14
+          any-of-labels: 'stat: need more info,stat: waiting response'
+          stale-issue-label: 'stat: no response'
+          stale-issue-message: 'This issue has been marked as stale because there has been no further activity in the last 10 days. If the issue remains stale for the next 4 days (a total of 14 days with no activity), then it will be assumed that the question has been resolved and the issue will be automatically closed.'
+          close-issue-message: 'This issue was closed because it has been inactive for 14 days since being marked as stale.'
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/todo.yml

@@ -0,0 +1,58 @@
+name: Create issues from TODOs
+
+on:
+  workflow_dispatch:
+    inputs:
+      importAll:
+        default: false
+        required: false
+        type: boolean
+        description: Enable, if you want to import all TODOs. Runs on checked out branch! Only use if you're sure what you are doing.
+      sha:
+        default: ''
+        required: false
+        type: string
+        description: 'A commit SHA or range (e.g. "abc123" or "abc123...def456"). Single SHA compares against its parent.'
+      path:
+        default: ''
+        required: false
+        type: string
+        description: 'Import TODOs from a specific path (e.g. "apps/meteor/client" or "packages/core-typings/src/IMessage.ts").'
+  push:
+    branches: # do not set multiple branches, todos might be added and then get referenced by themselves in case of a merge
+      - develop
+
+permissions:
+  issues: write
+  repository-projects: read
+  contents: read
+
+jobs:
+  todos:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        working-directory: scripts/todo-issue
+
+      - name: Create issues from TODOs
+        run: bun run src/index.ts
+        working-directory: scripts/todo-issue
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
+          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
+          GITHUB_SHA: ${{ github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
+          IMPORT_ALL: ${{ inputs.importAll || 'false' }}
+          SHA_INPUT: ${{ inputs.sha || '' }}
+          PATH_FILTER: ${{ inputs.path || '' }}

.github/workflows/update-version-durability.yml

@@ -0,0 +1,47 @@
+name: Update Version Durability
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      LTS_VERSIONS:
+        required: false
+        type: string
+    secrets:
+      CI_PAT:
+        required: true
+      D360_TOKEN:
+        required: true
+      D360_USER_ID:
+        required: true
+
+permissions: {}
+
+jobs:
+  update-versions:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Use Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.15.0
+
+      - name: Install dependencies
+        run: |
+          cd ./.github/actions/update-version-durability
+          npm install
+
+      - name: Update Version Durability
+        uses: ./.github/actions/update-version-durability
+        with:
+          LTS_VERSIONS: ${{ inputs.LTS_VERSIONS != '' && inputs.LTS_VERSIONS || vars.LTS_VERSIONS }}
+          GH_TOKEN: ${{ secrets.CI_PAT }}
+          D360_TOKEN: ${{ secrets.D360_TOKEN }}
+          D360_ARTICLE_ID: 800f8d52-409d-478d-b560-f82a2c0eb7fb
+          D360_USER_ID: ${{ secrets.D360_USER_ID }}
+          PUBLISH: true