snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

.github/workflows/api-docs-update-check.yml

@@ -0,0 +1,86 @@
+name: API Documentation Update Check
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "api_docs/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-feature-level-updated:
+    runs-on: ubuntu-slim
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.x"
+
+      - name: Run tools/check-feature-level-updated
+        id: run_check
+        run: ./tools/check-feature-level-updated >> $GITHUB_OUTPUT
+
+      - name: Report status to CZO
+        if: ${{ steps.run_check.outputs.fail == 'true' && github.repository == 'zulip/zulip'}}
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "automated testing"
+          topic: ${{ steps.run_check.outputs.topic }}
+          type: "stream"
+          content: ${{ steps.run_check.outputs.content }}
+
+      - name: Fail job if feature level not updated in API docs
+        if: ${{ steps.run_check.outputs.fail == 'true' }}
+        run: exit 1
+
+  notify-if-api-docs-changed:
+    runs-on: ubuntu-slim
+    # The failure message in tools/check-feature-level-updated says that
+    # its failure skips this job. Update that message if changing this
+    # dependency.
+    needs: check-feature-level-updated
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.x"
+
+      - name: Run tools/github-changes-contain-file
+        run: ./tools/github-changes-contain-file api_docs/changelog.md
+
+      - name: Run tools/notify-if-api-docs-changed
+        id: run_check
+        run: ./tools/notify-if-api-docs-changed >> $GITHUB_OUTPUT
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Report status to CZO
+        if: ${{github.repository == 'zulip/zulip'}}
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "api documentation"
+          topic: ${{ steps.run_check.outputs.topic }}
+          type: "stream"
+          content: ${{ steps.run_check.outputs.content }}

.github/workflows/auto-add-parent-label.yml

@@ -0,0 +1,46 @@
+name: Auto add general area label
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+
+jobs:
+  add-general-label:
+    runs-on: ubuntu-slim
+
+    steps:
+      - name: Add general area label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const addedLabel = context.payload.label.name;
+            const issue = context.payload.issue;
+
+            // Explicit allowlist of supported parent labels
+            const allowedParents = new Set([
+              "area: compose",
+              "area: left sidebar",
+              // add more parent labels here if needed
+            ]);
+
+            // Match labels like: "area: compose (uploads)"
+            const match = addedLabel.match(/^area:\s*([^(]+)\s*\(/);
+            if (!match) return;
+
+            const parentLabel = `area: ${match[1].trim()}`;
+
+            // Skip if this parent label isn’t explicitly supported
+            if (!allowedParents.has(parentLabel)) return;
+
+            // Avoid re-adding if parent already exists
+            if (issue.labels.some(l => l.name === parentLabel)) return;
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              labels: [parentLabel],
+            });

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,42 @@
+name: "Code scanning"
+
+on:
+  push:
+    branches: ["*.x", chat.zulip.org, main]
+    tags: ["*"]
+  pull_request:
+    branches: ["*.x", chat.zulip.org, main]
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.run_id }}"
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  CodeQL:
+    permissions:
+      actions: read # for github/codeql-action/init to get workflow details
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/analyze to upload SARIF results
+    if: ${{!github.event.repository.private}}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+
+        # Override language selection by uncommenting this and choosing your languages
+        # with:
+        #   languages: go, javascript, csharp, python, cpp, java
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/production-suite.yml

@@ -0,0 +1,354 @@
+name: Zulip production suite
+
+on:
+  push:
+    branches: ["*.x", chat.zulip.org, main]
+    tags: ["*"]
+  pull_request:
+    paths:
+      - .github/workflows/production-suite.yml
+      - "**/migrations/**"
+      - manage.py
+      - pnpm-lock.yaml
+      - puppet/**
+      - scripts/**
+      - tools/**
+      - uv.lock
+      - web/babel.config.js
+      - web/postcss.config.js
+      - web/third/**
+      - web/webpack.config.ts
+      - zerver/apps.py
+      - zerver/checks.py
+      - zerver/worker/queue_processors.py
+      - zerver/lib/push_notifications.py
+      - zerver/lib/storage.py
+      - zerver/decorator.py
+      - zproject/**
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.run_id }}"
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  production_build:
+    # This job builds a release tarball from the current commit, which
+    # will be used for all of the following install/upgrade tests.
+    name: Ubuntu 22.04 production build
+    runs-on: ubuntu-latest
+
+    # Docker images are built from 'tools/ci/Dockerfile'; the comments at
+    # the top explain how to build and upload these images.
+    # Ubuntu 22.04 ships with Python 3.10.12.
+    container: zulip/ci:jammy
+
+    steps:
+      - name: Add required permissions
+        run: |
+          # The checkout actions doesn't clone to ~/zulip or allow
+          # us to use the path option to clone outside the current
+          # /__w/zulip/zulip directory. Since this directory is owned
+          # by root we need to change it's ownership to allow the
+          # github user to clone the code here.
+          # Note: /__w/ is a docker volume mounted to $GITHUB_WORKSPACE
+          # which is /home/runner/work/.
+          sudo chown -R github .
+
+          # This is the GitHub Actions specific cache directory the
+          # the current github user must be able to access for the
+          # cache action to work. It is owned by root currently.
+          sudo chmod -R 0777 /__w/_temp/
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Create cache directories
+        run: |
+          dirs=(/srv/zulip-emoji-cache)
+          sudo mkdir -p "${dirs[@]}"
+          sudo chown -R github "${dirs[@]}"
+
+      - name: Restore pnpm store
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # zizmor: ignore[cache-poisoning]
+        with:
+          path: /__w/.pnpm-store
+          key: v1-pnpm-store-jammy-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Restore uv cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # zizmor: ignore[cache-poisoning]
+        with:
+          path: ~/.cache/uv
+          key: uv-jammy-${{ hashFiles('uv.lock') }}
+          restore-keys: uv-jammy-
+
+      - name: Restore emoji cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # zizmor: ignore[cache-poisoning]
+        with:
+          path: /srv/zulip-emoji-cache
+          key: v1-emoji-jammy-${{ hashFiles('tools/setup/emoji/emoji_map.json') }}-${{ hashFiles('tools/setup/emoji/build_emoji') }}-${{ hashFiles('tools/setup/emoji/emoji_setup_utils.py') }}-${{ hashFiles('tools/setup/emoji/emoji_names.py') }}-${{ hashFiles('package.json') }}
+          restore-keys: v1-emoji-jammy
+
+      - name: Build production tarball
+        run: ./tools/ci/production-build
+
+      - name: Upload production build artifacts for install jobs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: production-tarball
+          path: /tmp/production-build
+          retention-days: 1
+
+      - name: Verify pnpm store path
+        run: |
+          set -x
+          path="$(pnpm store path)"
+          [[ "$path" == /__w/.pnpm-store/* ]]
+
+      - name: Minimize uv cache
+        run: uv cache prune --ci
+
+      - name: Generate failure report string
+        id: failure_report_string
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        run: tools/ci/generate-failure-message >> $GITHUB_OUTPUT
+
+      - name: Report status to CZO
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "automated testing"
+          topic: ${{ steps.failure_report_string.outputs.topic }}
+          type: "stream"
+          content: ${{ steps.failure_report_string.outputs.content }}
+
+  production_install:
+    # This job installs the server release tarball built above on a
+    # range of platforms, and does some basic health checks on the
+    # resulting installer Zulip server.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Docker images are built from 'tools/ci/Dockerfile'; the comments at
+          # the top explain how to build and upload these images.
+          - docker_image: zulip/ci:jammy
+            name: Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga
+            os: jammy
+            extra-args: ""
+
+          - docker_image: zulip/ci:noble
+            name: Ubuntu 24.04 production install
+            os: noble
+            extra-args: ""
+
+          - docker_image: zulip/ci:resolute
+            name: Ubuntu 26.04 production install
+            os: resolute
+            extra-args: ""
+
+          - docker_image: zulip/ci:bookworm
+            name: Debian 12 production install with custom db name and user
+            os: bookworm
+            extra-args: --test-custom-db
+
+          - docker_image: zulip/ci:trixie
+            name: Debian 13 production install
+            os: trixie
+            extra-args: ""
+
+    name: ${{ matrix.name  }}
+    container:
+      image: ${{ matrix.docker_image }}
+      options: --init
+    runs-on: ubuntu-latest
+    needs: production_build
+
+    steps:
+      - name: Download built production tarball
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: production-tarball
+          path: /tmp
+
+      - name: Add required permissions and setup
+        run: |
+          # This is the GitHub Actions specific cache directory the
+          # the current github user must be able to access for the
+          # cache action to work. It is owned by root currently.
+          sudo chmod -R 0777 /__w/_temp/
+
+          # Since actions/download-artifact@v6 loses all the permissions
+          # of the tarball uploaded by the upload artifact fix those.
+          chmod +x /tmp/production-upgrade-pg
+          chmod +x /tmp/production-pgroonga
+          chmod +x /tmp/production-install
+          chmod +x /tmp/production-verify
+          chmod +x /tmp/generate-failure-message
+
+      - name: Create cache directories
+        run: |
+          dirs=(/srv/zulip-emoji-cache)
+          sudo mkdir -p "${dirs[@]}"
+          sudo chown -R github "${dirs[@]}"
+
+      - name: Install production
+        run: sudo /tmp/production-install ${{ matrix.extra-args }}
+
+      - name: Verify install
+        run: sudo /tmp/production-verify ${{ matrix.extra-args }}
+
+      - name: Install pgroonga
+        if: ${{ matrix.os == 'jammy' }}
+        run: sudo /tmp/production-pgroonga
+
+      - name: Verify install after installing pgroonga
+        if: ${{ matrix.os == 'jammy' }}
+        run: sudo /tmp/production-verify ${{ matrix.extra-args }}
+
+      - name: Upgrade postgresql
+        if: ${{ matrix.os == 'jammy' }}
+        run: sudo /tmp/production-upgrade-pg
+
+      - name: Verify install after upgrading postgresql
+        if: ${{ matrix.os == 'jammy' }}
+        run: sudo /tmp/production-verify ${{ matrix.extra-args }}
+
+      - name: Generate failure report string
+        id: failure_report_string
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        run: /tmp/generate-failure-message >> $GITHUB_OUTPUT
+
+      - name: Report status to CZO
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "automated testing"
+          topic: ${{ steps.failure_report_string.outputs.topic }}
+          type: "stream"
+          content: ${{ steps.failure_report_string.outputs.content }}
+
+  production_upgrade:
+    # The production upgrade job starts with a container with a
+    # previous Zulip release installed, and attempts to upgrade it to
+    # the release tarball built for the current commit being tested.
+    #
+    # This is intended to catch bugs that result in the upgrade
+    # process failing.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Docker images are built from 'tools/ci/Dockerfile.prod'; the comments at
+          # the top explain how to build and upload these images.
+          - docker_image: zulip/ci:jammy-6.0
+            name: 6.0 Version Upgrade
+            os: jammy
+          - docker_image: zulip/ci:bookworm-7.0
+            name: 7.0 Version Upgrade
+            os: bookworm
+          - docker_image: zulip/ci:bookworm-8.0
+            name: 8.0 Version Upgrade
+            os: bookworm
+          - docker_image: zulip/ci:noble-9.0
+            name: 9.0 Version Upgrade
+            os: noble
+          - docker_image: zulip/ci:noble-10.0
+            name: 10.0 Version Upgrade
+            os: noble
+          - docker_image: zulip/ci:trixie-11.0
+            name: 11.0 Version Upgrade
+            os: trixie
+          - docker_image: zulip/ci:resolute-12.0
+            name: 12.0 Version Upgrade
+            os: resolute
+
+    name: ${{ matrix.name  }}
+    container:
+      image: ${{ matrix.docker_image }}
+      options: --init
+    runs-on: ubuntu-latest
+    needs: production_build
+
+    steps:
+      - name: Download built production tarball
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: production-tarball
+          path: /tmp
+
+      - name: Add required permissions and setup
+        run: |
+          # This is the GitHub Actions specific cache directory the
+          # the current github user must be able to access for the
+          # cache action to work. It is owned by root currently.
+          sudo chmod -R 0777 /__w/_temp/
+
+          # Since actions/download-artifact@v6 loses all the permissions
+          # of the tarball uploaded by the upload artifact fix those.
+          chmod +x /tmp/production-upgrade
+          chmod +x /tmp/production-verify
+          chmod +x /tmp/generate-failure-message
+
+      - name: Create cache directories
+        run: |
+          dirs=(/srv/zulip-emoji-cache)
+          sudo mkdir -p "${dirs[@]}"
+          sudo chown -R github "${dirs[@]}"
+
+      - name: Upgrade production
+        run: sudo /tmp/production-upgrade
+
+        # TODO: We should be running production-verify here, but it
+        # doesn't pass yet.
+        #
+        # - name: Verify install
+        #   run: sudo /tmp/production-verify
+
+      - name: Generate failure report string
+        id: failure_report_string
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        run: /tmp/generate-failure-message >> $GITHUB_OUTPUT
+
+      - name: Report status to CZO
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "automated testing"
+          topic: ${{ steps.failure_report_string.outputs.topic }}
+          type: "stream"
+          content: ${{ steps.failure_report_string.outputs.content }}
+
+  required-jobs:
+    name: "Required jobs"
+    if: always()
+    needs:
+      - production_build
+      - production_install
+      - production_upgrade
+    runs-on: ubuntu-slim
+    steps:
+      - name: "Check required jobs"
+        run: jq 'with_entries(.value |= .result | select(.value | IN("success", "skipped") | not)) | if . != {} then halt_error end' <<<"$NEEDS"
+        env:
+          NEEDS: ${{ toJSON(needs) }}

.github/workflows/update-oneclick-apps.yml

@@ -0,0 +1,29 @@
+name: Update one click apps
+on:
+  release:
+    types: [published]
+permissions:
+  contents: read
+
+jobs:
+  update-digitalocean-oneclick-app:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Update DigitalOcean one click app
+        env:
+          DIGITALOCEAN_API_KEY: ${{ secrets.ONE_CLICK_ACTION_DIGITALOCEAN_API_KEY }}
+          ZULIP_API_KEY: ${{ secrets.ONE_CLICK_ACTION_ZULIP_BOT_API_KEY }}
+          ZULIP_EMAIL: ${{ secrets.ONE_CLICK_ACTION_ZULIP_BOT_EMAIL }}
+          ZULIP_SITE: https://chat.zulip.org
+          ONE_CLICK_ACTION_STREAM: kandra ops
+          PYTHON_DIGITALOCEAN_REQUEST_TIMEOUT_SEC: 30
+          RELEASE_VERSION: ${{ github.event.release.tag_name }}
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          git clone https://github.com/zulip/marketplace-partners
+          pip3 install python-digitalocean zulip fab-classic PyNaCl
+          echo $PATH
+          python3 tools/oneclickapps/prepare_digital_ocean_one_click_app_release.py

.github/workflows/zizmor.yml

@@ -0,0 +1,23 @@
+name: GitHub Actions Security Analysis with zizmor
+
+on:
+  push:
+    branches:
+      - main
+  pull_request: {}
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

.github/workflows/zulip-ci.yml

@@ -0,0 +1,295 @@
+# NOTE: Everything test in this file should be in `tools/test-all`.  If there's a
+# reason not to run it there, it should be there as a comment
+# explaining why.
+
+name: Zulip CI
+
+on:
+  push:
+    branches: ["*.x", chat.zulip.org, main]
+    tags: ["*"]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.run_id }}"
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Base images are built using `tools/ci/Dockerfile`.
+          # The comments at the top explain how to build and upload these images.
+          # Ubuntu 22.04 ships with Python 3.10.12.
+          - docker_image: zulip/ci:jammy
+            name: Ubuntu 22.04 (Python 3.10, backend + frontend)
+            os: jammy
+            include_documentation_tests: false
+            include_frontend_tests: true
+          # Debian 12 ships with Python 3.11.2.
+          - docker_image: zulip/ci:bookworm
+            name: Debian 12 (Python 3.11, backend + documentation)
+            os: bookworm
+            include_documentation_tests: true
+            include_frontend_tests: false
+          # Ubuntu 24.04 ships with Python 3.12.2.
+          - docker_image: zulip/ci:noble
+            name: Ubuntu 24.04 (Python 3.12, backend)
+            os: noble
+            include_documentation_tests: false
+            include_frontend_tests: false
+          # Ubuntu 26.04 ships with Python 3.14.4.
+          - docker_image: zulip/ci:resolute
+            name: Ubuntu 26.04 (Python 3.14, backend)
+            os: resolute
+            include_documentation_tests: false
+            include_frontend_tests: false
+          # Debian 13 ships with Python 3.13.5.
+          - docker_image: zulip/ci:trixie
+            name: Debian 13 (Python 3.13, backend)
+            os: trixie
+            include_documentation_tests: false
+            include_frontend_tests: false
+
+    runs-on: ubuntu-latest
+    name: ${{ matrix.name }}
+    container: ${{ matrix.docker_image }}
+    env:
+      # GitHub Actions sets HOME to /github/home which causes
+      # problem later in provision and frontend test that runs
+      # tools/setup/postgresql-init-dev-db because of the .pgpass
+      # location. PostgreSQL (psql) expects .pgpass to be at
+      # /home/github/.pgpass and setting home to `/home/github/`
+      # ensures it written there because we write it to ~/.pgpass.
+      HOME: /home/github/
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Create cache directories
+        run: |
+          dirs=(/srv/zulip-emoji-cache)
+          sudo mkdir -p "${dirs[@]}"
+          sudo chown -R github "${dirs[@]}"
+
+      - name: Restore pnpm store
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # zizmor: ignore[cache-poisoning]
+        with:
+          path: /__w/.pnpm-store
+          key: v1-pnpm-store-${{ matrix.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Restore uv cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # zizmor: ignore[cache-poisoning]
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ matrix.os }}-${{ hashFiles('uv.lock') }}
+          restore-keys: uv-${{ matrix.os }}-
+
+      - name: Restore emoji cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # zizmor: ignore[cache-poisoning]
+        with:
+          path: /srv/zulip-emoji-cache
+          key: v1-emoji-${{ matrix.os }}-${{ hashFiles('tools/setup/emoji/emoji_map.json', 'tools/setup/emoji/build_emoji', 'tools/setup/emoji/emoji_setup_utils.py', 'tools/setup/emoji/emoji_names.py', 'package.json') }}
+          restore-keys: v1-emoji-${{ matrix.os }}
+
+      - name: Install dependencies
+        run: |
+          # This is the main setup job for the test suite
+          ./tools/ci/setup-backend --skip-dev-db-build
+          scripts/lib/clean_unused_caches.py --verbose --threshold=0
+
+      - name: Run tools test
+        run: |
+          source tools/ci/activate-venv
+          ./tools/test-tools
+
+      - name: Run Codespell lint
+        run: |
+          source tools/ci/activate-venv
+          ./tools/run-codespell
+
+      # We run the tests that are only run in a specific job early, so
+      # that we get feedback to the developer about likely failures as
+      # quickly as possible. Backend/mypy failures that aren't
+      # identical across different versions are much more rare than
+      # frontend linter or node test failures.
+      - name: Run documentation and api tests
+        if: ${{ matrix.include_documentation_tests }}
+        run: |
+          source tools/ci/activate-venv
+          ./tools/build-help-center
+          # In CI, we only test links we control in test-documentation to avoid flakes
+          ./tools/test-documentation --skip-external-links
+          ./tools/test-help-documentation --skip-external-links --help-center
+          ./tools/test-api
+
+      - name: Run node tests
+        if: ${{ matrix.include_frontend_tests }}
+        run: |
+          source tools/ci/activate-venv
+          # Run the node tests first, since they're fast and deterministic
+          ./tools/test-js-with-node --coverage --parallel=1
+
+      - name: Run frontend lint
+        if: ${{ matrix.include_frontend_tests }}
+        run: |
+          source tools/ci/activate-venv
+          ./tools/lint --groups=frontend --skip=gitlint # gitlint disabled because flaky
+
+      - name: Check schemas
+        if: ${{ matrix.include_frontend_tests }}
+        run: |
+          source tools/ci/activate-venv
+          # Check that various schemas are consistent. (is fast)
+          ./tools/check-schemas
+
+      - name: Check capitalization of strings
+        if: ${{ matrix.include_frontend_tests }}
+        run: |
+          source tools/ci/activate-venv
+          ./manage.py makemessages --locale en
+          ./tools/check-capitalization --no-generate
+          ./tools/check-frontend-i18n --no-generate
+
+      - name: Run astro check
+        if: ${{ matrix.include_frontend_tests }}
+        run: |
+          pnpm run --filter=starlight_help check
+
+      - name: Run puppeteer tests
+        if: ${{ matrix.include_frontend_tests }}
+        run: |
+          source tools/ci/activate-venv
+          ./tools/test-js-with-puppeteer
+
+      - name: Check pnpm dedupe
+        if: ${{ matrix.include_frontend_tests }}
+        run: pnpm dedupe --check
+
+      - name: Run backend lint
+        run: |
+          source tools/ci/activate-venv
+          echo "Test suite is running under $(python --version)."
+          ./tools/lint --groups=backend --skip=gitlint,mypy # gitlint disabled because flaky
+
+      - name: Run backend tests
+        run: |
+          source tools/ci/activate-venv
+          ./tools/test-backend ${{ matrix.os != 'bookworm' && '--coverage' || '' }} --xml-report --no-html-report --include-webhooks --include-transaction-tests --no-cov-cleanup --ban-console-output
+
+      - name: Run mypy
+        run: |
+          source tools/ci/activate-venv
+          # We run mypy after the backend tests so we get output from the
+          # backend tests, which tend to uncover more serious problems, first.
+          ./tools/run-mypy --version
+          ./tools/run-mypy
+
+      - name: Run miscellaneous tests
+        run: |
+          source tools/ci/activate-venv
+          env -u PYTHONDEVMODE -u PYTHONWARNINGS uv lock --check
+
+          # ./tools/test-run-dev  # https://github.com/zulip/zulip/pull/14233
+          #
+          # This test has been persistently flaky at like 1% frequency, is slow,
+          # and is for a very specific single feature, so we don't run it by default:
+          # ./tools/test-queue-worker-reload
+
+          ./tools/test-migrations
+          ./tools/setup/optimize-svg --check
+          ./tools/setup/generate_integration_bots_avatars.py --check-missing
+          ./tools/ci/check-executables
+
+          # Ban check-database-compatibility from transitively
+          # relying on static/generated, because it might not be
+          # up-to-date at that point in upgrade-zulip-stage-2.
+          chmod 000 static/generated web/generated
+          ./scripts/lib/check-database-compatibility
+          chmod 755 static/generated web/generated
+
+      - name: Check for untracked files
+        run: |
+          source tools/ci/activate-venv
+          # This final check looks for untracked files that may have been
+          # created by test-backend or provision.
+          untracked="$(git ls-files --exclude-standard --others)"
+          if [ -n "$untracked" ]; then
+              printf >&2 "Error: untracked files:\n%s\n" "$untracked"
+              exit 1
+          fi
+
+      - name: Upload coverage reports
+
+        # Only upload coverage when both frontend and backend
+        # tests are run.
+        if: ${{ matrix.include_frontend_tests }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          files: var/coverage.xml,var/node-coverage/lcov.info
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Store Puppeteer artifacts
+        # Upload these on failure, as well
+        if: ${{ always() && matrix.include_frontend_tests }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: puppeteer
+          path: ./var/puppeteer
+          retention-days: 60
+
+      - name: Check development database build
+        run: ./tools/ci/setup-backend
+
+      - name: Verify pnpm store path
+        run: |
+          set -x
+          path="$(pnpm store path)"
+          [[ "$path" == /__w/.pnpm-store/* ]]
+
+      - name: Minimize uv cache
+        run: uv cache prune --ci
+
+      - name: Generate failure report string
+        id: failure_report_string
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        run: tools/ci/generate-failure-message >> $GITHUB_OUTPUT
+
+      - name: Report status to CZO
+        if: ${{ failure() && github.repository == 'zulip/zulip' && github.event_name == 'push' }}
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "automated testing"
+          topic: ${{ steps.failure_report_string.outputs.topic }}
+          type: "stream"
+          content: ${{ steps.failure_report_string.outputs.content }}
+
+  required-jobs:
+    name: "Required jobs"
+    if: always()
+    needs:
+      - tests
+    runs-on: ubuntu-slim
+    steps:
+      - name: "Check required jobs"
+        run: jq 'with_entries(.value |= .result | select(.value | IN("success", "skipped") | not)) | if . != {} then halt_error end' <<<"$NEEDS"
+        env:
+          NEEDS: ${{ toJSON(needs) }}

.github/workflows/zulip-cloud-deploy.yaml

@@ -0,0 +1,108 @@
+name: Notify of issues resolved in latest Zulip Cloud deploy
+
+on:
+  push:
+    branches:
+      - zulip-cloud-current
+  workflow_dispatch:
+    inputs:
+      before:
+        description: "Old commit-ish"
+        required: true
+      after:
+        description: "New commit-ish"
+        required: true
+      stream:
+        description: "Stream to send to"
+        default: "zulip cloud"
+      topic:
+        description: "Topic to send to"
+        default: "latest deploy"
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
+jobs:
+  build-messages:
+    runs-on: ubuntu-slim
+    outputs:
+      filenames: ${{ steps.set-matrix.outputs.filenames }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.x"
+
+      - name: Install uv
+        run: |
+          ./scripts/lib/install-uv
+
+      - name: Generate list of resolved issues
+        id: generate
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BASE: ${{ inputs.before || github.event.before }}
+          HEAD: ${{ inputs.after || github.event.after }}
+        run: |
+          set -o pipefail
+
+          mkdir closed-by-commits-output
+          ./tools/closed-by-commits "$BASE" "$HEAD" \
+            | perl -ple 'undef $/;s/\n\n/\x00/g' \
+            | split -t '\0' -C 8000 -d - closed-by-commits-output/message-
+          perl -pi -e 's/\00/\n\n/g' closed-by-commits-output/message-*
+
+      - name: Upload messages as artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: closed-by-commits-output
+          path: closed-by-commits-output/
+
+      - name: Store filename list for matrix
+        id: set-matrix
+        run: |
+          cd closed-by-commits-output/
+          echo "filenames=$(ls | jq -Rnc '[inputs]')" >> $GITHUB_OUTPUT
+
+  send-messages:
+    needs: build-messages
+    runs-on: ubuntu-slim
+    strategy:
+      max-parallel: 1
+      matrix:
+        filename: ${{ fromJson(needs.build-messages.outputs.filenames) }}
+    if: ${{ success() && github.repository == 'zulip/zulip' }}
+    steps:
+      - name: Download messages as artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: closed-by-commits-output
+          path: closed-by-commits-output/
+
+      - name: Read message contents
+        id: read-file
+        run: |
+          echo "content<<EOF" >> $GITHUB_OUTPUT
+          cat "closed-by-commits-output/$FILENAME" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+        env:
+          FILENAME: ${{ matrix.filename }}
+
+      - name: Send to Zulip
+        uses: zulip/github-actions-zulip/send-message@f675f2b4eb2a95fae974215476dcb7ad8dfeff6b # v2.0.2
+        with:
+          api-key: ${{ secrets.ZULIP_BOT_KEY }}
+          email: "github-actions-bot@chat.zulip.org"
+          organization-url: "https://chat.zulip.org"
+          to: "${{ inputs.stream || 'zulip cloud' }}"
+          topic: "${{ inputs.topic || 'latest deploy' }}"
+          type: "stream"
+          content: ${{ steps.read-file.outputs.content }}