feat(1.116): update apis (#2808)

.github/dependabot.yml

@@ -1,12 +1,9 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: github-actions
-    directory: "/"
+    directory: /
     target-branch: insider
     schedule:
-      interval: "weekly"
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci-build-linux.yml

@@ -0,0 +1,371 @@
+name: CI - Build - Linux
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  DISABLE_UPDATE: yes
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: linux
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: ubuntu-22.04
+    env:
+      VSCODE_ARCH: x64
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+          image: vscodium/vscodium-linux-build-agent:focal-x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+          image: vscodium/vscodium-linux-build-agent:focal-arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+          image: vscodium/vscodium-linux-build-agent:focal-armhf
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+          image: vscodium/vscodium-linux-build-agent:focal-riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+          image: vscodium/vscodium-linux-build-agent:crimson-loong64
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+          image: vscodium/vscodium-linux-build-agent:focal-ppc64le
+    container:
+      image: ${{ matrix.image }}
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_APP_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install dependencies
+        run: ./build/linux/deps.sh
+        if: env.DISABLED != 'yes'
+
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes'
+
+      - name: Build
+        id: build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_bin.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Prepare assets
+        env:
+          SHOULD_BUILD_APPIMAGE: ${{ vars[format('DISABLE_{0}_APPIMAGE', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] == 'yes' && 'no' || 'yes' }}
+          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
+        run: ./prepare_assets.sh
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_linux:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+        - slug: S390X
+          vscode_arch: s390x
+          npm_arch: s390x
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.DISABLED != 'yes'
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-linux-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_alpine:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_ALPINE_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      OS_NAME: alpine
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/alpine/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-alpine-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-macos.yml

@@ -0,0 +1,90 @@
+name: CI - Build - macOS
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ${{ matrix.runner }}
+    env:
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-intel
+            vscode_arch: x64
+          - runner: [self-hosted, macOS, ARM64]
+            vscode_arch: arm64
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: . get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.VSCODE_ARCH == 'x64'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-windows.yml

@@ -0,0 +1,166 @@
+name: CI - Build - Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: windows
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: windows-2022
+    defaults:
+      run:
+        shell: bash
+    env:
+      VSCODE_ARCH: 'x64'
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        vscode_arch:
+          - x64
+          - arm64
+    defaults:
+      run:
+        shell: bash
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD_REH: no
+      SHOULD_BUILD_REH_WEB: no
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+
+      - name: Build
+        env:
+          DISABLE_MSI: ${{ vars[format('DISABLE_{0}_MSI', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.vscode_arch }}
+          npm_config_target_arch: ${{ matrix.vscode_arch }}
+        run: ./build/windows/package.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Prepare checksums
+        run: ./prepare_checksums.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: github.event.inputs.generate_assets == 'true'

.github/workflows/insider-spearhead.yml

@@ -1,98 +0,0 @@
-name: insider-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-      dont_dispatch:
-        type: boolean
-        description: Disable dispatch
-  schedule:
-    - cron: '0 7 * * *'
-
-jobs:
-  build:
-    runs-on: macos-15
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}-insiders
-      BINARY_NAME: codium-insiders
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: insider
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: insider
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload sourcemaps
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./upload_sourcemaps.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v4
-        with:
-          event-type: insider
-        if: github.event.inputs.dont_dispatch != 'true' && (env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true')

.github/workflows/lint-zizmor.yml

@@ -0,0 +1,30 @@
+name: Lint - zizmor
+
+on:
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

.github/workflows/lock.yml

@@ -1,17 +0,0 @@
-name: Lock Closed Threads
-
-on:
-  schedule:
-    - cron: '0 2 * * *'
-
-jobs:
-  lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/lock-threads@v6
-        with:
-          github-token: ${{ github.token }}
-          issue-inactive-days: '90'
-          pr-inactive-days: '90'
-          discussion-inactive-days: '90'
-          log-output: true

.github/workflows/mod-lock-closed-threads.yml

@@ -0,0 +1,22 @@
+name: Moderation - Lock Closed Threads
+
+on:
+  schedule:
+    - cron: 0 2 * * *
+
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: "90"
+          pr-inactive-days: "90"
+          discussion-inactive-days: "90"
+          log-output: true

.github/workflows/mod-stale-issue-pr.yml

@@ -0,0 +1,24 @@
+name: Moderation - Stale Issues & PR
+
+on:
+  schedule:
+    - cron: 0 1 * * *
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          days-before-stale: 180
+          days-before-close: 30
+          operations-per-run: 1024
+          stale-issue-message: This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
+          close-issue-message: This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
+          exempt-issue-labels: discussion,never-stale
+          stale-pr-message: This PR has been automatically marked as stale.
+          close-pr-message: This PR has been closed due to inactivity, and will not be monitored.
+          only-pr-labels: needs-information

.github/workflows/publish-insider-linux.yml

@@ -1,37 +1,19 @@
-name: insider-linux
+name: Publish - Insider - Linux
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [insider]
+    types:
-  push:
+      - publish-insider
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -40,77 +22,66 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -123,8 +94,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +108,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +120,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -185,29 +159,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -221,16 +188,17 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Build
+        id: build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
@@ -241,37 +209,34 @@ jobs:
         env:
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -304,37 +269,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -345,7 +304,7 @@ jobs:
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -355,38 +314,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -405,34 +359,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -445,45 +393,38 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium-insiders-bin
         - package_name: vscodium-insiders
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
 
     steps:
       - name: Get version
@@ -492,7 +433,7 @@ jobs:
         run: echo "PACKAGE_VERSION=${RELEASE_VERSION/-*/}" >> "${GITHUB_ENV}"
 
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_version: ${{ env.PACKAGE_VERSION }}
@@ -505,6 +446,9 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium-insiders
@@ -514,21 +458,17 @@ jobs:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
-      - name: Switch to relevant branch
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
-
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
         with:
           path: stores/snapcraft/insider
           architecture: ${{ matrix.platform }}
@@ -539,7 +479,7 @@ jobs:
       #     snap: ${{ steps.build.outputs.snap }}
       #     isClassic: 'true'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -551,11 +491,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-insider-macos.yml

@@ -1,35 +1,17 @@
-name: insider-macos
+name: Publish - Insider - macOS
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [insider]
+    types:
-  push:
+      - publish-insider
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,6 +20,9 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
@@ -50,39 +35,29 @@ jobs:
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -98,30 +73,21 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-insider-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Insider - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 7 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}-insiders
+  BINARY_NAME: codium-insiders
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: insider
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-insider
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-insider-windows.yml

@@ -1,35 +1,17 @@
-name: insider-windows
+name: Publish - Insider - Windows
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [insider]
+    types:
-  push:
+      - publish-insider
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,41 +20,33 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: windows-2022
+    permissions: {}
     defaults:
       run:
         shell: bash
@@ -80,52 +54,38 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      # - name: Setup GCC
-      #   uses: egor-tensin/setup-gcc@v1
-      #   with:
-      #     version: 10
-      #     platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
-      # - name: Install libkrb5-dev
-      #   run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
-      #   if: env.SHOULD_BUILD == 'yes'
-
       - name: Clone VSCode repo
         run: ./get_repo.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -138,11 +98,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -150,6 +110,9 @@ jobs:
       - check
       - compile
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -164,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -203,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -218,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -242,52 +198,46 @@ jobs:
           artifact-configuration-slug: ${{ matrix.vscode_arch }}
           wait-for-completion: true
           # 3h to manually approve the request
-          wait-for-completion-timeout-in-seconds: 10800
+          wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   winget:
     needs: build
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium.Insiders
       ASSETS_REPOSITORY: vscodium-insiders
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -295,7 +245,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/publish-stable-linux.yml

@@ -1,36 +1,19 @@
-name: stable-linux
+name: Publish - Stable - Linux
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [stable]
+    types:
-  push:
+      - publish-stable
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -39,79 +22,67 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
+          FORCE_LINUX_SNAP: ${{ github.event.inputs.force_snap }}
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -124,8 +95,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -138,11 +109,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -150,6 +121,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -186,29 +160,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-        if: env.DISABLED != 'yes'
-
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -222,16 +189,17 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Build
+        id: build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
@@ -242,37 +210,34 @@ jobs:
         env:
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -305,37 +270,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -346,7 +305,7 @@ jobs:
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -356,38 +315,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -406,34 +360,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -446,51 +394,42 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium
           package_type: stable
-        # - package_name: vscodium-git
-        #   package_type: rolling
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_type: ${{ matrix.package_type }}
@@ -503,26 +442,25 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium
+      SNAP_PUBLISHER: vscodium
     strategy:
       fail-fast: false
       matrix:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Check version
         env:
@@ -532,23 +470,21 @@ jobs:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         run: ./stores/snapcraft/check_version.sh
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-        if: env.SHOULD_BUILD == 'yes'
 
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
         with:
           path: stores/snapcraft/stable
           architecture: ${{ matrix.platform }}
         id: build
-        if: env.SHOULD_BUILD == 'yes'
 
-      - uses: diddlesnaps/snapcraft-review-action@v1
+      - uses: diddlesnaps/snapcraft-review-action@40554b42331cf84dab19ef98c382620427f13482 # v1.3.1
         with:
           snap: ${{ steps.build.outputs.snap }}
           isClassic: 'true'
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes' || env.SHOULD_DEPLOY_TO_STORE == 'yes'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -556,7 +492,7 @@ jobs:
           tag: ${{ env.RELEASE_VERSION }}
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes'
 
-      - uses: snapcore/action-publish@master
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         with:
@@ -569,7 +505,8 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
@@ -582,11 +519,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-stable-macos.yml

@@ -1,34 +1,17 @@
-name: stable-macos
+name: Publish - Stable - macOS
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [stable]
+    types:
-  push:
+      - publish-stable
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,6 +20,9 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
@@ -49,39 +35,29 @@ jobs:
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -97,29 +73,20 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-stable-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Stable - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 18 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}
+  BINARY_NAME: codium
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: stable
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-stable
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-stable-windows.yml

@@ -1,34 +1,17 @@
-name: stable-windows
+name: Publish - Stable - Windows
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [stable]
+    types:
-  push:
+      - publish-stable
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,41 +20,33 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: windows-2022
+    permissions: {}
     defaults:
       run:
         shell: bash
@@ -79,52 +54,38 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      # - name: Setup GCC
-      #   uses: egor-tensin/setup-gcc@v1
-      #   with:
-      #     version: 10
-      #     platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
-      # - name: Install libkrb5-dev
-      #   run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
-      #   if: env.SHOULD_BUILD == 'yes'
-
       - name: Clone VSCode repo
         run: ./get_repo.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +98,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +110,9 @@ jobs:
       - check
       - compile
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -163,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -202,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -217,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -243,48 +200,42 @@ jobs:
           # 8h to manually approve the request
           wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   winget:
     needs: build
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -292,7 +243,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/stable-spearhead.yml

@@ -1,93 +0,0 @@
-name: stable-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-  schedule:
-    - cron: '0 18 * * *'
-
-jobs:
-  build:
-    runs-on: macos-15
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}
-      BINARY_NAME: codium
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: stable
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload sourcemaps
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./upload_sourcemaps.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v4
-        with:
-          event-type: stable
-        if: env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true'

.github/workflows/stale.yml

@@ -1,25 +0,0 @@
-name: Stale Issues
-
-on:
-  schedule:
-    - cron: '0 1 * * *'
-
-permissions:
-  issues: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v10
-        with:
-          days-before-stale: 180
-          days-before-close: 30
-          stale-issue-label: stale
-          operations-per-run: 1024
-          stale-issue-message: >
-            This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
-          close-issue-message: >
-            This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
-          exempt-issue-labels: discussion,never-stale
-          only-pr-labels: needs-information

.nvmrc

@@ -1 +1 @@
-22.22.0
+22.22.1

build.sh

@@ -13,14 +13,9 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
   cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
   export NODE_OPTIONS="--max-old-space-size=8192"
+  export VSCODE_PUBLISH_COUNTER=1
 
-  npm run monaco-compile-check
+  npm run gulp vscode-min-prepack
-  npm run valid-layers-check
-
-  npm run gulp compile-build-without-mangling
-  npm run gulp compile-extension-media
-  npm run gulp compile-extensions-build
-  npm run gulp minify-vscode
 
   if [[ "${OS_NAME}" == "osx" ]]; then
     # remove win32 node modules
@@ -30,7 +25,7 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
     npm run copy-policy-dto --prefix build
     node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc darwin
 
-    npm run gulp "vscode-darwin-${VSCODE_ARCH}-min-ci"
+    npm run gulp "vscode-darwin-${VSCODE_ARCH}-min-packing"
 
     find "../VSCode-darwin-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 
@@ -46,7 +41,7 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
       npm run copy-policy-dto --prefix build
       node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc win32
 
-      npm run gulp "vscode-win32-${VSCODE_ARCH}-min-ci"
+      npm run gulp "vscode-win32-${VSCODE_ARCH}-min-packing"
 
       if [[ "${VSCODE_ARCH}" != "x64" ]]; then
         SHOULD_BUILD_REH="no"
@@ -67,7 +62,7 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
       npm run copy-policy-dto --prefix build
       node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc linux
 
-      npm run gulp "vscode-linux-${VSCODE_ARCH}-min-ci"
+      npm run gulp "vscode-linux-${VSCODE_ARCH}-min-packing"
 
       find "../VSCode-linux-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 

build/alpine/check_tags.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+  if [[ -z $( contains "${APP_NAME_LC}-reh-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Alpine ${VSCODE_ARCH} because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Alpine REH ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Alpine ${VSCODE_ARCH} because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Alpine REH-web ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+else
+
+  # alpine-arm64
+  if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine arm64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine arm64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+  fi
+
+  # alpine-x64
+  if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine x64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine x64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+  fi
+fi

build/linux/check_tags.sh

@@ -0,0 +1,345 @@
+#!/usr/bin/env bash
+
+if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Linux ${VSCODE_ARCH} because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Linux REH ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Linux ${VSCODE_ARCH} because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Linux REH-web ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+
+else
+
+  # linux-arm64
+  if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "arm64.deb" ) ]]; then
+      echo "Building on Linux arm64 because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "aarch64.rpm" ) ]]; then
+      echo "Building on Linux arm64 because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ -z $( contains "arm64.snap" ) || "${FORCE_LINUX_SNAP}" == "true" ]]; then
+      echo "Building on Linux arm64 because we have no SNAP"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_SNAP="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux arm64 builds"
+    fi
+  fi
+
+  # linux-armhf
+  if [[ "${VSCODE_ARCH}" == "armhf" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "armhf.deb" ) ]]; then
+      echo "Building on Linux arm because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "armv7hl.rpm" ) ]]; then
+      echo "Building on Linux arm because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux arm builds"
+    fi
+  fi
+
+  # linux-ppc64le
+  if [[ "${VSCODE_ARCH}" == "ppc64le" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "ppc64el.deb" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "ppc64le.rpm" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux PowerPC64LE builds"
+    fi
+  fi
+
+  # linux-riscv64
+  if [[ "${VSCODE_ARCH}" == "riscv64" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_DEB="no"
+    export SHOULD_BUILD_RPM="no"
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME}-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux riscv64 builds"
+    fi
+  fi
+
+  # linux-loong64
+  if [[ "${VSCODE_ARCH}" == "loong64" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_DEB="no"
+    export SHOULD_BUILD_RPM="no"
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME}-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux Loong64 builds"
+    fi
+  fi
+
+  # linux-s390x
+  if [[ "${VSCODE_ARCH}" == "s390x" || "${CHECK_ALL}" == "yes" ]]; then
+    SHOULD_BUILD_APPIMAGE="no"
+    SHOULD_BUILD_DEB="no"
+    SHOULD_BUILD_RPM="no"
+    SHOULD_BUILD_TAR="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-reh-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux s390x because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux s390x because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux s390x builds"
+    fi
+  fi
+
+  # linux-x64
+  if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "amd64.deb" ) ]]; then
+      echo "Building on Linux x64 because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "x86_64.rpm" ) ]]; then
+      echo "Building on Linux x64 because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${DISABLE_APPIMAGE}" == "yes" ]]; then
+      export SHOULD_BUILD_APPIMAGE="no"
+    elif [[ -z $( contains "x86_64.AppImage" ) ]]; then
+      echo "Building on Linux x64 because we have no AppImage"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_APPIMAGE="no"
+    fi
+
+    if [[ -z $( contains "amd64.snap" ) || "${FORCE_LINUX_SNAP}" == "true" ]]; then
+      echo "Building on Linux x64 because we have no SNAP"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_SNAP="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux x64 builds"
+    fi
+  fi
+fi

build/linux/package_bin.sh

@@ -7,6 +7,9 @@ if [[ "${CI_BUILD}" == "no" ]]; then
   exit 1
 fi
 
+npm -v
+node -v
+
 # include common functions
 . ./utils.sh
 
@@ -26,10 +29,12 @@ if [[ "${VSCODE_ARCH}" == "arm64" || "${VSCODE_ARCH}" == "armhf" ]]; then
 elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20240129-253798'
+  export VSCODE_SYSROOT_PREFIX="-glibc-2.28"
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
   export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_ELECTRON_REPOSITORY='lex-ibm/electron-ppc64le-build-scripts'
+  export IGNORE_ELECTRON_VERSION="yes"
 elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
   export VSCODE_ELECTRON_REPOSITORY='riscv-forks/electron-riscv-releases'
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
@@ -56,7 +61,7 @@ if [[ -f "../build/linux/${VSCODE_ARCH}/electron.sh" ]]; then
   TARGET=$( npm config get target )
 
   # Only fails at different major versions
-  if [[ "${ELECTRON_VERSION%%.*}" != "${TARGET%%.*}" ]]; then
+  if [[ "${ELECTRON_VERSION%%.*}" != "${TARGET%%.*}" ]] && [[ "${IGNORE_ELECTRON_VERSION}" != "yes" ]]; then
     # Fail the pipeline if electron target doesn't match what is used.
     echo "Electron ${VSCODE_ARCH} binary version doesn't match target electron version!"
     echo "Releases available at: https://github.com/${VSCODE_ELECTRON_REPOSITORY}/releases"
@@ -134,7 +139,7 @@ find .build/extensions -type f -name '*.node' -print -delete
 npm run copy-policy-dto --prefix build
 node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc linux
 
-npm run gulp "vscode-linux-${VSCODE_ARCH}-min-ci"
+npm run gulp "vscode-linux-${VSCODE_ARCH}-min-packing"
 
 if [[ -f "../build/linux/${VSCODE_ARCH}/ripgrep.sh" ]]; then
   bash "../build/linux/${VSCODE_ARCH}/ripgrep.sh" "../VSCode-linux-${VSCODE_ARCH}/resources/app/node_modules"
@@ -144,4 +149,10 @@ find "../VSCode-linux-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 
 . ../build_cli.sh
 
+if [[ -n "${GITHUB_OUTPUT}" ]]; then
+  echo "VSCODE_SYSROOT_REPOSITORY=${VSCODE_SYSROOT_REPOSITORY:-}" >> "${GITHUB_OUTPUT}"
+  echo "VSCODE_SYSROOT_VERSION=${VSCODE_SYSROOT_VERSION:-}" >> "${GITHUB_OUTPUT}"
+  echo "VSCODE_SYSROOT_PREFIX=${VSCODE_SYSROOT_PREFIX:-}" >> "${GITHUB_OUTPUT}"
+fi
+
 cd ..

build/linux/package_reh.sh

@@ -50,13 +50,13 @@ elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20240129-253798'
 elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
-  NODE_VERSION="20.16.0"
+  NODE_VERSION="22.21.1"
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:focal-devtoolset-riscv64"
 
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_NODEJS_SITE='https://unofficial-builds.nodejs.org'
 elif [[ "${VSCODE_ARCH}" == "loong64" ]]; then
-  NODE_VERSION="20.16.0"
+  NODE_VERSION="22.21.1"
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:beige-devtoolset-loong64"
 
   export VSCODE_SKIP_SETUPENV=1

build/linux/ppc64le/electron.sh

@@ -2,5 +2,5 @@
 
 set -ex
 
-export ELECTRON_VERSION="39.2.7"
+export ELECTRON_VERSION="41.0.3"
 export VSCODE_ELECTRON_TAG="v${ELECTRON_VERSION}"

build/linux/ppc64le/electron.sha256sums

@@ -1,10 +1,11 @@
-bacff46523cea806df9788d9e24f7f53fad2317f18afdcbc596b86863dd40805 *chromedriver-v39.2.7-linux-ppc64le.zip
+120e0e5915c8f1a49904737e82bf50bc72563f8556fc3c5997c118908b377874 *chromedriver-v41.0.3-linux-ppc64le.zip
-b83820b37325c0a6ce0bbb98344b54f70ef7c2a949eea61bcb423b18c623a742 *electron-v39.2.7-linux-ppc64le-debug.zip
+4601e7692cac011610c245d8c58f14a73b415fccf520194f14674f81e4ce2c41 *electron-v41.0.3-linux-ppc64le-debug.zip
-7d3b4ff4320a54572f9e1e0286702a0bed3e1596a2cb34f8fdc455acf3b9234f *electron-v39.2.7-linux-ppc64le-symbols.zip
+498a74b78699ff9d4819310262d96e861dd7d899f38f8f625a311968b076b29b *electron-v41.0.3-linux-ppc64le-symbols.zip
-6974cf1c8a550019b04762222742b8f1d9d76387594a191d3522cd65da075db1 *electron-v39.2.7-linux-ppc64le.zip
+77e86aa200d9e19b5eb3a51f273ee410788c21977f2ea76b1239d79aa2e1adbf *electron-v41.0.3-linux-ppc64le.zip
-40c772eb189d100087b75da6c2ad1aeb044f1d661c90543592546a654b0b6d5b *electron.d.ts
+e246066ccc328729e6a9f2a0d829bc893391cf54ed199b809bb7e47993fed88f *electron.d.ts
-0c923001d08e474d0dcd3b747b4f9a4bfca685d755ec08de8e44556a63f9ad3a *hunspell_dictionaries.zip
+687a36388a7cf06427d7fa7e3db7fca4ab0118c5eab2baeac128c1989a600cff *ffmpeg-v41.0.3-linux-ppc64le.zip
-ee57f79e88f50f199a6aeb87fa45c83d1bd0f92eb72e00787cfdf4cf11863562 *libcxx-objects-v39.2.7-linux-ppc64le.zip
+70ba677d4bea3e7164c82f6b5a36ac6b740317fb1dd149a0eaf1ff151da44cb2 *hunspell_dictionaries.zip
-a8709029737d3073758ccb384161a37d91f16e5a3f8110ca8e2c30f83ef8d7e6 *libcxx_headers.zip
+3e85df4843497ce567ad36ddf826cd1af7dfe9f883daad4623736ddd012dbfd1 *libcxx-objects-v41.0.3-linux-ppc64le.zip
-238dcec817528659a86b0cd3d7dabe301e65b4cab25e45c5bbab7642a8849c02 *libcxxabi_headers.zip
+5587472eeaf9bfb76d0f187ecc19d11d60bc05f5e7c8fa822f2370210c30b95d *libcxx_headers.zip
-be033ed825bd8be92bb6ca86ff81f0907e60aa999aa011f5ddf1360abb19429b *mksnapshot-v39.2.7-linux-ppc64le.zip
+f531ddd2782b4b19caf622c0355c93892965e22861279cc891675230c1310905 *libcxxabi_headers.zip
+6cb0e67dc5a23de0ebbe89253e1f24bf9d4ca41213a1b9f784f2afaa2cf61324 *mksnapshot-v41.0.3-linux-ppc64le.zip

build/linux/prepare_assets.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+if [[ -z "${VSCODE_SYSROOT_REPOSITORY}" ]]; then
+  unset VSCODE_SYSROOT_REPOSITORY
+fi
+
+if [[ -z "${VSCODE_SYSROOT_VERSION}" ]]; then
+  unset VSCODE_SYSROOT_VERSION
+fi
+
+if [[ -z "${VSCODE_SYSROOT_PREFIX}" ]]; then
+  unset VSCODE_SYSROOT_PREFIX
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" && "${VSCODE_ARCH}" != "x64" ]]; then
+  SHOULD_BUILD_APPIMAGE="no"
+fi
+
+if [[ "${SHOULD_BUILD_DEB}" != "no" || "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-deb"
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-build-deb"
+fi
+
+if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-rpm"
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-build-rpm"
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  . ../build/linux/appimage/build.sh
+fi
+
+cd ..
+
+if [[ "${CI_BUILD}" == "no" ]]; then
+  . ./stores/snapcraft/build.sh
+
+  if [[ "${SKIP_ASSETS}" == "no" ]]; then
+    mv stores/snapcraft/build/*.snap assets/
+  fi
+fi
+
+if [[ "${SHOULD_BUILD_TAR}" != "no" ]]; then
+  echo "Building and moving TAR"
+  cd "VSCode-linux-${VSCODE_ARCH}"
+  tar czf "../assets/${APP_NAME}-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" .
+  cd ..
+fi
+
+if [[ "${SHOULD_BUILD_DEB}" != "no" ]]; then
+  echo "Moving DEB"
+  mv vscode/.build/linux/deb/*/deb/*.deb assets/
+fi
+
+if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
+  echo "Moving RPM"
+  mv vscode/.build/linux/rpm/*/*.rpm assets/
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  echo "Moving AppImage"
+  mv build/linux/appimage/out/*.AppImage* assets/
+
+  find assets -name '*.AppImage*' -exec bash -c 'mv $0 ${0/_-_/-}' {} \;
+fi

build/osx/check_tags.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+if [[ -z $( contains "${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+  echo "Building on MacOS because we have no ZIP"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_ZIP="no"
+fi
+
+if [[ -z $( contains ".${VSCODE_ARCH}.${RELEASE_VERSION}.dmg" ) ]]; then
+  echo "Building on MacOS because we have no DMG"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_DMG="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-reh-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no REH archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_REH="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-reh-web-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no REH-web archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_REH_WEB="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-cli-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no CLI archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_CLI="no"
+fi
+
+if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+  echo "Already have all the MacOS builds"
+fi

build/osx/prepare_assets.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  if [[ "${CI_BUILD}" == "no" ]]; then
+    RUNNER_TEMP="${TMPDIR}"
+  fi
+
+  CERTIFICATE_P12="${APP_NAME}.p12"
+  KEYCHAIN="${RUNNER_TEMP}/buildagent.keychain"
+  AGENT_TEMPDIRECTORY="${RUNNER_TEMP}"
+  # shellcheck disable=SC2006
+  KEYCHAINS=`security list-keychains | xargs`
+
+  rm -f "${KEYCHAIN}"
+
+  echo "${CERTIFICATE_OSX_P12_DATA}" | base64 --decode > "${CERTIFICATE_P12}"
+
+  echo "+ create temporary keychain"
+  security create-keychain -p pwd "${KEYCHAIN}"
+  security set-keychain-settings -lut 21600 "${KEYCHAIN}"
+  security unlock-keychain -p pwd "${KEYCHAIN}"
+  # shellcheck disable=SC2086
+  security list-keychains -s $KEYCHAINS "${KEYCHAIN}"
+  # security show-keychain-info "${KEYCHAIN}"
+
+  echo "+ import certificate to keychain"
+  security import "${CERTIFICATE_P12}" -k "${KEYCHAIN}" -P "${CERTIFICATE_OSX_P12_PASSWORD}" -T /usr/bin/codesign
+  security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd "${KEYCHAIN}" > /dev/null
+  # security find-identity "${KEYCHAIN}"
+
+  CODESIGN_IDENTITY="$( security find-identity -v -p codesigning "${KEYCHAIN}" | grep -oEi "([0-9A-F]{40})" | head -n 1 )"
+
+  echo "+ signing"
+  export CODESIGN_IDENTITY AGENT_TEMPDIRECTORY
+
+  DEBUG="electron-osx-sign*" node vscode/build/darwin/sign.ts "$( pwd )"
+  # codesign --display --entitlements :- ""
+
+  echo "+ notarize"
+
+  cd "VSCode-darwin-${VSCODE_ARCH}"
+  ZIP_FILE="./${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip"
+
+  zip -r -X -y "${ZIP_FILE}" ./*.app
+
+  xcrun notarytool store-credentials "${APP_NAME}" --apple-id "${CERTIFICATE_OSX_ID}" --team-id "${CERTIFICATE_OSX_TEAM_ID}" --password "${CERTIFICATE_OSX_APP_PASSWORD}" --keychain "${KEYCHAIN}"
+  # xcrun notarytool history --keychain-profile "${APP_NAME}" --keychain "${KEYCHAIN}"
+  xcrun notarytool submit "${ZIP_FILE}" --keychain-profile "${APP_NAME}" --wait --keychain "${KEYCHAIN}"
+
+  echo "+ attach staple"
+  xcrun stapler staple ./*.app
+  # spctl --assess -vv --type install ./*.app
+
+  rm "${ZIP_FILE}"
+
+  cd ..
+fi
+
+if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
+  echo "Building and moving ZIP"
+  cd "VSCode-darwin-${VSCODE_ARCH}"
+  zip -r -X -y "../assets/${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ./*.app
+  cd ..
+fi
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" && "${SHOULD_BUILD_DMG}" != "no" ]]; then
+  echo "Building and moving DMG"
+  pushd "VSCode-darwin-${VSCODE_ARCH}"
+  npx create-dmg ./*.app .
+  mv ./*.dmg "../assets/${APP_NAME}.${VSCODE_ARCH}.${RELEASE_VERSION}.dmg"
+  popd
+fi
+
+if [[ "${SHOULD_BUILD_SRC}" == "yes" ]]; then
+  git archive --format tar.gz --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.tar.gz" HEAD
+  git archive --format zip --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.zip" HEAD
+fi
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  echo "+ clean"
+  security delete-keychain "${KEYCHAIN}"
+  # shellcheck disable=SC2086
+  security list-keychains -s $KEYCHAINS
+fi

build/windows/appx/build.sh

@@ -8,7 +8,7 @@ export PATH="${SDK}:${PATH}"
 
 APPX_NAME="${BINARY_NAME//-/_}"
 
-makeappx pack /d "../../../VSCode-win32-${VSCODE_ARCH}/appx/manifest" /p "../../../VSCode-win32-${VSCODE_ARCH}/appx/${APPX_NAME}_${VSCODE_ARCH}.appx" /nv
+powershell "makeappx pack /d ..\\VSCode-win32-${VSCODE_ARCH}\\appx\\manifest /p ..\\VSCode-win32-${VSCODE_ARCH}\\appx\\${APPX_NAME}_${VSCODE_ARCH}.appx /nv"
 
 # Remove the raw manifest folder
-rm -rf "../../../VSCode-win32-${VSCODE_ARCH}/appx/manifest"
+rm -rf "../VSCode-win32-${VSCODE_ARCH}/appx/manifest"

build/windows/check_tags.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+# windows-arm64
+if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
+  if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows arm64 because we have no system setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_SYS="no"
+  fi
+
+  if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows arm64 because we have no user setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_USR="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    echo "Building on Windows arm64 because we have no zip"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_ZIP="no"
+  fi
+
+  export SHOULD_BUILD_REH="no"
+  export SHOULD_BUILD_REH_WEB="no"
+
+  if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows arm64 because we have no CLI archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_CLI="no"
+  fi
+
+  if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+    echo "Already have all the Windows arm64 builds"
+  fi
+
+# windows-x64
+else
+  if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows x64 because we have no system setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_SYS="no"
+  fi
+
+  if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows x64 because we have no user setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_USR="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    echo "Building on Windows x64 because we have no zip"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_ZIP="no"
+  fi
+
+  if [[ "${DISABLE_MSI}" == "yes" ]]; then
+      export SHOULD_BUILD_MSI="no"
+  elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
+    echo "Building on Windows x64 because we have no msi"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_MSI="no"
+  fi
+
+  if [[ "${DISABLE_MSI}" == "yes" ]]; then
+      export SHOULD_BUILD_MSI_NOUP="no"
+  elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
+    echo "Building on Windows x64 because we have no updates-disabled msi"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_MSI_NOUP="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no CLI archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_CLI="no"
+  fi
+
+  if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+    echo "Already have all the Windows x64 builds"
+  fi
+fi

build/windows/package.sh

@@ -31,7 +31,9 @@ find .build/extensions -type f -name '*.node' -print -delete
 npm run copy-policy-dto --prefix build
 node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc win32
 
-npm run gulp "vscode-win32-${VSCODE_ARCH}-min-ci"
+# node build/win32/explorer-dll-fetcher.ts .build/win32/appx
+
+npm run gulp "vscode-win32-${VSCODE_ARCH}-min-packing"
 
 . ../build_cli.sh
 

build/windows/prepare_assets.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+npm run gulp "vscode-win32-${VSCODE_ARCH}-inno-updater"
+
+# . ../build/windows/appx/build.sh
+
+if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
+  7z.exe a -tzip "../assets/${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" -x!CodeSignSummary*.md -x!tools "../VSCode-win32-${VSCODE_ARCH}/*" -r
+fi
+
+if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
+  npm run gulp "vscode-win32-${VSCODE_ARCH}-system-setup"
+fi
+
+if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
+  npm run gulp "vscode-win32-${VSCODE_ARCH}-user-setup"
+fi
+
+if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
+  if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
+    . ../build/windows/msi/build.sh
+  fi
+
+  if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
+    . ../build/windows/msi/build-updates-disabled.sh
+  fi
+fi
+
+cd ..
+
+if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
+  echo "Moving System EXE"
+  mv "vscode\\.build\\win32-${VSCODE_ARCH}\\system-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
+fi
+
+if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
+  echo "Moving User EXE"
+  mv "vscode\\.build\\win32-${VSCODE_ARCH}\\user-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
+fi
+
+if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
+  if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
+    echo "Moving MSI"
+    mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" assets/
+  fi
+
+  if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
+    echo "Moving MSI with disabled updates"
+    mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" assets/
+  fi
+fi

build_cli.sh

@@ -81,6 +81,21 @@ else
       export CXX_armv7_unknown_linux_gnueabihf=arm-linux-gnueabihf-g++
       export PKG_CONFIG_ALLOW_CROSS=1
     fi
+  elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
+    VSCODE_CLI_TARGET="powerpc64le-unknown-linux-gnu"
+
+    # Use system libs instead of @vscode/openssl-prebuilt
+    mkdir -p openssl/out/ppc64le-linux/
+    ln -sf /usr/lib/powerpc64le-linux-gnu openssl/out/ppc64le-linux/lib
+    ln -sf /usr/include openssl/out/ppc64le-linux/include
+
+    if [[ "${CI_BUILD}" != "no" ]] && [[ "$(uname -m)" != "ppc64le" ]]; then
+      export CARGO_TARGET_POWERPC64LE_UNKNOWN_LINUX_GNU_LINKER=powerpc64le-linux-gnu-gcc-10
+      export CC_powerpc64le_unknown_linux_gnu=powerpc64le-linux-gnu-gcc-10
+      export CXX_powerpc64le_unknown_linux_gnu=powerpc64le-linux-gnu-g++-10
+      export PKG_CONFIG_ALLOW_CROSS=1
+    fi
+
   elif [[ "${VSCODE_ARCH}" == "x64" ]]; then
     VSCODE_CLI_TARGET="x86_64-unknown-linux-gnu"
   fi

check_tags.sh

@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 # shellcheck disable=SC2129
 
+# Env Paramaters
+# CHECK_ALL: yes | no
+# CHECK_REH: yes | no
+# CHECK_ONLY_REH: yes | no
+# FORCE_LINUX_SNAP: true
+
 set -e
 
 if [[ -z "${GH_TOKEN}" ]] && [[ -z "${GITHUB_TOKEN}" ]] && [[ -z "${GH_ENTERPRISE_TOKEN}" ]] && [[ -z "${GITHUB_ENTERPRISE_TOKEN}" ]]; then
@@ -77,546 +83,23 @@ elif [[ "${ASSETS}" != "null" ]]; then
     fi
   # macos
   elif [[ "${OS_NAME}" == "osx" ]]; then
-    if [[ -z $( contains "${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    . ./build/osx/check_tags.sh
-      echo "Building on MacOS because we have no ZIP"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_ZIP="no"
-    fi
-
-    if [[ -z $( contains ".${VSCODE_ARCH}.${RELEASE_VERSION}.dmg" ) ]]; then
-      echo "Building on MacOS because we have no DMG"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_DMG="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-reh-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no REH archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_REH="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-reh-web-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no REH-web archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_REH_WEB="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-cli-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no CLI archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_CLI="no"
-    fi
-
-    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-      echo "Already have all the MacOS builds"
-    fi
   elif [[ "${OS_NAME}" == "windows" ]]; then
-
+    . ./build/windows/check_tags.sh
-    # windows-arm64
-    if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows arm64 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows arm64 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows arm64 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      export SHOULD_BUILD_REH="no"
-      export SHOULD_BUILD_REH_WEB="no"
-
-      if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows arm64 because we have no CLI archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_CLI="no"
-      fi
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows arm64 builds"
-      fi
-
-    # windows-x64
-    else
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows x64 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows x64 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows x64 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows x64 because we have no msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI_NOUP="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows x64 because we have no updates-disabled msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI_NOUP="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no REH archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no REH-web archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH_WEB="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no CLI archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_CLI="no"
-      fi
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows x64 builds"
-      fi
-    fi
   else
     if [[ "${OS_NAME}" == "linux" ]]; then
-      if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+      . ./build/linux/check_tags.sh
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Linux ${VSCODE_ARCH} because we have no REH archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Linux REH ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH="no"
-        fi
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Linux ${VSCODE_ARCH} because we have no REH-web archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Linux REH-web ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH_WEB="no"
-        fi
-
-      else
-
-        # linux-arm64
-        if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "arm64.deb" ) ]]; then
-            echo "Building on Linux arm64 because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "aarch64.rpm" ) ]]; then
-            echo "Building on Linux arm64 because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ -z $( contains "arm64.snap" ) ]]; then
-            echo "Building on Linux arm64 because we have no SNAP"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_SNAP="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-cli-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no CLI archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_CLI="no"
-          fi
-
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux arm64 builds"
-          fi
-        fi
-
-        # linux-armhf
-        if [[ "${VSCODE_ARCH}" == "armhf" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "armhf.deb" ) ]]; then
-            echo "Building on Linux arm because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "armv7hl.rpm" ) ]]; then
-            echo "Building on Linux arm because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-cli-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no CLI archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_CLI="no"
-          fi
-
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux arm builds"
-          fi
-        fi
-
-        # linux-ppc64le
-        if [[ "${VSCODE_ARCH}" == "ppc64le" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_APPIMAGE="no"
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux PowerPC64LE builds"
-          fi
-        fi
-
-        # linux-riscv64
-        if [[ "${VSCODE_ARCH}" == "riscv64" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux riscv64 builds"
-          fi
-        fi
-
-        # linux-loong64
-        if [[ "${VSCODE_ARCH}" == "loong64" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-         export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux Loong64 builds"
-          fi
-        fi
-
-        # linux-s390x
-        if [[ "${VSCODE_ARCH}" == "s390x" || "${CHECK_ALL}" == "yes" ]]; then
-          SHOULD_BUILD_APPIMAGE="no"
-          SHOULD_BUILD_DEB="no"
-          SHOULD_BUILD_RPM="no"
-          SHOULD_BUILD_TAR="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-reh-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux s390x because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux s390x because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-         export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux s390x builds"
-          fi
-        fi
-
-        # linux-x64
-        if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "amd64.deb" ) ]]; then
-            echo "Building on Linux x64 because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "x86_64.rpm" ) ]]; then
-            echo "Building on Linux x64 because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${DISABLE_APPIMAGE}" == "yes" ]]; then
-            export SHOULD_BUILD_APPIMAGE="no"
-          elif [[ -z $( contains "x86_64.AppImage" ) ]]; then
-            echo "Building on Linux x64 because we have no AppImage"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_APPIMAGE="no"
-          fi
-
-          if [[ -z $( contains "amd64.snap" ) ]]; then
-            echo "Building on Linux x64 because we have no SNAP"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_SNAP="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME_LC}-cli-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no CLI archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_CLI="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux x64 builds"
-          fi
-        fi
-      fi
     fi
 
     if [[ "${OS_NAME}" == "alpine" ]] || [[ "${OS_NAME}" == "linux" && "${CHECK_ALL}" == "yes" ]]; then
-
+      . ./build/alpine/check_tags.sh
-      if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
-        if [[ -z $( contains "${APP_NAME_LC}-reh-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Alpine ${VSCODE_ARCH} because we have no REH archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Alpine REH ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH="no"
-        fi
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-web-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Alpine ${VSCODE_ARCH} because we have no REH-web archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Alpine REH-web ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH_WEB="no"
-        fi
-      else
-
-        # alpine-arm64
-        if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine arm64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine arm64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-        fi
-
-        # alpine-x64
-        if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine x64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine x64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-        fi
-      fi
     fi
   fi
 else
   if [[ "${IS_SPEARHEAD}" == "yes" ]]; then
     export SHOULD_BUILD_SRC="yes"
   elif [[ "${OS_NAME}" == "linux" ]]; then
-    if [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
+    if [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
-      SHOULD_BUILD_DEB="no"
-      SHOULD_BUILD_RPM="no"
-      SHOULD_BUILD_TAR="no"
-      SHOULD_BUILD_CLI="no"
-    elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
       SHOULD_BUILD_DEB="no"
       SHOULD_BUILD_RPM="no"
       SHOULD_BUILD_CLI="no"

dev/patch.sh

@@ -30,6 +30,7 @@ normalize_file "${1}"
 if [[ "${FILE}" != "../patches/helper/settings.patch" ]]; then
   git apply --reject "../patches/helper/settings.patch"
 
+  if [[ $# -gt 1 ]]; then
     while [ $# -gt 1 ]; do
       echo "Parameter: $1"
       normalize_file "${1}"
@@ -43,6 +44,49 @@ if [[ "${FILE}" != "../patches/helper/settings.patch" ]]; then
     git commit --no-verify -q -m "VSCODIUM HELPER"
 
     normalize_file "${1}"
+  else
+    normalize_file "${1}"
+
+    BASENAME=$(basename "${FILE}")
+    DIRNAME=$(dirname "${FILE}")
+
+    if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+      GROUP_ID="${BASH_REMATCH[1]}"
+      INDEX="${BASH_REMATCH[2]}"
+      ENDNAME="${BASH_REMATCH[3]}"
+
+      for ((I = 0; I < INDEX; I++)); do
+        NOT_FOUND=1
+
+        for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+          if [[ -f "$CANDIDATE" ]]; then
+            echo "Candidate: ${CANDIDATE}"
+            normalize_file "${CANDIDATE}"
+
+            git apply --reject "${FILE}"
+
+            NOT_FOUND=0
+          fi
+        done
+
+        if (( $NOT_FOUND )); then
+          for CANDIDATE in "${DIRNAME}/../${GROUP_ID}${I}-"*.patch; do
+            if [[ -f "$CANDIDATE" ]]; then
+              echo "Candidate: ${CANDIDATE}"
+              normalize_file "${CANDIDATE}"
+
+              git apply --reject "${FILE}"
+            fi
+          done
+        fi
+      done
+    fi
+
+    git add .
+    git commit --no-verify -q -m "VSCODIUM HELPER"
+
+    normalize_file "${1}"
+  fi
 fi
 
 echo "FILE: ${FILE}"

dev/update_patches.sh

@@ -119,6 +119,7 @@ check_file() {
       fi
 
       while [[ -n "$( find . -name '*.rej' -print )" ]]; do
+        echo "patch: ${1}"
         find . -name '*.rej' -print
         read -rp "Press any key when the conflict have been resolved..." -n1 -s
         echo
@@ -144,8 +145,26 @@ while [[ -n "$( git log -1 | grep "VSCODIUM HELPER" )" ]]; do
 done
 
 for FILE in ../patches/*.patch; do
-  if [[ "${FILE}" == *"/fix-policies.patch" ]]; then
+  ADDITIONAL_FILES=()
-    check_file "../patches/fix-keymap.patch" "../patches/fix-policies.patch"
+  BASENAME=$(basename "${FILE}")
+  DIRNAME=$(dirname "${FILE}")
+
+  if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+    GROUP_ID="${BASH_REMATCH[1]}"
+    INDEX="${BASH_REMATCH[2]}"
+    ENDNAME="${BASH_REMATCH[3]}"
+
+    for ((I = 0; I < INDEX; I++)); do
+      for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+        if [[ -f "$CANDIDATE" ]]; then
+          ADDITIONAL_FILES+=("$CANDIDATE")
+        fi
+      done
+    done
+  fi
+
+  if [[ ${#ADDITIONAL_FILES[@]} -gt 0 ]]; then
+    check_file ${ADDITIONAL_FILES[@]} "${FILE}"
   else
     check_file "${FILE}"
   fi
@@ -159,25 +178,44 @@ fi
 
 for ARCH in alpine linux osx windows; do
   for FILE in "../patches/${ARCH}/"*.patch; do
-    if [[ "${ARCH}" == "linux" && "${FILE}" == *"/arch-"* ]] || [[ "${ARCH}" == "linux" && "${FILE}" == *"/fix-dependencies.patch" ]] || [[ "${ARCH}" == "windows" && "${FILE}" == *"/cli"* ]]; then
+    ADDITIONAL_FILES=()
-      echo "skip ${FILE}"
+    BASENAME=$(basename "${FILE}")
+    DIRNAME=$(dirname "${FILE}")
+
+    if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+      GROUP_ID="${BASH_REMATCH[1]}"
+      INDEX="${BASH_REMATCH[2]}"
+      ENDNAME="${BASH_REMATCH[3]}"
+
+      for ((I = 0; I < INDEX; I++)); do
+        NOT_FOUND=1
+
+        for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+          if [[ -f "$CANDIDATE" ]]; then
+            ADDITIONAL_FILES+=("$CANDIDATE")
+            NOT_FOUND=0
+          fi
+        done
+
+        if (( $NOT_FOUND )); then
+          for CANDIDATE in "${DIRNAME}/../${GROUP_ID}${I}-"*.patch; do
+            if [[ -f "$CANDIDATE" ]]; then
+              ADDITIONAL_FILES+=("$CANDIDATE")
+            fi
+          done
+        fi
+      done
+
+      if [[ ${#ADDITIONAL_FILES[@]} -gt 0 ]]; then
+        check_file ${ADDITIONAL_FILES[@]} "${FILE}"
+      else
+        check_file "${FILE}"
+      fi
     else
       check_file "${FILE}"
     fi
   done
 
-  if [[ "${ARCH}" == "linux" ]]; then
-    check_file "../patches/optional-tree-sitter.patch" "../patches/linux/fix-dependencies.patch"
-
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch" "../patches/linux/arch-3-loong64.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch" "../patches/linux/arch-3-loong64.patch" "../patches/linux/arch-4-s390x.patch"
-  elif [[ "${ARCH}" == "windows" ]]; then
-    check_file "../patches/cli.patch" "../patches/windows/cli.patch"
-  fi
-
   for TARGET in client reh; do
     for FILE in "../patches/${ARCH}/${TARGET}/"*.patch; do
       check_file "${FILE}"

docs/extensions-compatibility.md

@@ -12,11 +12,11 @@
 
 ## <a id="incompatibility"></a>Incompatibility
 
-Most MS extensions are limited to run on only MS products by their license and by running additional checks in their proprietary code.
+Most Microsoft extensions are limited to run on only MS products by their license and by running additional checks in their proprietary code.
 
+Extensions incompatible with VSCodium **include**:
 - [C/C++](https://marketplace.visualstudio.com/items?itemName=ms-vscode.cpptools)
-- [LaTeX Workshop](https://marketplace.visualstudio.com/items?itemName=James-Yu.latex-workshop)
+- [LaTeX Workshop](https://marketplace.visualstudio.com/items?itemName=James-Yu.latex-workshop) (explicitly unsupported, as [indicated in the FAQ](https://github.com/James-Yu/LaTeX-Workshop/wiki/FAQ#vscodium-is-not-officially-supported))
-> It's officially unsupported: https://github.com/James-Yu/LaTeX-Workshop/wiki/FAQ#vscodium-is-not-officially-supported
 - [Live Share](https://marketplace.visualstudio.com/items?itemName=MS-vsliveshare.vsliveshare)
 - [Python](https://marketplace.visualstudio.com/items?itemName=ms-python.python)
 - [Remote - Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
@@ -40,6 +40,5 @@ The following extensions are functional replacements for incompatible extensions
 
 ### <a id="remote"></a>Remote Development
 
-- [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh)
+- [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh) (SSH server must be configured with the setting `AllowTcpForwarding yes`.)
-> SSH server must be configured with the setting `AllowTcpForwarding yes`.
 - [Open Remote - WSL](https://open-vsx.org/extension/jeanp413/open-remote-wsl)

docs/extensions.md

@@ -28,7 +28,7 @@ By default, the `product.json` file is set up to use [open-vsx.org](https://open
 ## <a id="howto-openvsx-marketplace"></a>How to use the Open VSX Registry
 
 As noted above, the [Open VSX Registry](https://open-vsx.org/) is the pre-set extension gallery in VSCodium. Using the extension view in VSCodium will therefore by default use it.
-See [this article](https://www.gitpod.io/blog/open-vsx/) for more information on the motivation behind Open VSX.
+See [this article](https://web.archive.org/web/20200423131829/https://www.gitpod.io/blog/open-vsx/) for more information on the motivation behind Open VSX.
 
 ## <a id="howto-switch-marketplace"></a>How to use a different extension gallery
 

docs/howto-build.md

@@ -46,11 +46,74 @@ see [the common dependencies](#dependencies)
 
 ### <a id="dependencies-windows"></a>Windows
 
-- powershell
+The build scripts are written in Bash, so on Windows you must run them inside **Git Bash** (bundled with [Git for Windows](https://gitforwindows.org/)) or **WSL2**.
-- sed
+
-- 7z
+#### Required tools
-- [WiX Toolset](http://wixtoolset.org/releases/)
+
-- 'Tools for Native Modules' from the official Node.js installer
+- **Git for Windows** — provides Git Bash, `sed`, and POSIX utilities used by the build scripts:
+
+  ```cmd
+  winget install --id Git.Git -e
+  ```
+
+- **Node.js** — exact version is specified in [`.nvmrc`](../.nvmrc). Use [nvm-windows](https://github.com/coreybutler/nvm-windows) to manage versions:
+
+  ```cmd
+  nvm install <version-from-.nvmrc>
+  nvm use <version-from-.nvmrc>
+  ```
+
+  Alternatively, download directly from [nodejs.org](https://nodejs.org/). During installation, enable **"Automatically install the necessary tools"** to get the C++ build tools (required for native Node addons).
+
+- **jq** — JSON processor used throughout the build scripts:
+
+  ```cmd
+  winget install --id jqlang.jq -e
+  ```
+
+- **7-Zip** — used to package `.zip` archives:
+
+  ```cmd
+  winget install --id 7zip.7zip -e
+  ```
+
+- **Python 3.11** — required by the VS Code build system:
+
+  ```cmd
+  winget install --id Python.Python.3.11 -e
+  ```
+
+  Ensure `python` / `python3` is on your `PATH` after installation.
+
+- **Rustup** — required to compile some native VS Code modules:
+
+  ```cmd
+  winget install --id Rustlang.Rustup -e
+  ```
+
+  Restart your shell afterwards so `cargo` and `rustc` are on your `PATH`.
+
+#### Optional tools
+
+- **WiX Toolset v3** _(only needed for `.msi` installer packaging, i.e., the `-p` flag)_:
+
+  Download from [wixtoolset.org](https://wixtoolset.org/releases/) and ensure `candle.exe` / `light.exe` are on your `PATH`.
+
+#### PATH verification
+
+After installing all tools, verify each is discoverable from Git Bash:
+
+```bash
+node --version    # should match .nvmrc
+npm --version
+jq --version
+python3 --version # should be 3.11.x
+cargo --version
+7z i 2>&1 | head -1
+git --version
+```
+
+If any command is not found, add its install directory to your `PATH` via **System Properties → Environment Variables → Path**.
 
 ## <a id="build-dev"></a>Build for Development
 
@@ -58,7 +121,10 @@ A build helper script can be found at `dev/build.sh`.
 
 - Linux: `./dev/build.sh`
 - MacOS: `./dev/build.sh`
-- Windows: `powershell -ExecutionPolicy ByPass -File .\dev\build.ps1` or `"C:\Program Files\Git\bin\bash.exe" ./dev/build.sh`
+- Windows (Git Bash — **recommended**): `"C:\Program Files\Git\bin\bash.exe" ./dev/build.sh`
+- Windows (PowerShell): `powershell -ExecutionPolicy ByPass -File .\dev\build.ps1`
+
+> **Note for Windows users**: Git Bash is the recommended shell because the build scripts rely on POSIX utilities (`sed`, `grep`, `find`, etc.) bundled with Git for Windows. If you use WSL2, follow the Linux dependencies section instead.
 
 ### Insider
 
@@ -95,6 +161,7 @@ export RELEASE_VERSION="${version}"
 ```
 
 To go further, you should look at how we build it:
+
 - Linux: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-linux.yml
 - macOS: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-macos.yml
 - Windows: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-windows.yml

docs/patches.md

@@ -0,0 +1,43 @@
+# Patches
+
+Documentation for VSCodium patches applied on top of VS Code.
+
+---
+
+## fix-policies
+
+**Replace `@vscode/policy-watcher` with `@vscodium/policy-watcher`**
+
+VS Code uses `@vscode/policy-watcher` to enforce Group Policy Objects (GPOs) on
+Windows. That package reads from:
+
+```
+HKLM\SOFTWARE\Policies\Microsoft\<productName>
+```
+
+VSCodium forks this into `@vscodium/policy-watcher`, which takes a separate
+`vendorName` argument. The `createWatcher()` call becomes:
+
+```ts
+createWatcher('VSCodium', this.productName, ...)
+```
+
+Because VSCodium sets `product.nameLong = 'VSCodium'` (via `prepare_vscode.sh`),
+`this.productName` resolves to `'VSCodium'` at runtime. Therefore, the final
+Windows registry key that VSCodium reads policies from is:
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>
+```
+
+(or `HKCU\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>` for per-user policies)
+
+This differs from VS Code's path (`Microsoft\VSCode`) and is the root cause of
+[issue #2714](https://github.com/VSCodium/vscodium/issues/2714) where users mirror
+VS Code's registry structure and find their GPOs ignored. Enterprise admins must
+use the VSCodium-specific registry path.
+
+### References
+
+- [VSCodium issue #2714](https://github.com/VSCodium/vscodium/issues/2714)
+- [VSCodium/policy-watcher — RegistryPolicy.hh](https://github.com/VSCodium/policy-watcher/blob/main/src/windows/RegistryPolicy.hh)

docs/telemetry.md

@@ -17,6 +17,7 @@ This page explains how VSCodium handles telemetry and how it enhances your priva
 Even though we do not pass the telemetry build flags and go out of our way to cripple the baked-in telemetry, Microsoft still can track usage by default depending on your settings.
 
 We disable all the following telemetry-related settings by default to enhance your privacy:
+
 ```
 telemetry.telemetryLevel
 telemetry.enableCrashReporter
@@ -26,28 +27,33 @@ workbench.enableExperiments
 workbench.settings.enableNaturalLanguageSearch
 workbench.commandPalette.experimental.enableNaturalLanguageSearch
 ```
+
 It is also recommended that you review all the settings that "use online services" by following [these instructions](https://code.visualstudio.com/docs/getstarted/telemetry#_managing-online-services). You can use the search filter `@tag:usesOnlineServices` to show such settings and review what to change.
 
-__Please note that some extensions send telemetry data to Microsoft as well. We have no control over this and can only recommend removing the extension.__  
+**Please note that some extensions send telemetry data to Microsoft as well. We have no control over this and can only recommend removing the extension.**  
 For example, the C# extension `ms-vscode.csharp` sends tracking data to Microsoft. Be sure to check each extension's settings page to disable their telemetry if applicable.
 
 ### Update services
+
 By default, the app periodically fetches connections to check for the latest version available to download and install.  
 Extensions are also checked for updates automatically from time to time.
 
 If you want to prevent such behaviors, modify the following preferences:
 
 For the app itself:
+
 - `update.mode` -> `manual` (or `none`)
 - `update.enableWindowsBackgroundUpdates` -> `false` (only applicable for Microsoft Windows)
 
 For extensions:
+
 - `extensions.autoUpdate` -> `false`
 - `extensions.autoCheckUpdates` -> `false`
 
-*Note: on Linux, the app update service is disabled completely at build-time even if the `update.mode` preference is configured. This is because users will more likely use their package managers to update the app rather than updating via the app itself.*
+_Note: on Linux, the app update service is disabled completely at build-time even if the `update.mode` preference is configured. This is because users will more likely use their package managers to update the app rather than updating via the app itself._
 
 ### Feedback telemetry
+
 By default, we keep the preference `telemetry.feedback.enabled` enabled. It's used to allow the button `Report Issue...` to be used on the app depending on the context. It does not send any data by having it enabled (other options already cover it). If you want, you can disable this behavior by toggling the preference value.
 
 ## <a id="replacements"></a>Replacements to Microsoft Online Services
@@ -66,7 +72,7 @@ If you want to verify that no telemetry is being sent, you can use network monit
 
 Look for connections to Microsoft domains and telemetry endpoints.
 
-## <a id="announcements"></a>VSCodium anouncements
+## <a id="announcements"></a>VSCodium announcements
 
 The welcome page in VSCodium displays announcements that are fetched via the internet from the project's GitHub repository.
 

docs/troubleshooting.md

@@ -11,10 +11,14 @@
   - [Flatpak most common issues](#linux-flatpak-most-common-issues)
   - [Remote SSH doesn't work](#linux-remote-ssh)
   - [The window doesn't show up](#linux-no-window)
+- [Windows](#windows)
+  - [Group Policy Objects (GPOs) are ignored](#windows-gpo)
+  - ["Open with VSCodium" missing from context menu](#windows-context-menu)
+  - [Windows Defender flags the installer as malware](#windows-defender)
 
 ## <a id="linux"></a>Linux
 
-### <a id="linux-fonts-rectangle"></a>*Fonts showing up as rectangles*
+### <a id="linux-fonts-rectangle"></a>_Fonts showing up as rectangles_
 
 The following command should help:
 
@@ -24,7 +28,7 @@ rm -rf ~/snap/codium/common/.cache
 fc-cache -r
 ```
 
-### <a id="linux-rendering-glitches"></a>*Text and/or the entire interface not appearing*
+### <a id="linux-rendering-glitches"></a>_Text and/or the entire interface not appearing_
 
 You have likely encountered [a bug in Chromium and Electron](microsoft/vscode#190437) when compiling Mesa shaders, which has affected all Visual Studio Code and VSCodium versions for Linux distributions since 1.82. The current workaround (see microsoft/vscode#190437) is to delete the GPU cache as follows:
 
@@ -32,19 +36,19 @@ You have likely encountered [a bug in Chromium and Electron](microsoft/vscode#19
 rm -rf ~/.config/VSCodium/GPUCache
 ```
 
-### <a id="linux-kde-global-menu"></a>*Global menu workaround for KDE*
+### <a id="linux-kde-global-menu"></a>_Global menu workaround for KDE_
 
 Install these packages on Fedora:
 
-* libdbusmenu-devel
+- libdbusmenu-devel
-* dbus-glib-devel
+- dbus-glib-devel
-* libdbusmenu
+- libdbusmenu
 
 On Ubuntu this package is called `libdbusmenu-glib4`.
 
 Credits: [Gerson](https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/91)
 
-### <a id="linux-flatpak-most-common-issues"></a>*Flatpak most common issues*
+### <a id="linux-flatpak-most-common-issues"></a>_Flatpak most common issues_
 
 - blurry screen with HiDPI on wayland run:
   ```bash
@@ -64,7 +68,7 @@ Credits: [Gerson](https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/
 
 - If you have any other problems with the flatpak package try to look on the [FAQ](https://github.com/flathub/com.vscodium.codium?tab=readme-ov-file#faq) maybe the solution is already there or open an [issue](https://github.com/flathub/com.vscodium.codium/issues).
 
-### <a id="linux-remote-ssh"></a>*Remote SSH doesn't work*
+### <a id="linux-remote-ssh"></a>_Remote SSH doesn't work_
 
 Use the VSCodium's compatible extension [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh).
 
@@ -72,9 +76,79 @@ On the server, in the `sshd` config, `AllowTcpForwarding` need to be set to `yes
 
 It might requires additional dependencies due to the OS/distro (alpine).
 
-### <a id="linux-no-window"></a>*The window doesn't show up*
+### <a id="linux-no-window"></a>_The window doesn't show up_
 
 If you are under Wayland:
+
 - try the command `codium --verbose`
 - if you see an error like `:ERROR:ui/gl/egl_util.cc:92] EGL Driver message (Error) eglCreateContext: Requested version is not supported`
 - try `codium --ozone-platform=x11`
+
+## <a id="windows"></a>Windows
+
+### <a id="windows-gpo"></a>_Group Policy Objects (GPOs) are ignored_
+
+VSCodium uses its own policy-watcher library (`@vscodium/policy-watcher`) which reads GPO values from a **different registry path** than VS Code.
+
+**VSCodium reads policies from:**
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium
+```
+
+**VS Code reads policies from:**
+
+```
+HKLM\SOFTWARE\Policies\Microsoft\VSCode
+```
+
+If you are deploying VSCodium in an enterprise environment via Group Policy:
+
+1. Copy the `.admx` template file to `C:\Windows\PolicyDefinitions\`
+2. Copy the `.adml` language file to `C:\Windows\PolicyDefinitions\en-US\`
+3. Open `gpedit.msc` and configure policies under the VSCodium group
+4. Verify the resulting registry key exists at `HKLM\SOFTWARE\Policies\VSCodium\VSCodium` (not `Microsoft\VSCodium`)
+
+If you set policies manually via Registry Editor, make sure you create the key at the correct path:
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>  (REG_SZ or REG_DWORD)
+```
+
+For example, to set `Update: Mode` to `none`:
+
+```
+Registry key: HKLM\SOFTWARE\Policies\VSCodium\VSCodium
+Value name:   update.mode
+Value type:   REG_SZ
+Value data:   none
+```
+
+Per-user policies are also supported under `HKCU\SOFTWARE\Policies\VSCodium\VSCodium` (machine policies take precedence).
+
+### <a id="windows-context-menu"></a>_"Open with VSCodium" missing from context menu_
+
+If the **"Open with VSCodium"** option does not appear after installation (even with the checkbox checked during setup):
+
+1. **Run the installer again** and ensure _"Add 'Open with VSCodium' action to Windows Explorer file context menu"_ is checked.
+2. **Windows 11 note**: Windows 11 hides most context menu entries behind **Shift + Right-click** ("Show more options"). VSCodium's entry may be present but hidden in the new condensed menu. Try Shift + Right-click to see the classic context menu.
+3. If the entry still does not appear, you can add it manually via Registry Editor:
+
+   ```
+   Key:   HKEY_CLASSES_ROOT\*\shell\Open with VSCodium
+   Value: (Default) = "Open with VSCodium"
+
+   Key:   HKEY_CLASSES_ROOT\*\shell\Open with VSCodium\command
+   Value: (Default) = "C:\Program Files\VSCodium\VSCodium.exe" "%1"
+   ```
+
+   Adjust the install path to match your actual installation directory.
+
+### <a id="windows-defender"></a>_Windows Defender flags the installer as malware_
+
+Some users report Windows Defender detecting the VSCodium installer as `Cinjo` or another threat. This is a **false positive** caused by the unsigned nature of certain build artifacts.
+
+- Download VSCodium **only from the official [GitHub Releases page](https://github.com/VSCodium/vscodium/releases)**.
+- Verify the SHA256/SHA512 checksum of the downloaded file against the `.sha256` or `.sha512` file published alongside each release.
+- If Defender blocks the installer, add an exclusion for the downloaded file, run the install, then remove the exclusion.
+- You can also report the false positive directly to Microsoft via the [Windows Defender Security Intelligence submission portal](https://www.microsoft.com/en-us/wdsi/filesubmission).

font-size/.artifactrc.yml

@@ -1,7 +1,8 @@
+$schema: https://raw.githubusercontent.com/zokugun/artifact/v0.6.0/schemas/v1/install.json
 artifacts:
   "@daiyam/artifact-lang-js":
-    version: 0.9.3
+    version: 0.11.3
     requires:
       - "22"
   "@daiyam/artifact-lang-ts":
-    version: 0.6.3
+    version: 0.8.0

font-size/.editorconfig

@@ -15,3 +15,8 @@ indent_size = 2
 [*.md]
 indent_style = space
 indent_size = 4
+
+[*.patch]
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = false

font-size/.fixpackrc

@@ -1,9 +1,14 @@
 {
+	"finalNewLine": true,
+	"required": [
+		"dependencies"
+	],
 	"sortToTop": [
 		"name",
 		"displayName",
 		"description",
 		"version",
+		"since",
 		"private",
 		"author",
 		"publisher",
@@ -23,7 +28,8 @@
 		"dependencies",
 		"devDependencies",
 		"optionalDependencies",
+		"peerDependencies",
+		"overrides",
 		"keywords"
-	],
+	]
-	"finalNewLine": true
 }

font-size/.nvmrc

@@ -1 +1 @@
-v22.21.1
+v22.22.2

font-size/.tazerc.json

@@ -0,0 +1,6 @@
+{
+	"force": true,
+	"includeLocked": true,
+	"maturityPeriod": 7,
+	"write": true
+}

font-size/.xo-config.json

@@ -48,8 +48,14 @@
 			"error",
 			{
 				"selector": "variable",
-				"modifiers": ["const", "global"],
+				"modifiers": [
-				"format": ["camelCase", "UPPER_CASE"],
+					"const",
+					"global"
+				],
+				"format": [
+					"camelCase",
+					"UPPER_CASE"
+				],
 				"filter": {
 					"regex": "^(__filename|__dirname)$",
 					"match": false
@@ -57,7 +63,9 @@
 			},
 			{
 				"selector": "variable",
-				"format": ["camelCase"],
+				"format": [
+					"camelCase"
+				],
 				"filter": {
 					"regex": "^(__filename|__dirname)$",
 					"match": false
@@ -66,6 +74,14 @@
 		],
 		"@typescript-eslint/no-confusing-void-expression": "off",
 		"@typescript-eslint/no-dynamic-delete": "off",
+		"@typescript-eslint/no-empty-function": [
+			"error",
+			{
+				"allow": [
+					"arrowFunctions"
+				]
+			}
+		],
 		"@typescript-eslint/no-inferrable-types": "off",
 		"@typescript-eslint/no-namespace": "off",
 		"@typescript-eslint/object-curly-spacing": [
@@ -117,6 +133,7 @@
 		"no-lonely-if": "off",
 		"no-negated-condition": "off",
 		"object-curly-newline": "off",
+		"object-shorthand": "off",
 		"one-var": [
 			"error",
 			"never"

font-size/package-lock.json

@@ -9,17 +9,45 @@
 			"version": "1.0.0",
 			"license": "MIT",
 			"dependencies": {
-				"@zokugun/fs-extra-plus": "^0.3.3",
+				"@zokugun/fs-extra-plus": "0.3.8",
-				"@zokugun/xtry": "^0.10.1",
+				"@zokugun/xtry": "0.10.1",
-				"fast-glob": "^3.3.3",
+				"fast-glob": "3.3.3",
-				"postcss": "^8.5.6"
+				"postcss": "8.5.10"
 			},
 			"devDependencies": {
-				"@types/node": "^22.9.0",
+				"@types/node": "22.19.17",
-				"fixpack": "^4.0.0",
+				"fixpack": "4.0.0",
+				"taze": "19.11.0",
+				"typescript": "5.9.3",
 				"xo": "0.60.0"
 			}
 		},
+		"node_modules/@antfu/ni": {
+			"version": "30.1.0",
+			"resolved": "https://registry.npmjs.org/@antfu/ni/-/ni-30.1.0.tgz",
+			"integrity": "sha512-3VuAbPjgY52rQNn4wABaXMhBU2Oq91uy6L8nX49eJ35OLI68CyckGU+HZxcaHix4ymuGM2nFL1D6sLpgODK5xw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"fzf": "^0.5.2",
+				"package-manager-detector": "^1.6.0",
+				"tinyexec": "^1.0.4",
+				"tinyglobby": "^0.2.15"
+			},
+			"bin": {
+				"na": "bin/na.mjs",
+				"nci": "bin/nci.mjs",
+				"nd": "bin/nd.mjs",
+				"ni": "bin/ni.mjs",
+				"nlx": "bin/nlx.mjs",
+				"nr": "bin/nr.mjs",
+				"nun": "bin/nun.mjs",
+				"nup": "bin/nup.mjs"
+			},
+			"engines": {
+				"node": ">=20.19.0"
+			}
+		},
 		"node_modules/@babel/code-frame": {
 			"version": "7.29.0",
 			"resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
@@ -145,6 +173,13 @@
 				"node": "^12.22.0 || ^14.17.0 || >=16.0.0"
 			}
 		},
+		"node_modules/@henrygd/queue": {
+			"version": "1.2.0",
+			"resolved": "https://registry.npmjs.org/@henrygd/queue/-/queue-1.2.0.tgz",
+			"integrity": "sha512-jW/BLSTpcvExDhqJGxtIPgGr2O0IFF8XUNDwEbfCfhrXT8a4xztQ9Lv6U/vbYzYC0xVWn+3zv6YnLUh3bEFUKA==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/@humanwhocodes/config-array": {
 			"version": "0.13.0",
 			"resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.13.0.tgz",
@@ -286,6 +321,19 @@
 				"url": "https://opencollective.com/pkgr"
 			}
 		},
+		"node_modules/@quansync/fs": {
+			"version": "1.0.0",
+			"resolved": "https://registry.npmjs.org/@quansync/fs/-/fs-1.0.0.tgz",
+			"integrity": "sha512-4TJ3DFtlf1L5LDMaM6CanJ/0lckGNtJcMjQ1NAV6zDmA0tEHKZtxNKin8EgPaVX1YzljbxckyT2tJrpQKAtngQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"quansync": "^1.0.0"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/sxzz"
+			}
+		},
 		"node_modules/@rtsao/scc": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/@rtsao/scc/-/scc-1.1.0.tgz",
@@ -358,9 +406,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@types/node": {
-			"version": "22.19.11",
+			"version": "22.19.17",
-			"resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.11.tgz",
+			"resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.17.tgz",
-			"integrity": "sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w==",
+			"integrity": "sha512-wGdMcf+vPYM6jikpS/qhg6WiqSV/OhG+jeeHT/KlVqxYfD40iYJf9/AE1uQxVWFvU7MipKRkRv8NSHiCGgPr8Q==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -527,9 +575,9 @@
 			}
 		},
 		"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-			"version": "2.0.2",
+			"version": "2.1.0",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-			"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+			"integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -824,22 +872,28 @@
 			"peer": true
 		},
 		"node_modules/@zokugun/fs-extra-plus": {
-			"version": "0.3.3",
+			"version": "0.3.8",
-			"resolved": "https://registry.npmjs.org/@zokugun/fs-extra-plus/-/fs-extra-plus-0.3.3.tgz",
+			"resolved": "https://registry.npmjs.org/@zokugun/fs-extra-plus/-/fs-extra-plus-0.3.8.tgz",
-			"integrity": "sha512-GzLdcuSttjzcWL3dkdoxKPm9MZVVOVv5q2tWjCn4KUlIu27FBTx3pyvZMmpJf8u6ZNw0bqafWVYYppBiFqJ23g==",
+			"integrity": "sha512-EijO0TJdupzTQN8a2ZsoWZNG7PuuKsyuYwr0XJDpgfWCVofuabxLSJPRiT5uzdTrTpsyEC4tk4RTXp9A5ZPeXg==",
 			"license": "MIT",
 			"dependencies": {
-				"@zokugun/is-it-type": "^0.5.2",
+				"@zokugun/is-it-type": "0.7.0",
-				"@zokugun/xtry": "^0.10.1"
+				"@zokugun/xtry": "0.11.4"
 			},
 			"optionalDependencies": {
 				"mime-types": "*"
 			}
 		},
+		"node_modules/@zokugun/fs-extra-plus/node_modules/@zokugun/xtry": {
+			"version": "0.11.4",
+			"resolved": "https://registry.npmjs.org/@zokugun/xtry/-/xtry-0.11.4.tgz",
+			"integrity": "sha512-Skkb/roP7cLWOo2uei66C63B39FeGqaaR/HU68at46X6ObTvYVMvvqEDr2AhmETVQF74wIOxSTMY6NPPhOCzEA==",
+			"license": "MIT"
+		},
 		"node_modules/@zokugun/is-it-type": {
-			"version": "0.5.2",
+			"version": "0.7.0",
-			"resolved": "https://registry.npmjs.org/@zokugun/is-it-type/-/is-it-type-0.5.2.tgz",
+			"resolved": "https://registry.npmjs.org/@zokugun/is-it-type/-/is-it-type-0.7.0.tgz",
-			"integrity": "sha512-Gj6H+nvhwJt4Q5UeIntwRQY4/JTs9ZVaJ/Ac2na3LUdN//dgSyH4gZrXzGqzDu31ZyaEySppvF+frN7L2Rg7Pg==",
+			"integrity": "sha512-6r7JJKo9+KkLw4aOIFkAAI5ZpcRXlGPogjENwbzqPOk37WREUKLpBTfxMxmS/dCBELAvyvBWrOatm0clEsHjdA==",
 			"license": "MIT"
 		},
 		"node_modules/@zokugun/xtry": {
@@ -1162,9 +1216,9 @@
 			}
 		},
 		"node_modules/brace-expansion": {
-			"version": "1.1.12",
+			"version": "1.1.14",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -1255,6 +1309,16 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/cac": {
+			"version": "7.0.0",
+			"resolved": "https://registry.npmjs.org/cac/-/cac-7.0.0.tgz",
+			"integrity": "sha512-tixWYgm5ZoOD+3g6UTea91eow5z6AAHaho3g0V9CNSNb45gM8SmflpAc+GRd1InC4AqN/07Unrgp56Y94N9hJQ==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=20.19.0"
+			}
+		},
 		"node_modules/call-bind": {
 			"version": "1.0.8",
 			"resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
@@ -1664,6 +1728,20 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
+		"node_modules/defu": {
+			"version": "6.1.7",
+			"resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+			"integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/destr": {
+			"version": "2.0.5",
+			"resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz",
+			"integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/detect-indent": {
 			"version": "6.1.0",
 			"resolved": "https://registry.npmjs.org/detect-indent/-/detect-indent-6.1.0.tgz",
@@ -3480,6 +3558,13 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
+		"node_modules/fzf": {
+			"version": "0.5.2",
+			"resolved": "https://registry.npmjs.org/fzf/-/fzf-0.5.2.tgz",
+			"integrity": "sha512-Tt4kuxLXFKHy8KT40zwsUPUkg1CrsgY25FxA2U/j/0WgEDCk3ddc/zLTCCcbSHX9FcKtLuVaDGtGE/STWC+j3Q==",
+			"dev": true,
+			"license": "BSD-3-Clause"
+		},
 		"node_modules/generator-function": {
 			"version": "2.0.1",
 			"resolved": "https://registry.npmjs.org/generator-function/-/generator-function-2.0.1.tgz",
@@ -4671,6 +4756,16 @@
 				"url": "https://github.com/chalk/supports-color?sponsor=1"
 			}
 		},
+		"node_modules/jiti": {
+			"version": "2.6.1",
+			"resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
+			"integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
+			"dev": true,
+			"license": "MIT",
+			"bin": {
+				"jiti": "lib/jiti-cli.mjs"
+			}
+		},
 		"node_modules/js-tokens": {
 			"version": "4.0.0",
 			"resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
@@ -4835,16 +4930,16 @@
 			}
 		},
 		"node_modules/lodash": {
-			"version": "4.17.23",
+			"version": "4.18.1",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
 			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/lodash-es": {
-			"version": "4.17.23",
+			"version": "4.18.1",
-			"resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
+			"resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
-			"integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+			"integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
 			"dev": true,
 			"license": "MIT"
 		},
@@ -4959,6 +5054,19 @@
 				"node": ">= 0.6"
 			}
 		},
+		"node_modules/mimic-function": {
+			"version": "5.0.1",
+			"resolved": "https://registry.npmjs.org/mimic-function/-/mimic-function-5.0.1.tgz",
+			"integrity": "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/sindresorhus"
+			}
+		},
 		"node_modules/min-indent": {
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/min-indent/-/min-indent-1.0.1.tgz",
@@ -5061,6 +5169,13 @@
 				"semver": "bin/semver.js"
 			}
 		},
+		"node_modules/node-fetch-native": {
+			"version": "1.6.7",
+			"resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
+			"integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/node-releases": {
 			"version": "2.0.27",
 			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
@@ -5278,6 +5393,18 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
+		"node_modules/ofetch": {
+			"version": "1.5.1",
+			"resolved": "https://registry.npmjs.org/ofetch/-/ofetch-1.5.1.tgz",
+			"integrity": "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"destr": "^2.0.5",
+				"node-fetch-native": "^1.6.7",
+				"ufo": "^1.6.1"
+			}
+		},
 		"node_modules/once": {
 			"version": "1.4.0",
 			"resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
@@ -5288,6 +5415,22 @@
 				"wrappy": "1"
 			}
 		},
+		"node_modules/onetime": {
+			"version": "7.0.0",
+			"resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
+			"integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"mimic-function": "^5.0.0"
+			},
+			"engines": {
+				"node": ">=18"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/sindresorhus"
+			}
+		},
 		"node_modules/open": {
 			"version": "10.2.0",
 			"resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
@@ -5404,6 +5547,13 @@
 				"node": ">=6"
 			}
 		},
+		"node_modules/package-manager-detector": {
+			"version": "1.6.0",
+			"resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
+			"integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/parent-module": {
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -5499,6 +5649,13 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/pathe": {
+			"version": "2.0.3",
+			"resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+			"integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/picocolors": {
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -5506,9 +5663,9 @@
 			"license": "ISC"
 		},
 		"node_modules/picomatch": {
-			"version": "2.3.1",
+			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=8.6"
@@ -5644,6 +5801,26 @@
 				"node": ">=4"
 			}
 		},
+		"node_modules/pnpm-workspace-yaml": {
+			"version": "1.6.0",
+			"resolved": "https://registry.npmjs.org/pnpm-workspace-yaml/-/pnpm-workspace-yaml-1.6.0.tgz",
+			"integrity": "sha512-uUy4dK3E11sp7nK+hnT7uAWfkBMe00KaUw8OG3NuNlYQoTk4sc9pcdIy1+XIP85v9Tvr02mK3JPaNNrP0QyRaw==",
+			"dev": true,
+			"funding": [
+				{
+					"type": "individual",
+					"url": "https://github.com/sponsors/antfu"
+				},
+				{
+					"type": "individual",
+					"url": "https://github.com/sponsors/sxzz"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"yaml": "^2.8.2"
+			}
+		},
 		"node_modules/possible-typed-array-names": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
@@ -5655,9 +5832,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.6",
+			"version": "8.5.10",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
-			"integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+			"integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
 			"funding": [
 				{
 					"type": "opencollective",
@@ -5757,6 +5934,23 @@
 				"node": ">=6"
 			}
 		},
+		"node_modules/quansync": {
+			"version": "1.0.0",
+			"resolved": "https://registry.npmjs.org/quansync/-/quansync-1.0.0.tgz",
+			"integrity": "sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA==",
+			"dev": true,
+			"funding": [
+				{
+					"type": "individual",
+					"url": "https://github.com/sponsors/antfu"
+				},
+				{
+					"type": "individual",
+					"url": "https://github.com/sponsors/sxzz"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/queue-microtask": {
 			"version": "1.2.3",
 			"resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@@ -6051,6 +6245,23 @@
 				"url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
 			}
 		},
+		"node_modules/restore-cursor": {
+			"version": "5.1.0",
+			"resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
+			"integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"onetime": "^7.0.0",
+				"signal-exit": "^4.1.0"
+			},
+			"engines": {
+				"node": ">=18"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/sindresorhus"
+			}
+		},
 		"node_modules/reusify": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
@@ -6649,6 +6860,34 @@
 				"node": ">=0.6"
 			}
 		},
+		"node_modules/taze": {
+			"version": "19.11.0",
+			"resolved": "https://registry.npmjs.org/taze/-/taze-19.11.0.tgz",
+			"integrity": "sha512-BlfH8Z6JdoIsrUptnz4P4YuEqdYsa/bSNNDOMhTlsHZ7Bbg1/0NyYh6uPkoRREjrt/kVovV+HYdi1ilHxvChfw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@antfu/ni": "^30.0.0",
+				"@henrygd/queue": "^1.2.0",
+				"cac": "^7.0.0",
+				"find-up-simple": "^1.0.1",
+				"ofetch": "^1.5.1",
+				"package-manager-detector": "^1.6.0",
+				"pathe": "^2.0.3",
+				"pnpm-workspace-yaml": "^1.6.0",
+				"restore-cursor": "^5.1.0",
+				"tinyexec": "^1.0.4",
+				"tinyglobby": "^0.2.15",
+				"unconfig": "^7.5.0",
+				"yaml": "^2.8.3"
+			},
+			"bin": {
+				"taze": "bin/taze.mjs"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/antfu"
+			}
+		},
 		"node_modules/terser": {
 			"version": "5.46.0",
 			"resolved": "https://registry.npmjs.org/terser/-/terser-5.46.0.tgz",
@@ -6719,6 +6958,64 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/tinyexec": {
+			"version": "1.1.1",
+			"resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.1.1.tgz",
+			"integrity": "sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/tinyglobby": {
+			"version": "0.2.16",
+			"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
+			"integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"fdir": "^6.5.0",
+				"picomatch": "^4.0.4"
+			},
+			"engines": {
+				"node": ">=12.0.0"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/SuperchupuDev"
+			}
+		},
+		"node_modules/tinyglobby/node_modules/fdir": {
+			"version": "6.5.0",
+			"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+			"integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=12.0.0"
+			},
+			"peerDependencies": {
+				"picomatch": "^3 || ^4"
+			},
+			"peerDependenciesMeta": {
+				"picomatch": {
+					"optional": true
+				}
+			}
+		},
+		"node_modules/tinyglobby/node_modules/picomatch": {
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+			"integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=12"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/jonschlinkert"
+			}
+		},
 		"node_modules/to-absolute-glob": {
 			"version": "3.0.0",
 			"resolved": "https://registry.npmjs.org/to-absolute-glob/-/to-absolute-glob-3.0.0.tgz",
@@ -6782,9 +7079,9 @@
 			}
 		},
 		"node_modules/ts-declaration-location/node_modules/picomatch": {
-			"version": "4.0.3",
+			"version": "4.0.4",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-			"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+			"integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -6925,6 +7222,13 @@
 				"node": ">=14.17"
 			}
 		},
+		"node_modules/ufo": {
+			"version": "1.6.3",
+			"resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.3.tgz",
+			"integrity": "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/unbox-primitive": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz",
@@ -6954,6 +7258,37 @@
 				"node": ">=0.10.0"
 			}
 		},
+		"node_modules/unconfig": {
+			"version": "7.5.0",
+			"resolved": "https://registry.npmjs.org/unconfig/-/unconfig-7.5.0.tgz",
+			"integrity": "sha512-oi8Qy2JV4D3UQ0PsopR28CzdQ3S/5A1zwsUwp/rosSbfhJ5z7b90bIyTwi/F7hCLD4SGcZVjDzd4XoUQcEanvA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@quansync/fs": "^1.0.0",
+				"defu": "^6.1.4",
+				"jiti": "^2.6.1",
+				"quansync": "^1.0.0",
+				"unconfig-core": "7.5.0"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/antfu"
+			}
+		},
+		"node_modules/unconfig-core": {
+			"version": "7.5.0",
+			"resolved": "https://registry.npmjs.org/unconfig-core/-/unconfig-core-7.5.0.tgz",
+			"integrity": "sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@quansync/fs": "^1.0.0",
+				"quansync": "^1.0.0"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/antfu"
+			}
+		},
 		"node_modules/undici-types": {
 			"version": "6.21.0",
 			"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
@@ -7361,6 +7696,22 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/yaml": {
+			"version": "2.8.3",
+			"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+			"integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+			"dev": true,
+			"license": "ISC",
+			"bin": {
+				"yaml": "bin.mjs"
+			},
+			"engines": {
+				"node": ">= 14.6"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/eemeli"
+			}
+		},
 		"node_modules/yocto-queue": {
 			"version": "1.2.2",
 			"resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.2.tgz",

font-size/package.json

@@ -10,20 +10,27 @@
 	"type": "module",
 	"main": "generate-css.ts",
 	"scripts": {
-		"clean": "rimraf lib",
+		"audit:fix": "npm audit fix --min-release-age=0",
+		"ci:lint": "zizmor .",
+		"ci:lint:fix": "zizmor . --fix=all",
 		"lint": "xo",
+		"lint:all": "fixpack && npm audit && npm run ci:lint && npm run lint",
 		"lint:fix": "xo --fix",
-		"prepare": "fixpack || true"
+		"prepare": "fixpack || true",
+		"update:artifacts": "artifact update",
+		"update:deps": "taze"
 	},
 	"dependencies": {
-		"@zokugun/fs-extra-plus": "^0.3.3",
+		"@zokugun/fs-extra-plus": "0.3.8",
-		"@zokugun/xtry": "^0.10.1",
+		"@zokugun/xtry": "0.10.1",
-		"fast-glob": "^3.3.3",
+		"fast-glob": "3.3.3",
-		"postcss": "^8.5.6"
+		"postcss": "8.5.10"
 	},
 	"devDependencies": {
-		"@types/node": "^22.9.0",
+		"@types/node": "22.19.17",
-		"fixpack": "^4.0.0",
+		"fixpack": "4.0.0",
+		"taze": "19.11.0",
+		"typescript": "5.9.3",
 		"xo": "0.60.0"
 	},
 	"keywords": []

justfile

@@ -0,0 +1,10 @@
+set shell := ["bash", "-uc"]
+
+ci-lint:
+	zizmor .
+
+ci-lint-fix:
+  zizmor . --fix=all
+
+ci-update:
+	PINACT_MIN_AGE=7 pinact run --update

patches/00-build-disable-esbuild.patch

@@ -0,0 +1,8 @@
+diff --git a/build/buildConfig.ts b/build/buildConfig.ts
+index a4299d26..a815dd51 100644
+--- a/build/buildConfig.ts
++++ b/build/buildConfig.ts
+@@ -11,2 +11,2 @@
+  */
+-export const useEsbuildTranspile = true;
++export const useEsbuildTranspile = false;

patches/00-build-update-electron.patch.no

@@ -0,0 +1,203 @@
+diff --git a/.npmrc b/.npmrc
+index a275846..e31402c 100644
+--- a/.npmrc
++++ b/.npmrc
+@@ -1,3 +1,3 @@
+ disturl="https://electronjs.org/headers"
+-target="39.8.0"
++target="39.8.4"
+ ms_build_id="13470701"
+diff --git a/build/checksums/electron.txt b/build/checksums/electron.txt
+index 5d8343f..1fd0e54 100644
+--- a/build/checksums/electron.txt
++++ b/build/checksums/electron.txt
+@@ -1,75 +1,75 @@
+-d70954386008ad2c65d9849bb89955ab3c7dd08763256ae0d91d8604e8894d64 *chromedriver-v39.8.0-darwin-arm64.zip
+-2f6b654337133c13440aafdaf9e8b15f5ebb244e7d49f20977f03438e9bb8adb *chromedriver-v39.8.0-darwin-x64.zip
+-ef8681bb6b6af42cdf0e14c9ce188f035e01620781308c06cd3c6b922aaea2e6 *chromedriver-v39.8.0-linux-arm64.zip
+-c03fea6ac2b743d771407dc5f58809f44d2a885b1830b847957823cac2e7b222 *chromedriver-v39.8.0-linux-armv7l.zip
+-4bb7c6d9b3a7bfdd89edd0db98e63599ebf6dacdb888d5985bbb73f6153acc0c *chromedriver-v39.8.0-linux-x64.zip
+-aad1f6f970b5636d637c1c242766fbaa5bebe2707a605a38aadc7b40724b3d11 *chromedriver-v39.8.0-mas-arm64.zip
+-e89ebebe3a135d3ce40168152a0aabfd055b9fa6b118262a6df18405fd2ea433 *chromedriver-v39.8.0-mas-x64.zip
+-232e1a0460f6a59056499cccfff3265bf92eae22f20f02f2419e5e49552aaed7 *chromedriver-v39.8.0-win32-arm64.zip
+-ab92f46cc55da7c719175b50203c734781828389b8b3a1a535204bf0dc7d1296 *chromedriver-v39.8.0-win32-ia32.zip
+-a40eb521063e4ea6791ed4005815fa8ac259c1febc850246a83a47ce120121ce *chromedriver-v39.8.0-win32-x64.zip
+-d6a33b4c3c0de845ea23d1e2614c6c6d3bbe35b771bb63ae521c4db11373b021 *electron-api.json
+-5425323fdb23167870075e944ec6cf3ae383fbe45ad141d08b1d9689030ccd05 *electron-v39.8.0-darwin-arm64-dsym-snapshot.zip
+-aa32ab00ee58d8827cd53ca561b8c26b7cb7e2ad8cb0801acdda117ee728388e *electron-v39.8.0-darwin-arm64-dsym.zip
+-f94e589804a3394a4735543b888927be873f8f402899d0debe32a9dc570d6285 *electron-v39.8.0-darwin-arm64-symbols.zip
+-681d82c2ec6677ff0bf12f5bb1808b5a51dcbf10894bd0298641015119a3e04d *electron-v39.8.0-darwin-arm64.zip
+-a95e83b5cde762a37e64229e5669b0c19b95aac148689d96ca344535109eb983 *electron-v39.8.0-darwin-x64-dsym-snapshot.zip
+-8c989d8ca835ecdd93d49d9627f5548272c0ed03e263392b21ed287960b29e41 *electron-v39.8.0-darwin-x64-dsym.zip
+-b4b6fda9c5b9063a104318645aa29ef4738dd099da2b722e3e9b6dde5e098418 *electron-v39.8.0-darwin-x64-symbols.zip
+-ec53f2ba79498410323bb96a19ce98741bf28666cc9d83e07d11dadcc5506f38 *electron-v39.8.0-darwin-x64.zip
+-9141e64f9d4ea7f0e6a43ae364c8232a0dac79ecec44de2d4a0e5d688fbb742c *electron-v39.8.0-linux-arm64-debug.zip
+-5fac949d5331abaff0643dbcda7cc187e548cd4bf9d198c1ffc361383bfaa79f *electron-v39.8.0-linux-arm64-symbols.zip
+-c9db883fa671237fbc16256cf89aba55b9fcfbd9825fec32a6d57724a6446fe1 *electron-v39.8.0-linux-arm64.zip
+-b26ac10e84f6b7d338c13a38547aa66b5e9afbe2f1355b183ebc2ff8f428cfa9 *electron-v39.8.0-linux-armv7l-debug.zip
+-16c47c008a8783f6c8d6387fe01ea15425161befbf4211e4667bbdd6bb806ef0 *electron-v39.8.0-linux-armv7l-symbols.zip
+-b1b37fd450a5081a876c2b00b6ca007d454747a7d1d8f04feb16119d6ace94c6 *electron-v39.8.0-linux-armv7l.zip
+-1e8039cdf60b27785771c9e3f3c4c39fad37602bb0e6b75a30f83c57fdbef069 *electron-v39.8.0-linux-x64-debug.zip
+-ff9ca169c6e79649dd4c5a49a82a8d4b1761b62fbe14c15c61bf534381a9f653 *electron-v39.8.0-linux-x64-symbols.zip
+-854076cc4c63d6d6c320df1ca3f4bd7084ef9f9bb47c7b75d80feb2c2ed920b4 *electron-v39.8.0-linux-x64.zip
+-91bc313cbd009435552d8d5efff5d6ed0ff15465743c2629dac1cfe99ac34e4d *electron-v39.8.0-mas-arm64-dsym-snapshot.zip
+-974f10f80ec6c65f8d9f2ac1ccd8c4395bb34e24e2b09dc0ff80bd351099692e *electron-v39.8.0-mas-arm64-dsym.zip
+-b3878bc9198cff324b7c829ce2fbea7a4ee505f2f99b0bb3c11ac5e60651be59 *electron-v39.8.0-mas-arm64-symbols.zip
+-48dac99c757a850b0db7b38c1b95e08270f690a7ea1b58872e45308c2f7c8c93 *electron-v39.8.0-mas-arm64.zip
+-1a6e4df1092f89ed46833938d6dd1b3036640037bd09f0630a369ae386a7c872 *electron-v39.8.0-mas-x64-dsym-snapshot.zip
+-81425eb867527341af64c00726bd462957fec4d5f073922df891d830addbc5bc *electron-v39.8.0-mas-x64-dsym.zip
+-748ce154e894a27b117b46354cc288dc9442fade844c637b59fe1c1f3f7c625d *electron-v39.8.0-mas-x64-symbols.zip
+-91f8f7d4eb1a42ac4fa0eaa93034c8e6155ccb50718f9f55541ce2be4a4ed6d0 *electron-v39.8.0-mas-x64.zip
+-b775b7584afb84e52b0a770e1e63a2f17384b66eeebe845e0c5c82beacaf7e93 *electron-v39.8.0-win32-arm64-pdb.zip
+-ac62373d11ed682b4fcdae27de2bd72ebf7d46d3b569f5fcf242de01786d0948 *electron-v39.8.0-win32-arm64-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-arm64-toolchain-profile.zip
+-08b79fa5deabbcace447f1e15eb99b3b117b42a84b71ad5b0f52d2da68a34192 *electron-v39.8.0-win32-arm64.zip
+-f4fb798d76a0c2f80717ef1607571537dbbb07f1cc5f177048bcfd17046c2255 *electron-v39.8.0-win32-ia32-pdb.zip
+-37c1d2988793604294724b648589fca6459472021189abab1550d5e1eecff1a7 *electron-v39.8.0-win32-ia32-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-ia32-toolchain-profile.zip
+-59b70a12abedb550795614bc74c5803787e824da3529a631fdb5c2b5aad00196 *electron-v39.8.0-win32-ia32.zip
+-0357c6fb0d7198c45cba0e8c939473ea1d971e1efe801bc84e2c559141b368e7 *electron-v39.8.0-win32-x64-pdb.zip
+-8e6f4e8516d15aecde5244beac315067c13513c7074383086523eef2638a5e8d *electron-v39.8.0-win32-x64-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-x64-toolchain-profile.zip
+-9edc111b22aee1a0efb5103d6d3b48645af57b48214eeb48f75f9edfc3e271d6 *electron-v39.8.0-win32-x64.zip
+-b6eca0e05fcff2464382278dff52367f6f21eb1a580dd8a0a954fc16397ab085 *electron.d.ts
+-27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.0-darwin-arm64.zip
+-321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.0-darwin-x64.zip
+-52ae6eccbdb4a9403a6c3eb46b356a28940ec25958b6b9181fb2f38e612e40ed *ffmpeg-v39.8.0-linux-arm64.zip
+-622cb781fb1e3b9617e7e60c36384427f7b0d9b5ad888e9bc356a83b050e13f1 *ffmpeg-v39.8.0-linux-armv7l.zip
+-ba441851788008362f013bf2983b22b0042af8df31bf90123328f928cc067492 *ffmpeg-v39.8.0-linux-x64.zip
+-27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.0-mas-arm64.zip
+-321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.0-mas-x64.zip
+-3ba7c7507181e0d4836f70f3d8800b4e9ba379e1086e9e89fda7ff9b3b9ad2cb *ffmpeg-v39.8.0-win32-arm64.zip
+-f37e7d51b8403e2ed8ca192bc6ae759cf63d80010e747b15eeb7120b575578b2 *ffmpeg-v39.8.0-win32-ia32.zip
+-b252e232438010f9683e8fd10c3bf0631df78e42a6ae11d6cb7aa7e6ac11185f *ffmpeg-v39.8.0-win32-x64.zip
+-365735192f58a7f7660100227ec348ba3df604415ff5264b54d93cb6cf5f6f6f *hunspell_dictionaries.zip
+-6384ee31daa39de4dd4bd3aa225cdb14cdddb7f463a2c1663b38a79e122a13e2 *libcxx-objects-v39.8.0-linux-arm64.zip
+-9748b3272e52a8274fe651def2d6ae2dad7a3771b520dd105f46f4020ba9d63b *libcxx-objects-v39.8.0-linux-armv7l.zip
+-74d47a155ecc6c2054418c7c3e0540f32b983ebdc65e8b4ea5d3e257d29b3f4f *libcxx-objects-v39.8.0-linux-x64.zip
+-c0755fbb84011664bd36459fc6e06a603078dccd3b7b260f6ed6ad1d409f79f7 *libcxx_headers.zip
+-3ea41e9bd56e8f52ab8562c1406ba9416abe3993640935e981cbbd77c0f2654b *libcxxabi_headers.zip
+-befcd6067f35d911a6a87b927e79dc531cb7bea39e85f86a65e9ab82ef0cece1 *mksnapshot-v39.8.0-darwin-arm64.zip
+-f0e692655298ffed60630c3e6490ced69e9d8726e85bcaecfa34485f3a991469 *mksnapshot-v39.8.0-darwin-x64.zip
+-d5d0901cd1eafdf921d2a0d1565829cf60f454a71ce74fa60db98780fd8a1a96 *mksnapshot-v39.8.0-linux-arm64-x64.zip
+-1bc0a3294d258a59846aa5c5359cd8b0f43831ebd7c3e1dde9a6cfaa39d845bf *mksnapshot-v39.8.0-linux-armv7l-x64.zip
+-4e414dbe75f460cb34508608db984aa6f4d274f333fa327a3d631da4a516da8f *mksnapshot-v39.8.0-linux-x64.zip
+-c51c86e3a11ad75fb4f7559798f6d64ec7def19583c96ce08de7ee5796568841 *mksnapshot-v39.8.0-mas-arm64.zip
+-6544d1e93adea1e9a694f9b9f539d96f84df647d9c9319b29d4fc88751ff9075 *mksnapshot-v39.8.0-mas-x64.zip
+-372b4685c53f19ccc72c33d78c1283d9389c72f42cd48224439fe4f89199caa0 *mksnapshot-v39.8.0-win32-arm64-x64.zip
+-199e9244f4522a4a02aece09a6a33887b24d7ec837640d39c930170e4b3caa57 *mksnapshot-v39.8.0-win32-ia32.zip
+-970e979e7a8b70f300f7854cb571756d9049bc42b44a6153a9ce3a18e1a83243 *mksnapshot-v39.8.0-win32-x64.zip
++1e91e08b27242bfa38e3321eac27a76b4527b5240d9b7fa55b34b27272c7d20d *chromedriver-v39.8.4-darwin-arm64.zip
++e6036542dea19cf60b0d1ae6b7be1cdfb741363f7af8243720566363a9d04a23 *chromedriver-v39.8.4-darwin-x64.zip
++464e5f0c7ae0dcf4817436d6289bcee5cd655e7da96debf8e4723a10f2545362 *chromedriver-v39.8.4-linux-arm64.zip
++2be3059d746a33bf3e4c0cf89131401294ef270e152a0e567ffb279a77cd3bba *chromedriver-v39.8.4-linux-armv7l.zip
++dfce0407bf9304f1df3f053e305d8c7660ab7ac2b6f4b81bedab343d16bcc48d *chromedriver-v39.8.4-linux-x64.zip
++28c4f1b14580fc2a0b35cb9a9b29e8742e117311df8843c1ba31439249b368c3 *chromedriver-v39.8.4-mas-arm64.zip
++381581e0ba9ca49682d39b7cdf05d5f3c2c477c2db7878738103051bffb02c5d *chromedriver-v39.8.4-mas-x64.zip
++22c4c9e1fdbb80b02bfca06de84407ff4fae79072f192b4e4c9260ccd2d55ded *chromedriver-v39.8.4-win32-arm64.zip
++d2771daa0fdd9375b6b82b8fbdc61781fba3ab3aa104a57d0e4a5262b8aa7baa *chromedriver-v39.8.4-win32-ia32.zip
++984738998aa9f5947f11446386d5c26dc5836de5869be4a11a8db6c1a21a9801 *chromedriver-v39.8.4-win32-x64.zip
++21469b4c0fba6ff2470f3ca046c4fedaa0e7169de6849d3a515df1229583e72b *electron-api.json
++4ef051701b2d01f19f8d3d29d41d27e3a9c6881c9defefc3883b35157234ffb0 *electron-v39.8.4-darwin-arm64-dsym-snapshot.zip
++115a40e2f14a492cc5ea9948e61e8c00ad758c568a74c94551acde0a0c6ff892 *electron-v39.8.4-darwin-arm64-dsym.zip
++d744d733681a36a242abb8b997c58571b49edb12db616bbd966111b1ff9f2114 *electron-v39.8.4-darwin-arm64-symbols.zip
++47636d2c4e07dc587fad991d2e682a8a8aa42281732e33323418e16e4d31245d *electron-v39.8.4-darwin-arm64.zip
++8196638bd34cc5815bd91de60f2d5eaa1119c8d473519c208e640cf68a1d9410 *electron-v39.8.4-darwin-x64-dsym-snapshot.zip
++f6cc6d79870acb14efda0bfb33f1e78b96fcab3bdbecc6d91c505dddb519f09f *electron-v39.8.4-darwin-x64-dsym.zip
++14204efe7f170b82e9c369d060f8b05d5a32aceb9800330861dbc05482ada505 *electron-v39.8.4-darwin-x64-symbols.zip
++48bc4c03e3dab5678ddc447378ec639803d687d75939575675a273f054b98237 *electron-v39.8.4-darwin-x64.zip
++8c5e0eb3e15b90b2397dc641255c8bac797a0e4a2f999ea77e4461d667add977 *electron-v39.8.4-linux-arm64-debug.zip
++25df0c1a03bdad3a19f5a9d6385efadc249b48a512cbb7967bccffe1a123a007 *electron-v39.8.4-linux-arm64-symbols.zip
++67d9c084e664ee2a5f76dce2efb13f79aff60e014deb06174af82b6cfd43b101 *electron-v39.8.4-linux-arm64.zip
++514dbca9bf81f82f6574ae906057b78f13c4bd781eba9033ed58d6609ce944a8 *electron-v39.8.4-linux-armv7l-debug.zip
++3baa152b9ae413da46ced437291b7bd65dca390168a62f9ba01b7f8c9bc76ed4 *electron-v39.8.4-linux-armv7l-symbols.zip
++a2d835231443afc8022a99a3ab94b7b4a90ebfbda77c2fbefafca430753174fe *electron-v39.8.4-linux-armv7l.zip
++8ea7223c43a03779fafc6272742ebca104f584b3952abcf17b186af3624803d7 *electron-v39.8.4-linux-x64-debug.zip
++4d834e7574dda95f1bd10a7758ed93fbc12d2aa4aa6cc6fad091a37ea422d196 *electron-v39.8.4-linux-x64-symbols.zip
++66f1ea702595deda724f6c6246acfddc84a317c7f0262bd7fd350af50dbbe4e9 *electron-v39.8.4-linux-x64.zip
++ce85bfbd66c6731004e7d035a2bf65b2c0cb95a9716ee7e156061c791bd723a7 *electron-v39.8.4-mas-arm64-dsym-snapshot.zip
++b745d57275df62904d779fe757446adfe515252edc00fe8e8667fe63e9975dda *electron-v39.8.4-mas-arm64-dsym.zip
++14706a26e78fcdc34be2f12229920cc178b6b773eeede0aee87875336e4a6a0c *electron-v39.8.4-mas-arm64-symbols.zip
++9a30bfe87c8d62f39798a5a69a63085429f6f1ba1975e7d552dc35c6c7c41a59 *electron-v39.8.4-mas-arm64.zip
++8ee820ece1f08d637ddbea9dae1b9fbe014be88fa20feb1e261a6921c2977e6c *electron-v39.8.4-mas-x64-dsym-snapshot.zip
++044c25405f83c6012c238990b534f47430e308c2c787e1f6d7fe0fb41728b818 *electron-v39.8.4-mas-x64-dsym.zip
++05c1f4fc148222481dc3e88388cbd5451bffdd436293cc0613a9ab1904e76cfa *electron-v39.8.4-mas-x64-symbols.zip
++51c310921e5740a91a75d89819f89757210707a913691fe07d60e84100102d42 *electron-v39.8.4-mas-x64.zip
++3aacf6f224b5438350c1ea5524cb0c962f6d60f8e00f297fc872dce9633aed7d *electron-v39.8.4-win32-arm64-pdb.zip
++180f870fbe3aff8d4ca837ff41b5e1dd04d63b0ae0cc2fcf8d7e20e518f4fcb6 *electron-v39.8.4-win32-arm64-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-arm64-toolchain-profile.zip
++4316324e59d8bceee77366a4ed7a8d3f087ccdf2232b9cac61d600c28fcf0876 *electron-v39.8.4-win32-arm64.zip
++110fa00b9defb546e6110022be00c2f8ef2306b7104e2a1f749dc2b74d467e57 *electron-v39.8.4-win32-ia32-pdb.zip
++ae8c656e2d43493a6c245235ca17f1ddd8ae9632f73348a8f76d76240c5f33f6 *electron-v39.8.4-win32-ia32-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-ia32-toolchain-profile.zip
++f260df3274199f29e32e89efb7bcd846db30d6ccdcc46cc3be9c19be9bc16566 *electron-v39.8.4-win32-ia32.zip
++2e37fd5956a3b73d99e569ea71cc463ba550440835f7672d0651c309d2489c52 *electron-v39.8.4-win32-x64-pdb.zip
++b1601c04324691324b2943aeda1309dbd8dac20cc5f4df32f4aa12d5a68c4b0c *electron-v39.8.4-win32-x64-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-x64-toolchain-profile.zip
++8acc4bb73f05a32eba18bd08e7bc4636e41b2fd00cb538cb90becffbca997789 *electron-v39.8.4-win32-x64.zip
++3675395eef7139544965c3408f1426e4af36055627c5ec0c2fe5abf4cecf6977 *electron.d.ts
++27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.4-darwin-arm64.zip
++321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.4-darwin-x64.zip
++52ae6eccbdb4a9403a6c3eb46b356a28940ec25958b6b9181fb2f38e612e40ed *ffmpeg-v39.8.4-linux-arm64.zip
++622cb781fb1e3b9617e7e60c36384427f7b0d9b5ad888e9bc356a83b050e13f1 *ffmpeg-v39.8.4-linux-armv7l.zip
++ba441851788008362f013bf2983b22b0042af8df31bf90123328f928cc067492 *ffmpeg-v39.8.4-linux-x64.zip
++27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.4-mas-arm64.zip
++321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.4-mas-x64.zip
++71d478432519dda32a53c47eb5fcb97d23265273ff7939da54cccf7a19f6f87e *ffmpeg-v39.8.4-win32-arm64.zip
++3c52c43a62ebf1ebbe0c02611ad4399eb0131257849b707156417ffcbaa144c8 *ffmpeg-v39.8.4-win32-ia32.zip
++5613f1bd387d6c91f4c3901b22643c5400c696e2dacbb7d9893d0e63edc51ae9 *ffmpeg-v39.8.4-win32-x64.zip
++d720519f7417fe58d60d54085a0c32e8e7b65883cad909ee55d1b9b78f86362d *hunspell_dictionaries.zip
++a4c6e3aef474b21e7f002858ddef194da1b64e8b20ecabdaea9533d1d2712738 *libcxx-objects-v39.8.4-linux-arm64.zip
++bd9f1876dddbc413fc3328707f4f7f9daa2df7cb81d4d9e13f520168ec9eb76a *libcxx-objects-v39.8.4-linux-armv7l.zip
++8403bc29cd82a40f422c63fdbaa61b85d28ff58e5e90e378a97c0715133b87c4 *libcxx-objects-v39.8.4-linux-x64.zip
++9bbb19892567a3a9abd0f6288f9f203fa3051387c3e4625fc52eb49adcbe96e5 *libcxx_headers.zip
++9b988e2bb379c6d3094872f600944ad3284510cf225f86368c4f43270b89673c *libcxxabi_headers.zip
++f106faec00f811971cce77bb39a2ef08ddeb3e6b3b6f96991a4ab889c06636a3 *mksnapshot-v39.8.4-darwin-arm64.zip
++23ca2a8fbe7d870c745c6808dced54889883d259fd6a601174b81891dfd1a052 *mksnapshot-v39.8.4-darwin-x64.zip
++23b78843edf3ad2ad2a38eb88578105a75335c397bd4f7cc1fdf54f890fb9d9b *mksnapshot-v39.8.4-linux-arm64-x64.zip
++582d768b97f13d5991fb96dbbba54f7c5da4248634952d77eac342ecd5db29a5 *mksnapshot-v39.8.4-linux-armv7l-x64.zip
++677e242eca2487d1427e035cc9e54750a3bb2528f761af483e5a6d67f81f69dc *mksnapshot-v39.8.4-linux-x64.zip
++fadb9ec8cbf598ef49d5dac34c764a2d2487d41111e3201dd13ad6f09d48c591 *mksnapshot-v39.8.4-mas-arm64.zip
++2a912c91dffeae2e8a97b7e49fe67f7dfb7d13f8e441bb5c2c40d2583ae504ca *mksnapshot-v39.8.4-mas-x64.zip
++fc5478a848c95a1412efdc550d16e4e83c7c2db5f98c658da2430c4275e5f6cb *mksnapshot-v39.8.4-win32-arm64-x64.zip
++b279c6292e1937a9c6aa7421415434e8f40ed7ba818851f57227cdedbdd19e7b *mksnapshot-v39.8.4-win32-ia32.zip
++c5b457d293d35f98d9d548613fce3c6ee111242760d381ed39d6c721b3d09918 *mksnapshot-v39.8.4-win32-x64.zip
+\ No newline at end of file
+diff --git a/cgmanifest.json b/cgmanifest.json
+index 1b1e171..09d805b 100644
+--- a/cgmanifest.json
++++ b/cgmanifest.json
+@@ -531,4 +531,4 @@
+ 					"repositoryUrl": "https://github.com/electron/electron",
+-					"commitHash": "69c8cbf259da0f84e9c1db04958516a68f7170aa",
+-					"tag": "39.8.0"
++					"commitHash": "7007907df08d02da98f513dcbdb430ab51be59c7",
++					"tag": "39.8.4"
+ 				}
+diff --git a/package-lock.json b/package-lock.json
+index 3795213..9d261de 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -104,3 +104,3 @@
+         "deemon": "^1.13.6",
+-        "electron": "39.8.0",
++        "electron": "39.8.4",
+         "eslint": "^9.36.0",
+@@ -8389,5 +8389,5 @@
+     "node_modules/electron": {
+-      "version": "39.8.0",
+-      "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.0.tgz",
+-      "integrity": "sha512-K+f3YelSyh9Q4LgUXuIhLB4kq73LJrqnIbe8ih9vpWi+iSdPebj0w7FRYwILCMDoyBQMFC9LicYHuIPmZzdKlg==",
++      "version": "39.8.4",
++      "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.4.tgz",
++      "integrity": "sha512-eXYKxr4y+s31xs78keVJYg+XY20tGQMQzyIhZvc5L0XRDH2Gp08mbeFlbR1OjAeM5h5l/T2JYT2MFK2kYe2fMg==",
+       "dev": true,
+diff --git a/package.json b/package.json
+index 295d4b3..6e707ed 100644
+--- a/package.json
++++ b/package.json
+@@ -174,3 +174,3 @@
+     "deemon": "^1.13.6",
+-    "electron": "39.8.0",
++    "electron": "39.8.4",
+     "eslint": "^9.36.0",

patches/00-copilot-fix-action-condition.patch

@@ -0,0 +1,140 @@
+diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
+index f7d4917d..b62a8a43 100644
+--- a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
++++ b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
+@@ -1144,3 +1144,3 @@ export function registerChatActions() {
+ 				precondition: ContextKeyExpr.and(
+-					ChatContextKeys.Setup.installed,
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.disabled.negate(),
+diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
+index 04243ca9..5241910f 100644
+--- a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
++++ b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
+@@ -316,3 +316,4 @@ class AttachSelectionToChatAction extends Action2 {
+ 						ResourceContextKey.Scheme.isEqualTo(Schemas.vscodeUserData)
+-					)
++					),
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 				)
+diff --git a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
+index 7e9c73f6..03da6f20 100644
+--- a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
++++ b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
+@@ -1420,3 +1420,3 @@ configurationRegistry.registerConfiguration({
+ 			description: nls.localize('chat.disableAIFeatures', "Disable and hide built-in AI features provided by GitHub Copilot, including chat and inline suggestions."),
+-			default: false,
++			default: true,
+ 			scope: ConfigurationScope.WINDOW
+diff --git a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
+index 8ac8f531..f56d3e96 100644
+--- a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
++++ b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
+@@ -72,2 +72,3 @@ const chatViewDescriptor: IViewDescriptor = {
+ 		ContextKeyExpr.and(
++			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 			ChatContextKeys.Setup.hidden.negate(),
+diff --git a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
+index 3fa75da3..b1832fcb 100644
+--- a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
++++ b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
+@@ -232,8 +232,9 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					f1: true,
+-					precondition: ContextKeyExpr.or(
+-						ChatContextKeys.Setup.hidden,
+-						ChatContextKeys.Setup.disabledInWorkspace,
+-						ChatContextKeys.Setup.untrusted,
+-						ChatContextKeys.Setup.completed.negate(),
+-						ChatContextKeys.Entitlement.canSignUp
++					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
++						ChatContextKeys.Setup.hidden.negate(),
++						ChatContextKeys.Setup.disabledInWorkspace.negate(),
++						ChatContextKeys.Setup.untrusted.negate(),
++						ChatContextKeys.Setup.completed,
++						ChatContextKeys.Entitlement.canSignUp.negate()
+ 					)
+@@ -353,2 +354,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 						when: ContextKeyExpr.and(
++							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 							ChatContextKeys.Setup.hidden.negate(),
+@@ -385,2 +387,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 						when: ContextKeyExpr.and(
++							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 							IsWebContext.negate(),
+@@ -415,2 +418,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 						ChatContextKeys.Setup.hidden.negate(),
+@@ -472,2 +476,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 						ChatContextKeys.Setup.hidden.negate(),
+@@ -564,2 +569,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 		const internalGenerateCodeContext = ContextKeyExpr.and(
++			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 			ChatContextKeys.Setup.hidden.negate(),
+@@ -801,3 +807,7 @@ export class ChatTeardownContribution extends Disposable implements IWorkbenchCo
+ 					category: CHAT_CATEGORY,
+-					precondition: ContextKeyExpr.and(ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate()),
++					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
++						ChatContextKeys.Setup.hidden.negate(),
++						ChatContextKeys.Setup.disabledInWorkspace.negate()
++					),
+ 					menu: {
+diff --git a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
+index 2c244736..2f5023d8 100644
+--- a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
++++ b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
+@@ -43,3 +43,4 @@ const inlineChatContextKey = ContextKeyExpr.and(
+ 	EditorContextKeys.writable,
+-	EditorContextKeys.editorSimpleInput.negate()
++	EditorContextKeys.editorSimpleInput.negate(),
++	ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ );
+diff --git a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
+index dc231e44..633de730 100644
+--- a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
++++ b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
+@@ -545,3 +545,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{}]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate()),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -554,3 +554,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{}]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`)), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -563,3 +563,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{}]),
+-				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
++				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`)), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 			},
+@@ -569,3 +569,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{ showWelcome: true }]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -578,3 +578,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{ showWelcome: true }]),
+-				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
++				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 			}
+diff --git a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
+index 6bdf7f36..3bfc7d19 100644
+--- a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
++++ b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
+@@ -703,2 +703,3 @@ registerAction2(class extends Action2 {
+ 				when: ContextKeyExpr.and(
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.hidden.negate(),
+diff --git a/src/vs/workbench/contrib/scm/browser/scmInput.ts b/src/vs/workbench/contrib/scm/browser/scmInput.ts
+index 6adf03c6..38a6d42c 100644
+--- a/src/vs/workbench/contrib/scm/browser/scmInput.ts
++++ b/src/vs/workbench/contrib/scm/browser/scmInput.ts
+@@ -848,2 +848,3 @@ registerAction2(class extends Action2 {
+ 				when: ContextKeyExpr.and(
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.hidden.negate(),

patches/00-ext-github-authentication-use-pat.patch

@@ -1,5 +1,5 @@
 diff --git a/extensions/github-authentication/src/common/env.ts b/extensions/github-authentication/src/common/env.ts
-index 5456fb8..18fd732 100644
+index 56cad4be..18fd7327 100644
 --- a/extensions/github-authentication/src/common/env.ts
 +++ b/extensions/github-authentication/src/common/env.ts
 @@ -7,24 +7,4 @@ import { AuthProviderType } from '../github';
@@ -8,9 +8,9 @@ index 5456fb8..18fd732 100644
 -	'vscode',
 -	'vscode-insiders',
 -	'vscode-exploration',
--	'vscode-sessions',
+-	'vscode-agents',
--	'vscode-sessions-insiders',
+-	'vscode-agents-insiders',
--	'vscode-sessions-exploration',
+-	'vscode-agents-exploration',
 -	// On Windows, some browsers don't seem to redirect back to OSS properly.
 -	// As a result, you get stuck in the auth flow. We exclude this from the
 -	// list until we can figure out a way to fix this behavior in browsers.

patches/00-ui-custom-font.patch

@@ -1,5 +1,5 @@
 diff --git a/src/vs/base/browser/ui/actionbar/actionbar.css b/src/vs/base/browser/ui/actionbar/actionbar.css
-index e9e55ad..0ce9147 100644
+index e9e55ad9..0ce9147c 100644
 --- a/src/vs/base/browser/ui/actionbar/actionbar.css
 +++ b/src/vs/base/browser/ui/actionbar/actionbar.css
 @@ -127 +127,72 @@
@@ -77,10 +77,10 @@ index e9e55ad..0ce9147 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/button/button.css b/src/vs/base/browser/ui/button/button.css
-index 8496f1b..964455a 100644
+index 0ec4cbb4..0fc77fae 100644
 --- a/src/vs/base/browser/ui/button/button.css
 +++ b/src/vs/base/browser/ui/button/button.css
-@@ -183 +183,43 @@
+@@ -184 +184,43 @@
  }
 +
 +
@@ -126,7 +126,7 @@ index 8496f1b..964455a 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/codicons/codicon/codicon.css b/src/vs/base/browser/ui/codicons/codicon/codicon.css
-index d7f257d..af55bdd 100644
+index d7f257db..af55bddb 100644
 --- a/src/vs/base/browser/ui/codicons/codicon/codicon.css
 +++ b/src/vs/base/browser/ui/codicons/codicon/codicon.css
 @@ -25 +25,7 @@
@@ -139,7 +139,7 @@ index d7f257d..af55bdd 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/iconLabel/iconlabel.css b/src/vs/base/browser/ui/iconLabel/iconlabel.css
-index d3dfd9a..cf59627 100644
+index d3dfd9a5..cf596272 100644
 --- a/src/vs/base/browser/ui/iconLabel/iconlabel.css
 +++ b/src/vs/base/browser/ui/iconLabel/iconlabel.css
 @@ -119 +119,21 @@
@@ -166,7 +166,7 @@ index d3dfd9a..cf59627 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/inputbox/inputBox.css b/src/vs/base/browser/ui/inputbox/inputBox.css
-index dc5e637..b580762 100644
+index dc5e637f..b580762b 100644
 --- a/src/vs/base/browser/ui/inputbox/inputBox.css
 +++ b/src/vs/base/browser/ui/inputbox/inputBox.css
 @@ -107 +107,28 @@
@@ -200,7 +200,7 @@ index dc5e637..b580762 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/selectBox/selectBox.css b/src/vs/base/browser/ui/selectBox/selectBox.css
-index fd4d00e..92ddc99 100644
+index fd4d00ea..92ddc996 100644
 --- a/src/vs/base/browser/ui/selectBox/selectBox.css
 +++ b/src/vs/base/browser/ui/selectBox/selectBox.css
 @@ -35 +35,16 @@
@@ -222,7 +222,7 @@ index fd4d00e..92ddc99 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts b/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts
-index b7cbca1..16f531c 100644
+index b7cbca15..16f531cb 100644
 --- a/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts
 +++ b/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts
 @@ -8,2 +8,3 @@ import * as arrays from '../../../common/arrays.js';
@@ -235,7 +235,7 @@ index b7cbca1..16f531c 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/base/browser/ui/splitview/paneview.css b/src/vs/base/browser/ui/splitview/paneview.css
-index 7bb4282..92c027a 100644
+index 7bb4282a..92c027a2 100644
 --- a/src/vs/base/browser/ui/splitview/paneview.css
 +++ b/src/vs/base/browser/ui/splitview/paneview.css
 @@ -153 +153,38 @@
@@ -279,7 +279,7 @@ index 7bb4282..92c027a 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/splitview/paneview.ts b/src/vs/base/browser/ui/splitview/paneview.ts
-index fb2e1f4..3b1e23f 100644
+index fb2e1f40..3b1e23f2 100644
 --- a/src/vs/base/browser/ui/splitview/paneview.ts
 +++ b/src/vs/base/browser/ui/splitview/paneview.ts
 @@ -21,2 +21,3 @@ import { IView, Sizing, SplitView } from './splitview.js';
@@ -302,7 +302,7 @@ index fb2e1f4..3b1e23f 100644
 +		const headerSize = this.headerSize;
  
 diff --git a/src/vs/base/browser/ui/toggle/toggle.css b/src/vs/base/browser/ui/toggle/toggle.css
-index e2d206d..e69352c 100644
+index e2d206d3..e69352c8 100644
 --- a/src/vs/base/browser/ui/toggle/toggle.css
 +++ b/src/vs/base/browser/ui/toggle/toggle.css
 @@ -69 +69,27 @@
@@ -335,7 +335,7 @@ index e2d206d..e69352c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/toggle/toggle.ts b/src/vs/base/browser/ui/toggle/toggle.ts
-index 0b2fcbb..6370e6f 100644
+index 0b2fcbbb..6370e6f7 100644
 --- a/src/vs/base/browser/ui/toggle/toggle.ts
 +++ b/src/vs/base/browser/ui/toggle/toggle.ts
 @@ -5,2 +5,3 @@
@@ -350,7 +350,7 @@ index 0b2fcbb..6370e6f 100644
  	}
 diff --git a/src/vs/base/common/font.ts b/src/vs/base/common/font.ts
 new file mode 100644
-index 0000000..8b9689c
+index 00000000..8b9689c7
 --- /dev/null
 +++ b/src/vs/base/common/font.ts
 @@ -0,0 +1,187 @@
@@ -544,7 +544,7 @@ index 0000000..8b9689c
 \ No newline at end of file
 diff --git a/src/vs/base/test/common/font.test.ts b/src/vs/base/test/common/font.test.ts
 new file mode 100644
-index 0000000..62a49d5
+index 00000000..62a49d53
 --- /dev/null
 +++ b/src/vs/base/test/common/font.test.ts
 @@ -0,0 +1,482 @@
@@ -1031,7 +1031,7 @@ index 0000000..62a49d5
 +	});
 +});
 diff --git a/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts b/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts
-index 328285f..0735dfa 100644
+index 328285f0..0735dfa2 100644
 --- a/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts
 +++ b/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts
 @@ -6,2 +6,3 @@
@@ -1044,7 +1044,7 @@ index 328285f..0735dfa 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/browser/media/style.css b/src/vs/workbench/browser/media/style.css
-index 0d6a2da..6127a14 100644
+index 1f6e583f..79401713 100644
 --- a/src/vs/workbench/browser/media/style.css
 +++ b/src/vs/workbench/browser/media/style.css
 @@ -11,20 +11,20 @@
@@ -1089,7 +1089,7 @@ index 0d6a2da..6127a14 100644
 +	font-family: var(--vscode-workbench-font-family, var(--monaco-font));
 +	font-size: var(--vscode-workbench-font-size, 13px);
  
-@@ -335 +337,41 @@ body {
+@@ -356 +358,41 @@ body {
  }
 +
 +
@@ -1133,33 +1133,33 @@ index 0d6a2da..6127a14 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts b/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts
-index 0307cab..5e5f6f3 100644
+index 86c8b184..bfd30e64 100644
 --- a/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts
 +++ b/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts
-@@ -40,2 +40,3 @@ import { IViewsService } from '../../../services/views/common/viewsService.js';
+@@ -41,2 +41,3 @@ import { IViewsService } from '../../../services/views/common/viewsService.js';
  import { SwitchCompositeViewAction } from '../compositeBarActions.js';
 +import { FONT, getFontSize, updateActivityBarSize } from '../../../../base/common/font.js';
  
-@@ -45,2 +46,3 @@ export class ActivitybarPart extends Part {
+@@ -46,2 +47,3 @@ export class ActivitybarPart extends Part {
  	static readonly COMPACT_ACTION_HEIGHT = 32;
 +	static readonly COMPACT_ACTION_HEIGHT_RATIO = 32/48;
  
-@@ -48,2 +50,3 @@ export class ActivitybarPart extends Part {
+@@ -49,2 +51,3 @@ export class ActivitybarPart extends Part {
  	static readonly COMPACT_ACTIVITYBAR_WIDTH = 36;
 +	static readonly COMPACT_ACTIVITYBAR_WIDTH_RATIO = 36/48;
  
-@@ -51,2 +54,3 @@ export class ActivitybarPart extends Part {
+@@ -52,2 +55,3 @@ export class ActivitybarPart extends Part {
  	static readonly COMPACT_ICON_SIZE = 16;
 +	static readonly COMPACT_ICON_SIZE_RATIO = 16/24;
  
-@@ -58,4 +62,4 @@ export class ActivitybarPart extends Part {
+@@ -59,4 +63,4 @@ export class ActivitybarPart extends Part {
  
 -	get minimumWidth(): number { return this._isCompact ? ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH : ActivitybarPart.ACTIVITYBAR_WIDTH; }
 -	get maximumWidth(): number { return this._isCompact ? ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH : ActivitybarPart.ACTIVITYBAR_WIDTH; }
 +	get minimumWidth(): number { return this._isCompact ? FONT.activityBarSize48 * ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH_RATIO : FONT.activityBarSize48; }
 +	get maximumWidth(): number { return this._isCompact ? FONT.activityBarSize48 * ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH_RATIO : FONT.activityBarSize48; }
  	readonly minimumHeight: number = 0;
-@@ -90,2 +94,11 @@ export class ActivitybarPart extends Part {
+@@ -91,2 +95,11 @@ export class ActivitybarPart extends Part {
  		}));
 +
 +		this._register(configurationService.onDidChangeConfiguration(e => {
@@ -1171,21 +1171,21 @@ index 0307cab..5e5f6f3 100644
 +			}
 +		}));
  	}
-@@ -96,4 +109,4 @@ export class ActivitybarPart extends Part {
+@@ -97,4 +110,4 @@ export class ActivitybarPart extends Part {
  			this.element.style.setProperty('--activity-bar-width', `${this.minimumWidth}px`);
 -			this.element.style.setProperty('--activity-bar-action-height', `${this._isCompact ? ActivitybarPart.COMPACT_ACTION_HEIGHT : ActivitybarPart.ACTION_HEIGHT}px`);
 -			this.element.style.setProperty('--activity-bar-icon-size', `${this._isCompact ? ActivitybarPart.COMPACT_ICON_SIZE : ActivitybarPart.ICON_SIZE}px`);
 +			this.element.style.setProperty('--activity-bar-action-height', `${this._isCompact ? FONT.activityBarSize32 : FONT.activityBarSize48}px`);
 +			this.element.style.setProperty('--activity-bar-icon-size', `${this._isCompact ? FONT.activityBarSize : FONT.activityBarSize24}px`);
  		}
-@@ -153,2 +166,6 @@ export class ActivitybarPart extends Part {
+@@ -154,2 +167,6 @@ export class ActivitybarPart extends Part {
  
 +		// Apply font settings before show() so composite bar uses correct sizes
 +		this.applyActivityBarFontFamily(parent);
 +		this.applyActivityBarFontSize(parent);
 +
  		this.updateCompactStyle();
-@@ -162,2 +179,34 @@ export class ActivitybarPart extends Part {
+@@ -163,2 +180,34 @@ export class ActivitybarPart extends Part {
  
 +	private applyActivityBarFontFamily(container?: HTMLElement): void {
 +		const target = container ?? this.getContainer();
@@ -1221,7 +1221,7 @@ index 0307cab..5e5f6f3 100644
 +
  	getPinnedPaneCompositeIds(): string[] {
 diff --git a/src/vs/workbench/browser/parts/activitybar/media/activityaction.css b/src/vs/workbench/browser/parts/activitybar/media/activityaction.css
-index a40a351..51eb067 100644
+index a40a3515..51eb067d 100644
 --- a/src/vs/workbench/browser/parts/activitybar/media/activityaction.css
 +++ b/src/vs/workbench/browser/parts/activitybar/media/activityaction.css
 @@ -230 +230,60 @@
@@ -1287,7 +1287,7 @@ index a40a351..51eb067 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css b/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css
-index 568a721..b3d7e50 100644
+index 568a7212..b3d7e506 100644
 --- a/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css
 +++ b/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css
 @@ -8,2 +8,4 @@
@@ -1306,7 +1306,7 @@ index 568a721..b3d7e50 100644
 +	height: calc(var(--vscode-workbench-activitybar-font-size) * 2.1875);
  }
 diff --git a/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts b/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts
-index d32082b..ad7e524 100644
+index d32082b4..ad7e524c 100644
 --- a/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts
 +++ b/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts
 @@ -36,2 +36,4 @@ import { VisibleViewContainersTracker } from '../visibleViewContainersTracker.js
@@ -1362,7 +1362,7 @@ index d32082b..ad7e524 100644
 +		this._onDidChange.fire(undefined); // Signal grid that size constraints changed
  	}
 diff --git a/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css b/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css
-index aec3de2..b0e1fd8 100644
+index aec3de2d..b0e1fd8f 100644
 --- a/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css
 +++ b/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css
 @@ -28,2 +28,8 @@
@@ -1375,7 +1375,7 @@ index aec3de2..b0e1fd8 100644
 +
  .monaco-workbench .part.auxiliarybar > .title > .title-label {
 diff --git a/src/vs/workbench/browser/parts/editor/editorTabsControl.ts b/src/vs/workbench/browser/parts/editor/editorTabsControl.ts
-index b0a44e2..e711a80 100644
+index b0a44e2c..e711a809 100644
 --- a/src/vs/workbench/browser/parts/editor/editorTabsControl.ts
 +++ b/src/vs/workbench/browser/parts/editor/editorTabsControl.ts
 @@ -48,2 +48,4 @@ import { MarkdownString } from '../../../../base/common/htmlContent.js';
@@ -1451,7 +1451,7 @@ index b0a44e2..e711a80 100644
 +
  	private get editorActionsEnabled(): boolean {
 diff --git a/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css b/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css
-index 57ab8ca..72a328f 100644
+index 57ab8ca5..72a328fc 100644
 --- a/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css
 +++ b/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css
 @@ -9,2 +9,3 @@
@@ -1498,7 +1498,7 @@ index 57ab8ca..72a328f 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css b/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css
-index a24f761..6b15b9c 100644
+index a24f7613..6b15b9c2 100644
 --- a/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css
 +++ b/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css
 @@ -47 +47,28 @@
@@ -1532,7 +1532,7 @@ index a24f761..6b15b9c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css b/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css
-index 4f9477d..b47fd85 100644
+index 4f9477d0..b47fd85b 100644
 --- a/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css
 +++ b/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css
 @@ -176,4 +176,4 @@
@@ -1663,7 +1663,7 @@ index 4f9477d..b47fd85 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts b/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts
-index b0befd9..7c25771 100644
+index b56047d6..d6e6c7ed 100644
 --- a/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts
 +++ b/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts
 @@ -6,2 +6,3 @@
@@ -1697,7 +1697,7 @@ index b0befd9..7c25771 100644
 +		super(parent, editorPartsView, groupsView, groupView, tabsModel, contextMenuService, instantiationService, contextKeyService, keybindingService, notificationService, quickInputService, themeService, editorResolverService, hostService, configurationService);
  
 diff --git a/src/vs/workbench/browser/parts/media/paneCompositePart.css b/src/vs/workbench/browser/parts/media/paneCompositePart.css
-index fe0f2ad..195267c 100644
+index fe0f2adf..195267cf 100644
 --- a/src/vs/workbench/browser/parts/media/paneCompositePart.css
 +++ b/src/vs/workbench/browser/parts/media/paneCompositePart.css
 @@ -369 +369,119 @@
@@ -1822,7 +1822,7 @@ index fe0f2ad..195267c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/panel/media/panelpart.css b/src/vs/workbench/browser/parts/panel/media/panelpart.css
-index e1c147d..63d0e10 100644
+index e1c147d8..63d0e109 100644
 --- a/src/vs/workbench/browser/parts/panel/media/panelpart.css
 +++ b/src/vs/workbench/browser/parts/panel/media/panelpart.css
 @@ -10,2 +10,7 @@
@@ -1887,7 +1887,7 @@ index e1c147d..63d0e10 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/panel/panelPart.ts b/src/vs/workbench/browser/parts/panel/panelPart.ts
-index 9afcf59..a8d4c2e 100644
+index 9afcf596..a8d4c2e6 100644
 --- a/src/vs/workbench/browser/parts/panel/panelPart.ts
 +++ b/src/vs/workbench/browser/parts/panel/panelPart.ts
 @@ -34,2 +34,3 @@ import { IConfigurationService } from '../../../../platform/configuration/common
@@ -1942,7 +1942,7 @@ index 9afcf59..a8d4c2e 100644
 +		this._onDidChange.fire(undefined); // Signal grid that size constraints changed
  	}
 diff --git a/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css b/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css
-index decb51a..d0db436 100644
+index decb51ab..d0db4363 100644
 --- a/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css
 +++ b/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css
 @@ -15,3 +15,3 @@
@@ -1999,7 +1999,7 @@ index decb51a..d0db436 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts b/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts
-index 101b9c6..970cdaa 100644
+index 101b9c6c..970cdaae 100644
 --- a/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts
 +++ b/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts
 @@ -36,2 +36,3 @@ import { VisibleViewContainersTracker } from '../visibleViewContainersTracker.js
@@ -2061,7 +2061,7 @@ index 101b9c6..970cdaa 100644
 +
  	private registerActions(): void {
 diff --git a/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css b/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css
-index 1f3b102..42ad22c 100644
+index 1f3b102e..42ad22c0 100644
 --- a/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css
 +++ b/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css
 @@ -11,2 +11,3 @@
@@ -2141,7 +2141,7 @@ index 1f3b102..42ad22c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts b/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts
-index 18340a8..0a33ce0 100644
+index 18340a8a..0a33ce06 100644
 --- a/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts
 +++ b/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts
 @@ -38,2 +38,4 @@ import { IView } from '../../../../base/browser/ui/grid/grid.js';
@@ -2237,7 +2237,7 @@ index 18340a8..0a33ce0 100644
 +		super(`workbench.parts.auxiliaryStatus.${id}`, instantiationService, themeService, contextService, storageService, layoutService, contextMenuService, contextKeyService, configurationService);
  	}
 diff --git a/src/vs/workbench/browser/parts/views/media/paneviewlet.css b/src/vs/workbench/browser/parts/views/media/paneviewlet.css
-index aca98de..5bf9bf7 100644
+index aca98deb..5bf9bf71 100644
 --- a/src/vs/workbench/browser/parts/views/media/paneviewlet.css
 +++ b/src/vs/workbench/browser/parts/views/media/paneviewlet.css
 @@ -87 +87,30 @@
@@ -2273,7 +2273,7 @@ index aca98de..5bf9bf7 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/views/treeView.ts b/src/vs/workbench/browser/parts/views/treeView.ts
-index 1c9305b..6471a0d 100644
+index 1c9305bd..6471a0d3 100644
 --- a/src/vs/workbench/browser/parts/views/treeView.ts
 +++ b/src/vs/workbench/browser/parts/views/treeView.ts
 @@ -79,2 +79,3 @@ import { IAccessibleViewInformationService } from '../../../services/accessibili
@@ -2290,10 +2290,10 @@ index 1c9305b..6471a0d 100644
 -	static readonly ITEM_HEIGHT = 22;
  	static readonly TREE_TEMPLATE_ID = 'treeExplorer';
 diff --git a/src/vs/workbench/browser/workbench.contribution.ts b/src/vs/workbench/browser/workbench.contribution.ts
-index 058693c..ee81a59 100644
+index bdc603ff..4bc6d153 100644
 --- a/src/vs/workbench/browser/workbench.contribution.ts
 +++ b/src/vs/workbench/browser/workbench.contribution.ts
-@@ -702,2 +702,85 @@ const registry = Registry.as<IConfigurationRegistry>(ConfigurationExtensions.Con
+@@ -698,2 +698,85 @@ const registry = Registry.as<IConfigurationRegistry>(ConfigurationExtensions.Con
  			},
 +			'workbench.experimental.fontFamily': {
 +				type: 'string',
@@ -2380,7 +2380,7 @@ index 058693c..ee81a59 100644
 +			},
  			'workbench.settings.editor': {
 diff --git a/src/vs/workbench/browser/workbench.ts b/src/vs/workbench/browser/workbench.ts
-index 10e2c3e..74e3bbe 100644
+index 10e2c3ed..74e3bbe9 100644
 --- a/src/vs/workbench/browser/workbench.ts
 +++ b/src/vs/workbench/browser/workbench.ts
 @@ -9,2 +9,3 @@ import { Event, Emitter, setGlobalLeakWarningThreshold } from '../../base/common
@@ -2460,7 +2460,7 @@ index 10e2c3e..74e3bbe 100644
 +		this.updateFontSize(configurationService);
  
 diff --git a/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts b/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts
-index 6f58865..3ab0ee4 100644
+index 6f588651..3ab0ee4e 100644
 --- a/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts
 +++ b/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts
 @@ -17,2 +17,3 @@ import { localize } from '../../../../nls.js';
@@ -2473,43 +2473,31 @@ index 6f58865..3ab0ee4 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts b/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts
-index bcb46c6..0aef82b 100644
+index d4f277de..4f386424 100644
 --- a/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts
 +++ b/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts
-@@ -52,2 +52,3 @@ import { BugIndicatingError } from '../../../../../base/common/errors.js';
+@@ -53,2 +53,3 @@ import { BugIndicatingError } from '../../../../../base/common/errors.js';
- import { ILogService } from '../../../../../platform/log/common/log.js';
+ import { compareIgnoreCase } from '../../../../../base/common/strings.js';
 +import { FONT } from '../../../../../base/common/font.js';
  
-@@ -638,5 +639,2 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
+@@ -838,5 +839,2 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
  
 -	static readonly ITEM_HEIGHT = 54;
 -	static readonly SECTION_HEIGHT = 26;
 -
- 	constructor(private readonly _approvalModel?: AgentSessionApprovalModel) { }
+ 	constructor(private readonly _approvalModel?: AgentSessionApprovalModel,
-@@ -645,6 +643,6 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
+@@ -847,3 +845,3 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
  		if (isAgentSessionSection(element)) {
 -			return AgentSessionsListDelegate.SECTION_HEIGHT;
 +			return FONT.sidebarSize26;
  		}
+@@ -854,3 +852,3 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
  
 -		let height = AgentSessionsListDelegate.ITEM_HEIGHT;
 +		let height = FONT.sidebarSize54;
  		const approval = this._approvalModel?.getApproval(element.resource).get();
-diff --git a/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts b/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts
-index ad2c82a..6cb6bce 100644
---- a/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts
-@@ -34,2 +34,3 @@ import { IContextKey, IContextKeyService } from '../../../../../platform/context
- import { CONTEXT_MODELS_EDITOR } from '../../common/constants.js';
-+import { FONT } from '../../../../../base/common/font.js';
- 
-@@ -439,3 +440,3 @@ class SectionItemDelegate implements IListVirtualDelegate<SectionItem> {
- 	getHeight(element: SectionItem) {
--		return 22;
-+		return FONT.sidebarSize22;
- 	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts
-index cc7bb15..f260d0e 100644
+index cc7bb156..f260d0e3 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts
 @@ -33,2 +33,3 @@ import { ResourcePool } from './chatCollections.js';
@@ -2522,7 +2510,7 @@ index cc7bb15..f260d0e 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts
-index 15ae799..06a95d5 100644
+index 15ae7996..06a95d59 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts
 @@ -36,2 +36,3 @@ import { ChatTreeItem } from '../../chat.js';
@@ -2535,7 +2523,7 @@ index 15ae799..06a95d5 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts
-index 8493938..50a19e4 100644
+index 84939387..50a19e4f 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts
 @@ -50,2 +50,3 @@ import { IHoverService } from '../../../../../../platform/hover/browser/hover.js
@@ -2548,20 +2536,20 @@ index 8493938..50a19e4 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts
-index 619d00a..9edbd1b 100644
+index 8f0f2c48..52818d1d 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts
 @@ -11,2 +11,3 @@ import { IListRenderer, IListVirtualDelegate } from '../../../../../../base/brow
  import { Codicon } from '../../../../../../base/common/codicons.js';
 +import { FONT } from '../../../../../../base/common/font.js';
  import { Disposable, DisposableStore } from '../../../../../../base/common/lifecycle.js';
-@@ -23,3 +24,3 @@ class TodoListDelegate implements IListVirtualDelegate<IChatTodo> {
+@@ -24,3 +25,3 @@ class TodoListDelegate implements IListVirtualDelegate<IChatTodo> {
  	getHeight(element: IChatTodo): number {
 -		return 22;
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts
-index 703940e..e0fa9eb 100644
+index 703940ed..e0fa9eb5 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts
 @@ -12,2 +12,3 @@ import { IAsyncDataSource, ITreeNode } from '../../../../../../base/browser/ui/t
@@ -2577,7 +2565,7 @@ index 703940e..e0fa9eb 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css b/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css
-index 83799c1..b2d3db2 100644
+index 83799c15..b2d3db2c 100644
 --- a/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css
 +++ b/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css
 @@ -169 +169,68 @@
@@ -2651,7 +2639,7 @@ index 83799c1..b2d3db2 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts b/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts
-index c6298b3..8fcab5f 100644
+index c6298b30..8fcab5f3 100644
 --- a/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts
 +++ b/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts
 @@ -15,2 +15,3 @@ import { safeIntl } from '../../../../../base/common/date.js';
@@ -2664,7 +2652,7 @@ index c6298b3..8fcab5f 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts b/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts
-index cacba31..7785734 100644
+index cacba319..77857347 100644
 --- a/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts
 +++ b/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts
 @@ -40,2 +40,3 @@ import { SelectionClipboardContributionID } from '../selectionClipboard.js';
@@ -2679,14 +2667,14 @@ index cacba31..7785734 100644
 +		lineHeight: FONT.sidebarSize20,
  		wordWrap: 'off',
 diff --git a/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts b/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts
-index b5234b6..b36e465 100644
+index 5162553b..5adbed8f 100644
 --- a/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts
 +++ b/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts
 @@ -43,2 +43,3 @@ import { MarshalledCommentThread, MarshalledCommentThreadInternal } from '../../
  import { IHoverService } from '../../../../platform/hover/browser/hover.js';
 +import { FONT } from '../../../../base/common/font.js';
  
-@@ -83,5 +84,5 @@ class CommentsModelVirtualDelegate implements IListVirtualDelegate<ResourceWithC
+@@ -84,5 +85,5 @@ class CommentsModelVirtualDelegate implements IListVirtualDelegate<ResourceWithC
  		if ((element instanceof CommentNode) && element.hasReply()) {
 -			return 44;
 +			return FONT.sidebarSize44;
@@ -2695,7 +2683,7 @@ index b5234b6..b36e465 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/breakpointsView.ts b/src/vs/workbench/contrib/debug/browser/breakpointsView.ts
-index 6f82df1..6c8ae0d 100644
+index 6f82df16..6c8ae0d6 100644
 --- a/src/vs/workbench/contrib/debug/browser/breakpointsView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/breakpointsView.ts
 @@ -63,2 +63,3 @@ import { equals } from '../../../../base/common/arrays.js';
@@ -2708,7 +2696,7 @@ index 6f82df1..6c8ae0d 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/callStackView.ts b/src/vs/workbench/contrib/debug/browser/callStackView.ts
-index 35c9c1e..f8bf9c5 100644
+index 35c9c1e5..f8bf9c5b 100644
 --- a/src/vs/workbench/contrib/debug/browser/callStackView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/callStackView.ts
 @@ -22,2 +22,3 @@ import { Event } from '../../../../base/common/event.js';
@@ -2729,7 +2717,7 @@ index 35c9c1e..f8bf9c5 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/callStackWidget.ts b/src/vs/workbench/contrib/debug/browser/callStackWidget.ts
-index 42e4cbe..bfaf21e 100644
+index 42e4cbeb..bfaf21e4 100644
 --- a/src/vs/workbench/contrib/debug/browser/callStackWidget.ts
 +++ b/src/vs/workbench/contrib/debug/browser/callStackWidget.ts
 @@ -13,2 +13,3 @@ import { Codicon } from '../../../../base/common/codicons.js';
@@ -2757,7 +2745,7 @@ index 42e4cbe..bfaf21e 100644
 -
  interface IAbstractFrameRendererTemplateData {
 diff --git a/src/vs/workbench/contrib/debug/browser/debugHover.ts b/src/vs/workbench/contrib/debug/browser/debugHover.ts
-index fe8ae2b..5830976 100644
+index fe8ae2b6..5830976e 100644
 --- a/src/vs/workbench/contrib/debug/browser/debugHover.ts
 +++ b/src/vs/workbench/contrib/debug/browser/debugHover.ts
 @@ -15,2 +15,3 @@ import { coalesce } from '../../../../base/common/arrays.js';
@@ -2770,7 +2758,7 @@ index fe8ae2b..5830976 100644
 +		return FONT.sidebarSize18;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts b/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts
-index 531c114..909a66d 100644
+index 531c1146..909a66db 100644
 --- a/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts
 @@ -14,2 +14,3 @@ import { Codicon } from '../../../../base/common/codicons.js';
@@ -2783,7 +2771,7 @@ index 531c114..909a66d 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css b/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css
-index ca34e6f..611b495 100644
+index ca34e6f7..611b4950 100644
 --- a/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css
 +++ b/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css
 @@ -55 +55,25 @@
@@ -2814,7 +2802,7 @@ index ca34e6f..611b495 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css b/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css
-index 4a627af..86f37c5 100644
+index 4a627af1..86f37c5a 100644
 --- a/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css
 +++ b/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css
 @@ -371 +371,103 @@
@@ -2923,7 +2911,7 @@ index 4a627af..86f37c5 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/debug/browser/variablesView.ts b/src/vs/workbench/contrib/debug/browser/variablesView.ts
-index f18d41b..8863b19 100644
+index f18d41bf..8863b19d 100644
 --- a/src/vs/workbench/contrib/debug/browser/variablesView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/variablesView.ts
 @@ -18,2 +18,3 @@ import { Codicon } from '../../../../base/common/codicons.js';
@@ -2936,7 +2924,7 @@ index f18d41b..8863b19 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts b/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts
-index f290f70..3269808 100644
+index f290f709..3269808a 100644
 --- a/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts
 @@ -42,2 +42,3 @@ import { watchExpressionsAdd, watchExpressionsRemoveAll } from './debugIcons.js'
@@ -2949,7 +2937,7 @@ index f290f70..3269808 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts b/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts
-index 3cd48a5..3238df4 100644
+index 3cd48a5b..3238df42 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts
 @@ -40,2 +40,3 @@ import { IHoverService } from '../../../../platform/hover/browser/hover.js';
@@ -2962,7 +2950,7 @@ index 3cd48a5..3238df4 100644
 +	getHeight() { return FONT.sidebarSize22; }
  	getTemplateId() { return 'extensionFeatureDescriptor'; }
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsList.ts b/src/vs/workbench/contrib/extensions/browser/extensionsList.ts
-index 42134f0..4e14bd1 100644
+index 42134f0b..4e14bd16 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsList.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsList.ts
 @@ -27,4 +27,3 @@ import { IActionViewItemOptions } from '../../../../base/browser/ui/actionbar/ac
@@ -2977,7 +2965,7 @@ index 42134f0..4e14bd1 100644
 +	getHeight() { return FONT.sidebarSize72; }
  	getTemplateId() { return 'extension'; }
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts b/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts
-index 418cb12..fbb30c5 100644
+index 418cb12e..fbb30c5c 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts
 @@ -40,2 +40,3 @@ import { ILogService } from '../../../../platform/log/common/log.js';
@@ -2990,7 +2978,7 @@ index 418cb12..fbb30c5 100644
 +		return FONT.sidebarSize62;
  	}
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts b/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts
-index 8bfac42..6430bf4 100644
+index 8bfac429..6430bf43 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts
 @@ -69,2 +69,3 @@ import { URI } from '../../../../base/common/uri.js';
@@ -3007,7 +2995,7 @@ index 8bfac42..6430bf4 100644
 +		const headerHeight = this.header && !!this.notificationContainer?.childNodes.length ? this.notificationContainer.clientHeight + searchBoxHeight + FONT.sidebarSize10 /*margin*/ : searchBoxHeight;
  		this.header!.style.height = `${headerHeight}px`;
 diff --git a/src/vs/workbench/contrib/extensions/browser/media/extension.css b/src/vs/workbench/contrib/extensions/browser/media/extension.css
-index 8454447..733b9a6 100644
+index 84544479..733b9a6b 100644
 --- a/src/vs/workbench/contrib/extensions/browser/media/extension.css
 +++ b/src/vs/workbench/contrib/extensions/browser/media/extension.css
 @@ -302 +302,91 @@
@@ -3104,7 +3092,7 @@ index 8454447..733b9a6 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css b/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css
-index 6326d45..cc5242a 100644
+index 6326d45f..cc5242ae 100644
 --- a/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css
 +++ b/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css
 @@ -166 +166,26 @@
@@ -3136,7 +3124,7 @@ index 6326d45..cc5242a 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css b/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css
-index db5712f..0f75b63 100644
+index db5712fe..0f75b632 100644
 --- a/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css
 +++ b/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css
 @@ -108 +108,24 @@
@@ -3166,7 +3154,7 @@ index db5712f..0f75b63 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/files/browser/views/explorerView.ts b/src/vs/workbench/contrib/files/browser/views/explorerView.ts
-index 5b11568..d276b5c 100644
+index 5b115684..d276b5c9 100644
 --- a/src/vs/workbench/contrib/files/browser/views/explorerView.ts
 +++ b/src/vs/workbench/contrib/files/browser/views/explorerView.ts
 @@ -511,3 +511,3 @@ export class ExplorerView extends ViewPane implements IExplorerView {
@@ -3175,7 +3163,7 @@ index 5b11568..d276b5c 100644
 +			paddingBottom: ExplorerDelegate.getHeight(),
  			overrideStyles: this.getLocationBasedColors().listOverrideStyles,
 diff --git a/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts b/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
-index ed7dbe0..dba05e8 100644
+index ed7dbe07..dba05e80 100644
 --- a/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 +++ b/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 @@ -76,2 +76,3 @@ import { listFilterMatchHighlight, listFilterMatchHighlightBorder } from '../../
@@ -3199,7 +3187,7 @@ index ed7dbe0..dba05e8 100644
 +			const offset = Math.max(39 - indent, 0); // derived via inspection
  			container.style.setProperty(`--vscode-explorer-align-offset-margin-left`, `${offset}px`);
 diff --git a/src/vs/workbench/contrib/files/browser/views/media/openeditors.css b/src/vs/workbench/contrib/files/browser/views/media/openeditors.css
-index d933ff9..3995b14 100644
+index d933ff97..3995b14f 100644
 --- a/src/vs/workbench/contrib/files/browser/views/media/openeditors.css
 +++ b/src/vs/workbench/contrib/files/browser/views/media/openeditors.css
 @@ -108 +108,28 @@
@@ -3233,7 +3221,7 @@ index d933ff9..3995b14 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts b/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts
-index 7229c14..33cae40 100644
+index 7229c14b..33cae40e 100644
 --- a/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts
 +++ b/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts
 @@ -58,2 +58,3 @@ import { IHoverService } from '../../../../../platform/hover/browser/hover.js';
@@ -3259,7 +3247,7 @@ index 7229c14..33cae40 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts b/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts
-index f16d9fa..3296abc 100644
+index f16d9fa5..3296abc7 100644
 --- a/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts
 +++ b/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts
 @@ -28,2 +28,3 @@ import { ExplorerFindProvider, FilesFilter } from '../../browser/views/explorerV
@@ -3272,7 +3260,7 @@ index f16d9fa..3296abc 100644
 +	getHeight() { return FONT.sidebarSize20; }
  	getTemplateId(element: ExplorerItem): string { return 'default'; }
 diff --git a/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts b/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts
-index 0176fb6..140cda1 100644
+index 0176fb67..140cda1d 100644
 --- a/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts
 +++ b/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts
 @@ -54,2 +54,3 @@ import type { IManagedHover } from '../../../../base/browser/ui/hover/hover.js';
@@ -3298,7 +3286,7 @@ index 0176fb6..140cda1 100644
 +				lineElement.style.height = `${FONT.sidebarSize22}px`;
  			}
 diff --git a/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts b/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts
-index 4c95a37..fcb18e0 100644
+index 4c95a373..fcb18e0e 100644
 --- a/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts
 +++ b/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts
 @@ -10,2 +10,3 @@ import { ITreeNode, ITreeRenderer } from '../../../../../../base/browser/ui/tree
@@ -3311,7 +3299,7 @@ index 4c95a37..fcb18e0 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts b/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts
-index d812034..e2affd5 100644
+index d812034b..e2affd59 100644
 --- a/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts
 +++ b/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts
 @@ -56,2 +56,3 @@ import { ILanguageFeaturesService } from '../../../../../../editor/common/servic
@@ -3324,7 +3312,7 @@ index d812034..e2affd5 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/preferences/browser/tocTree.ts b/src/vs/workbench/contrib/preferences/browser/tocTree.ts
-index 0078e1e..b40fa10 100644
+index 0078e1ea..b40fa10d 100644
 --- a/src/vs/workbench/contrib/preferences/browser/tocTree.ts
 +++ b/src/vs/workbench/contrib/preferences/browser/tocTree.ts
 @@ -11,2 +11,3 @@ import { RenderIndentGuides } from '../../../../base/browser/ui/tree/abstractTre
@@ -3337,7 +3325,7 @@ index 0078e1e..b40fa10 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts b/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts
-index b54812a..05e5f75 100644
+index b54812a0..05e5f75b 100644
 --- a/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts
 +++ b/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts
 @@ -35,2 +35,3 @@ import { Schemas } from '../../../../base/common/network.js';
@@ -3350,7 +3338,7 @@ index b54812a..05e5f75 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/remote/browser/remote.ts b/src/vs/workbench/contrib/remote/browser/remote.ts
-index 530b0c4..b3c979d 100644
+index 2d7e4bb9..f4a5a5c1 100644
 --- a/src/vs/workbench/contrib/remote/browser/remote.ts
 +++ b/src/vs/workbench/contrib/remote/browser/remote.ts
 @@ -57,2 +57,3 @@ import { mainWindow } from '../../../../base/browser/window.js';
@@ -3363,7 +3351,7 @@ index 530b0c4..b3c979d 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/scm/browser/media/scm.css b/src/vs/workbench/contrib/scm/browser/media/scm.css
-index 408b771..7ccc6b9 100644
+index 408b771f..7ccc6b93 100644
 --- a/src/vs/workbench/contrib/scm/browser/media/scm.css
 +++ b/src/vs/workbench/contrib/scm/browser/media/scm.css
 @@ -800 +800,215 @@
@@ -3584,7 +3572,7 @@ index 408b771..7ccc6b9 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts b/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts
-index ab1900f..5ea8f3c 100644
+index 88c5c132..cd2b3759 100644
 --- a/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts
 +++ b/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts
 @@ -77,2 +77,3 @@ import { IMarkdownRendererService } from '../../../../platform/markdown/browser/
@@ -3597,7 +3585,7 @@ index ab1900f..5ea8f3c 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts b/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts
-index 1523a82..fe78847 100644
+index 1523a82c..fe788478 100644
 --- a/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts
 +++ b/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts
 @@ -49,2 +49,3 @@ import { IActionViewItemProvider } from '../../../../base/browser/ui/actionbar/a
@@ -3610,7 +3598,7 @@ index 1523a82..fe78847 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/scm/browser/scmViewPane.ts b/src/vs/workbench/contrib/scm/browser/scmViewPane.ts
-index a2887d4..5e81511 100644
+index a2887d47..5e81511f 100644
 --- a/src/vs/workbench/contrib/scm/browser/scmViewPane.ts
 +++ b/src/vs/workbench/contrib/scm/browser/scmViewPane.ts
 @@ -77,2 +77,3 @@ import { AccessibilityCommandId } from '../../accessibility/common/accessibility
@@ -3656,7 +3644,7 @@ index a2887d4..5e81511 100644
 +			return FONT.sidebarSize22;
  		}
 diff --git a/src/vs/workbench/contrib/search/browser/media/searchview.css b/src/vs/workbench/contrib/search/browser/media/searchview.css
-index 47e85d6..977a4dc 100644
+index 47e85d64..977a4dc6 100644
 --- a/src/vs/workbench/contrib/search/browser/media/searchview.css
 +++ b/src/vs/workbench/contrib/search/browser/media/searchview.css
 @@ -443 +443,121 @@
@@ -3783,7 +3771,7 @@ index 47e85d6..977a4dc 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/search/browser/searchResultsView.ts b/src/vs/workbench/contrib/search/browser/searchResultsView.ts
-index 62d5db9..f86dba1 100644
+index 62d5db99..f86dba1f 100644
 --- a/src/vs/workbench/contrib/search/browser/searchResultsView.ts
 +++ b/src/vs/workbench/contrib/search/browser/searchResultsView.ts
 @@ -36,2 +36,3 @@ import { ISearchTreeMatch, isSearchTreeMatch, RenderableMatch, ITextSearchHeadin
@@ -3802,7 +3790,7 @@ index 62d5db9..f86dba1 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/search/browser/searchView.ts b/src/vs/workbench/contrib/search/browser/searchView.ts
-index fb52bbb..09ca311 100644
+index fb52bbb7..09ca3111 100644
 --- a/src/vs/workbench/contrib/search/browser/searchView.ts
 +++ b/src/vs/workbench/contrib/search/browser/searchView.ts
 @@ -87,2 +87,3 @@ import { ITelemetryService } from '../../../../platform/telemetry/common/telemet
@@ -3834,7 +3822,7 @@ index fb52bbb..09ca311 100644
 +		this.tree.layout(this.size.height - widgetHeight - messagesHeight, this.size.width - FONT.sidebarSize28);
  	}
 diff --git a/src/vs/workbench/contrib/search/browser/searchWidget.ts b/src/vs/workbench/contrib/search/browser/searchWidget.ts
-index e9c0fcd..f3e23de 100644
+index e9c0fcd4..f3e23de0 100644
 --- a/src/vs/workbench/contrib/search/browser/searchWidget.ts
 +++ b/src/vs/workbench/contrib/search/browser/searchWidget.ts
 @@ -47,5 +47,3 @@ import { IDisposable, MutableDisposable } from '../../../../base/common/lifecycl
@@ -3864,7 +3852,7 @@ index e9c0fcd..f3e23de 100644
 +			this.replaceInput.width = width - FONT.sidebarSize28;
  			this.replaceInput.inputBox.layout();
 diff --git a/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts b/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts
-index 21118dd..b5e53a1 100644
+index 21118dd7..b5e53a1d 100644
 --- a/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts
 +++ b/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts
 @@ -58,2 +58,3 @@ import { TerminalStorageKeys } from '../common/terminalStorageKeys.js';
@@ -3891,20 +3879,20 @@ index 21118dd..b5e53a1 100644
 +		inputBox.element.style.height = `${FONT.bottomPaneSize22}px`;
  		inputBox.value = value;
 diff --git a/src/vs/workbench/contrib/testing/browser/testCoverageView.ts b/src/vs/workbench/contrib/testing/browser/testCoverageView.ts
-index e19fc27..56e4bbc 100644
+index 02fdfa31..3bed1bbb 100644
 --- a/src/vs/workbench/contrib/testing/browser/testCoverageView.ts
 +++ b/src/vs/workbench/contrib/testing/browser/testCoverageView.ts
 @@ -16,2 +16,3 @@ import { memoize } from '../../../../base/common/decorators.js';
  import { FuzzyScore, createMatches } from '../../../../base/common/filters.js';
 +import { FONT } from '../../../../base/common/font.js';
  import { Iterable } from '../../../../base/common/iterator.js';
-@@ -429,3 +430,3 @@ class TestCoverageTreeListDelegate implements IListVirtualDelegate<CoverageTreeE
+@@ -440,3 +441,3 @@ class TestCoverageTreeListDelegate implements IListVirtualDelegate<CoverageTreeE
  	getHeight(element: CoverageTreeElement): number {
 -		return 22;
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts b/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts
-index 631bd2a..902bb81 100644
+index 631bd2a2..902bb810 100644
 --- a/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts
 +++ b/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts
 @@ -34,3 +34,2 @@ import { PANEL_BACKGROUND, SIDE_BAR_BACKGROUND } from '../../../../common/theme.
@@ -3921,20 +3909,20 @@ index 631bd2a..902bb81 100644
 +		let delta = Math.max(0, evt.scrollTop - (this.hasMultipleFrames ? FONT.sidebarSize24 : 0));
  		delta = Math.min(Math.max(0, this.contentHeight - this.viewHeight), delta);
 diff --git a/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts b/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts
-index 9257aa6..3819205 100644
+index 20d4dbdb..b48d2e90 100644
 --- a/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts
 +++ b/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts
 @@ -85,2 +85,3 @@ import { DebugLastRun, ReRunLastRun } from './testExplorerActions.js';
  import { TestingExplorerFilter } from './testingExplorerFilter.js';
 +import { FONT } from '../../../../base/common/font.js';
  
-@@ -1427,3 +1428,3 @@ class ListDelegate implements IListVirtualDelegate<TestExplorerTreeElement> {
+@@ -1431,3 +1432,3 @@ class ListDelegate implements IListVirtualDelegate<TestExplorerTreeElement> {
  	getHeight(element: TestExplorerTreeElement) {
 -		return element instanceof TestTreeErrorMessage ? 17 + 10 : 22;
 +		return element instanceof TestTreeErrorMessage ? FONT.sidebarSize17 + 10 : FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/timeline/browser/timelinePane.ts b/src/vs/workbench/contrib/timeline/browser/timelinePane.ts
-index c7c9cc7..84510c2 100644
+index 7219c099..7c6bc96c 100644
 --- a/src/vs/workbench/contrib/timeline/browser/timelinePane.ts
 +++ b/src/vs/workbench/contrib/timeline/browser/timelinePane.ts
 @@ -59,4 +59,3 @@ import { IHoverService, WorkbenchHoverDelegate } from '../../../../platform/hove
@@ -3948,13 +3936,13 @@ index c7c9cc7..84510c2 100644
 -			pageSize = Math.max(20, Math.floor((this.tree?.renderHeight ?? 0 / ItemHeight) + (this.pageOnScroll ? 1 : -1)));
 +			pageSize = Math.max(20, Math.floor((this.tree?.renderHeight ?? 0 / FONT.sidebarSize22) + (this.pageOnScroll ? 1 : -1)));
  		}
-@@ -1147,3 +1146,3 @@ export class TimelineListVirtualDelegate implements IListVirtualDelegate<TreeEle
+@@ -1148,3 +1147,3 @@ export class TimelineListVirtualDelegate implements IListVirtualDelegate<TreeEle
  	getHeight(_element: TreeElement): number {
 -		return ItemHeight;
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts b/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts
-index 27c6580..0feb646 100644
+index 27c65807..0feb6465 100644
 --- a/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts
 +++ b/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts
 @@ -17,2 +17,3 @@ import { localize } from '../../../../nls.js';
@@ -3967,7 +3955,7 @@ index 27c6580..0feb646 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts b/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts
-index 9e6ca13..478e4e7 100644
+index 0e3e5ccd..c7d20959 100644
 --- a/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts
 +++ b/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts
 @@ -49,3 +49,2 @@ import { AgentSessionsControl, IAgentSessionsControlOptions } from '../../chat/b
@@ -3978,12 +3966,12 @@ index 9e6ca13..478e4e7 100644
  import { ILogService } from '../../../../platform/log/common/log.js';
 +import { FONT } from '../../../../base/common/font.js';
  
-@@ -826,3 +826,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
+@@ -830,3 +830,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
  		);
 -		const sessionsHeight = visibleSessions * AgentSessionsListDelegate.ITEM_HEIGHT;
 +		const sessionsHeight = visibleSessions * FONT.sidebarSize22;
  		this.sessionsControl.layout(sessionsHeight, sessionsWidth);
-@@ -831,3 +831,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
+@@ -835,3 +835,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
  		// Visual height = ceil(n/2) * ITEM_HEIGHT, so offset = floor(n/2) * ITEM_HEIGHT
 -		const marginOffset = Math.floor(visibleSessions / 2) * AgentSessionsListDelegate.ITEM_HEIGHT;
 +		const marginOffset = Math.floor(visibleSessions / 2) * FONT.sidebarSize22;

patches/00-ui-disable-onboarding.patch

@@ -0,0 +1,35 @@
+diff --git a/src/vs/workbench/contrib/welcomeOnboarding/browser/welcomeOnboarding.contribution.ts b/src/vs/workbench/contrib/welcomeOnboarding/browser/welcomeOnboarding.contribution.ts
+index d725507e..a4a092d8 100644
+--- a/src/vs/workbench/contrib/welcomeOnboarding/browser/welcomeOnboarding.contribution.ts
++++ b/src/vs/workbench/contrib/welcomeOnboarding/browser/welcomeOnboarding.contribution.ts
+@@ -4,30 +4 @@
+  *--------------------------------------------------------------------------------------------*/
+-
+-// Load styles for the remaining onboarding variant.
+-import './media/variationA.css';
+-
+-import { localize2 } from '../../../../nls.js';
+-import { Categories } from '../../../../platform/action/common/actionCommonCategories.js';
+-import { Action2, registerAction2 } from '../../../../platform/actions/common/actions.js';
+-import { InstantiationType, registerSingleton } from '../../../../platform/instantiation/common/extensions.js';
+-import { ServicesAccessor } from '../../../../platform/instantiation/common/instantiation.js';
+-import { IOnboardingService } from '../common/onboardingService.js';
+-import { OnboardingVariationA } from './onboardingVariationA.js';
+-
+-registerSingleton(IOnboardingService, OnboardingVariationA, InstantiationType.Delayed);
+-
+-registerAction2(class extends Action2 {
+-	constructor() {
+-		super({
+-			id: 'workbench.action.welcomeOnboarding2026',
+-			title: localize2('welcomeOnboarding2026', "Welcome Onboarding 2026"),
+-			category: Categories.Developer,
+-			f1: true,
+-		});
+-	}
+-
+-	run(accessor: ServicesAccessor): void {
+-		const onboardingService = accessor.get(IOnboardingService);
+-		onboardingService.show();
+-	}
+-});

patches/00-vsce-use-custom-lib.patch

@@ -1,5 +1,5 @@
 diff --git a/build/.moduleignore b/build/.moduleignore
-index ed36151..022d6ed 100644
+index f83624f8..00779f06 100644
 --- a/build/.moduleignore
 +++ b/build/.moduleignore
 @@ -82,7 +82,7 @@ native-is-elevated/deps/**
@@ -16,30 +16,30 @@ index ed36151..022d6ed 100644
 +!@vscodium/vsce-sign/bin/**
  
 diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
-index 187726c..076f08b 100644
+index 080d97f3..180177c5 100644
 --- a/build/gulpfile.vscode.ts
 +++ b/build/gulpfile.vscode.ts
-@@ -449,3 +449,3 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
+@@ -460,3 +460,3 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
  				'**/*.wasm',
 -				'**/@vscode/vsce-sign/bin/*',
 +				'**/@vscodium/vsce-sign/bin/*',
  			], [
 diff --git a/build/lib/extensions.ts b/build/lib/extensions.ts
-index aacf25c..c4b0391 100644
+index a25395c9..d87ff9aa 100644
 --- a/build/lib/extensions.ts
 +++ b/build/lib/extensions.ts
-@@ -116,3 +116,3 @@ export function typeCheckExtensionStream(extensionPath: string, forWeb: boolean)
+@@ -126,3 +126,3 @@ export function typeCheckExtensionStream(extensionPath: string, forWeb: boolean)
  function fromLocalNormal(extensionPath: string): Stream {
 -	const vsce = require('@vscode/vsce') as typeof import('@vscode/vsce');
 +	const vsce = require('@vscodium/vsce') as typeof import('@vscodium/vsce');
  	const result = es.through();
-@@ -138,3 +138,3 @@ function fromLocalNormal(extensionPath: string): Stream {
+@@ -148,3 +148,3 @@ function fromLocalNormal(extensionPath: string): Stream {
  function fromLocalEsbuild(extensionPath: string, esbuildConfigFileName: string): Stream {
 -	const vsce = require('@vscode/vsce') as typeof import('@vscode/vsce');
 +	const vsce = require('@vscodium/vsce') as typeof import('@vscodium/vsce');
  	const result = es.through();
 diff --git a/build/package-lock.json b/build/package-lock.json
-index 644e16f..fac5de0 100644
+index 92f3b6a4..420464b0 100644
 --- a/build/package-lock.json
 +++ b/build/package-lock.json
 @@ -51,3 +51,3 @@
@@ -64,9 +64,9 @@ index 644e16f..fac5de0 100644
 +      }
 +    },
 +    "node_modules/@vscode/vsce/node_modules/brace-expansion": {
-+      "version": "5.0.4",
++      "version": "5.0.5",
-+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
++      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-+      "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
++      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
 +      "extraneous": true,
 +      "license": "MIT",
 +      "dependencies": {
@@ -260,7 +260,7 @@ index 644e16f..fac5de0 100644
      },
 -    "node_modules/@vscode/vsce/node_modules/brace-expansion": {
 +    "node_modules/@vscodium/vsce/node_modules/brace-expansion": {
-       "version": "5.0.4",
+       "version": "5.0.5",
 @@ -2172,3 +2065,3 @@
      },
 -    "node_modules/@vscode/vsce/node_modules/chalk": {
@@ -331,7 +331,7 @@ index 644e16f..fac5de0 100644
 -      }
 -    },
      "node_modules/@xmldom/xmldom": {
-@@ -7001,2 +6886,12 @@
+@@ -7022,2 +6907,12 @@
      },
 +    "node_modules/yazl": {
 +      "version": "2.5.1",
@@ -345,7 +345,7 @@ index 644e16f..fac5de0 100644
 +    },
      "node_modules/yocto-queue": {
 diff --git a/build/package.json b/build/package.json
-index 8a65120..a36d5c4 100644
+index 4746ea2f..49867df9 100644
 --- a/build/package.json
 +++ b/build/package.json
 @@ -45,3 +45,3 @@
@@ -354,7 +354,7 @@ index 8a65120..a36d5c4 100644
 +    "@vscodium/vsce": "3.6.1-258428",
      "ansi-colors": "^3.2.3",
 diff --git a/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts b/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts
-index 98535c5..cc37d7b 100644
+index 98535c5e..cc37d7b4 100644
 --- a/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts
 +++ b/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts
 @@ -69,3 +69,3 @@ export class ExtensionSignatureVerificationService implements IExtensionSignatur

patches/11-update-use-github-release.patch

@@ -1,14 +1,14 @@
 diff --git a/src/vs/platform/update/common/update.ts b/src/vs/platform/update/common/update.ts
-index bc90a03..f8885b9 100644
+index 92ae7b96..c3fe6214 100644
 --- a/src/vs/platform/update/common/update.ts
 +++ b/src/vs/platform/update/common/update.ts
-@@ -54,3 +54,4 @@ export const enum UpdateType {
+@@ -55,3 +55,4 @@ export const enum UpdateType {
  	Archive,
 -	Snap
 +	Snap,
 +	WindowsInstaller,
  }
-@@ -120 +121,38 @@ export interface IUpdateService {
+@@ -123 +124,38 @@ export interface IUpdateService {
  }
 +
 +export type Architecture =
@@ -49,17 +49,21 @@ index bc90a03..f8885b9 100644
 +	| "user";
 \ No newline at end of file
 diff --git a/src/vs/platform/update/electron-main/abstractUpdateService.ts b/src/vs/platform/update/electron-main/abstractUpdateService.ts
-index c943bca..1395594 100644
+index e13d1ba5..3767c907 100644
 --- a/src/vs/platform/update/electron-main/abstractUpdateService.ts
 +++ b/src/vs/platform/update/electron-main/abstractUpdateService.ts
-@@ -17,4 +17,4 @@ import { ILogService } from '../../log/common/log.js';
+@@ -17,3 +17,3 @@ import { ILogService } from '../../log/common/log.js';
  import { IProductService } from '../../product/common/productService.js';
 -import { IRequestService } from '../../request/common/request.js';
++import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
+ import { StorageScope, StorageTarget } from '../../storage/common/storage.js';
+@@ -21,3 +21,4 @@ import { IApplicationStorageMainService } from '../../storage/electron-main/stor
+ import { ITelemetryService } from '../../telemetry/common/telemetry.js';
 -import { AvailableForDownload, DisablementReason, IUpdateService, State, StateType, UpdateType } from '../common/update.js';
-+import { IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
++import { Architecture, AvailableForDownload, DisablementReason, IUpdate, IUpdateService, Platform, State, StateType, Target, UpdateType } from '../common/update.js';
-+import { Architecture, AvailableForDownload, DisablementReason, IUpdateService, Platform, State, StateType, Target, UpdateType } from '../common/update.js';
++import * as semver from 'semver';
  
-@@ -25,12 +25,8 @@ export interface IUpdateURLOptions {
+@@ -30,12 +31,8 @@ export interface IUpdateURLOptions {
  
 -export function createUpdateURL(baseUpdateUrl: string, platform: string, quality: string, commit: string, options?: IUpdateURLOptions): string {
 -	const url = new URL(`${baseUpdateUrl}/api/update/${platform}/${quality}/${commit}`);
@@ -77,30 +81,72 @@ index c943bca..1395594 100644
 -
 -	return url.toString();
  }
-@@ -322,3 +318,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+@@ -434,3 +431,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
  
 -		if (mode === 'none') {
 +		if (mode === 'none' || mode === 'manual') {
  			return undefined;
-@@ -336,3 +332,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+@@ -444,18 +441,37 @@ export abstract class AbstractUpdateService implements IUpdateService {
- 		try {
+ 
++		return this._isLatestVersion(url, false)
++			.then((result) => {
++				return Promise.resolve(result ? result.lastest : result);
++			})
++			.then(undefined, (error) => {
++				this.logService.error('update#isLatestVersion(): failed to check for updates');
++				this.logService.error(error);
++
++				return Promise.resolve(undefined);
++			});
++	}
++
++	_isLatestVersion(url: string, explicit: boolean): Promise<{lastest: boolean, update: IUpdate} | undefined> {
+ 		const headers = getUpdateRequestHeaders(this.productService.version);
+-		this.logService.trace('update#isLatestVersion() - checking update server', { url, headers });
+ 
+-		try {
 -			const context = await this.requestService.request({ url, headers, callSite: 'updateService.isLatestVersion' }, token);
-+			const context = await this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, token);
+-			const statusCode = context.res.statusCode;
- 			const statusCode = context.res.statusCode;
+-			this.logService.trace('update#isLatestVersion() - response', { statusCode });
+-			// The update server replies with 204 (No Content) when no
+-			// update is available - that's all we want to know.
+-			return statusCode === 204;
++		this.logService.info('update#isLatestVersion() - checking update server', { url, headers });
+ 
+-		} catch (error) {
+-			this.logService.error('update#isLatestVersion(): failed to check for updates');
+-			this.logService.error(error);
+-			return undefined;
+-		}
++		return this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
++			.then<IUpdate | null>(asJson)
++			.then(update => {
++				if (!update || !update.url || !update.version || !update.productVersion) {
++					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
++
++					return Promise.resolve(undefined);
++				}
++
++				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3');
++				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3');
++
++				this.logService.info('update#isLatestVersion() - found version', fetchedVersion, currentVersion);
++
++				const lastest = semver.compareBuild(currentVersion, fetchedVersion) >= 0;
++
++				return Promise.resolve({ lastest, update });
++			})
+ 	}
 diff --git a/src/vs/platform/update/electron-main/updateService.darwin.ts b/src/vs/platform/update/electron-main/updateService.darwin.ts
-index 40b38a2..323919e 100644
+index 3ddb310e..26738a64 100644
 --- a/src/vs/platform/update/electron-main/updateService.darwin.ts
 +++ b/src/vs/platform/update/electron-main/updateService.darwin.ts
 @@ -16,3 +16,3 @@ import { ILogService } from '../../log/common/log.js';
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
 +import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
- import { ITelemetryService } from '../../telemetry/common/telemetry.js';
+ import { IApplicationStorageMainService } from '../../storage/electron-main/storageMainService.js';
-@@ -22,2 +22,3 @@ import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdat
+@@ -101,15 +101,4 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
- import { INodeProcess } from '../../../base/common/platform.js';
-+import * as semver from 'semver';
- 
-@@ -99,15 +100,4 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string | undefined {
 -		const assetID = this.productService.darwinUniversalAssetId ?? (process.arch === 'x64' ? 'darwin' : 'darwin-arm64');
@@ -118,107 +164,130 @@ index 40b38a2..323919e 100644
 +	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string | undefined {
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch);
  	}
-@@ -154,3 +144,30 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+@@ -145,4 +134,30 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
- 		this.logService.trace('update#doCheckForUpdates - using Electron autoUpdater', { url, explicit, background });
+ 
+-		this.logService.trace('update#doCheckForUpdates - using Electron autoUpdater', { url, explicit, background });
 -		electron.autoUpdater.checkForUpdates();
-+		this.requestService.request({ url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
-+			.then<IUpdate | null>(asJson)
-+			.then(update => {
-+				if (!update || !update.url || !update.version || !update.productVersion) {
-+					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
 +
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
++				if(!result) {
 +					return Promise.resolve(null);
 +				}
 +
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
++				if(result.lastest) {
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
 +					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
 +				}
 +				else {
++					this.logService.info('update#doCheckForUpdates - using Electron autoUpdater');
++
 +					electron.autoUpdater.setFeedURL({ url });
 +					electron.autoUpdater.checkForUpdates();
 +				}
 +
 +				return Promise.resolve(null);
 +			})
-+			.then(undefined, err => {
++			.then(undefined, (error) => {
-+				this.logService.error(err);
++				this.logService.error(error);
++
 +				// only show message when explicitly checking for updates
-+				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
++
 +				this.setState(State.Idle(UpdateType.Setup, message));
 +			});
  	}
-@@ -167,3 +184,3 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+@@ -159,3 +174,3 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
  		try {
 -			const context = await this.requestService.request({ url, headers, callSite: 'updateService.darwin.checkForUpdates' }, CancellationToken.None);
 +			const context = await this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None);
  			const statusCode = context.res.statusCode;
 diff --git a/src/vs/platform/update/electron-main/updateService.linux.ts b/src/vs/platform/update/electron-main/updateService.linux.ts
-index 0eb5d74..8ce708e 100644
+index 2be53f61..8776a7f6 100644
 --- a/src/vs/platform/update/electron-main/updateService.linux.ts
 +++ b/src/vs/platform/update/electron-main/updateService.linux.ts
-@@ -13,5 +13,6 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
+@@ -5,3 +5,2 @@
+ 
+-import { CancellationToken } from '../../../base/common/cancellation.js';
+ import { IConfigurationService } from '../../configuration/common/configuration.js';
+@@ -13,6 +12,6 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
-+import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
++import { IRequestService } from '../../request/common/request.js';
- import { AvailableForDownload, IUpdate, State, UpdateType } from '../common/update.js';
+ import { IApplicationStorageMainService } from '../../storage/electron-main/storageMainService.js';
+ import { ITelemetryService } from '../../telemetry/common/telemetry.js';
+-import { AvailableForDownload, IUpdate, State, UpdateType } from '../common/update.js';
++import { AvailableForDownload, State, UpdateType } from '../common/update.js';
  import { AbstractUpdateService, createUpdateURL, IUpdateURLOptions } from './abstractUpdateService.js';
-+import * as semver from 'semver';
+@@ -36,4 +35,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
- 
-@@ -32,4 +33,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string {
 -		return createUpdateURL(this.productService.updateUrl!, `linux-${process.arch}`, quality, commit, options);
 +	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string {
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch);
  	}
-@@ -46,3 +47,3 @@ export class LinuxUpdateService extends AbstractUpdateService {
+@@ -45,2 +44,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
+ 
++		this.setState(State.CheckingForUpdates(explicit));
++
+ 		const internalOrg = this.getInternalOrg();
+@@ -48,17 +49,26 @@ export class LinuxUpdateService extends AbstractUpdateService {
+ 		const url = this.buildUpdateFeedUrl(this.quality, this.productService.commit!, { background, internalOrg });
+-		this.setState(State.CheckingForUpdates(explicit));
  
 -		this.requestService.request({ url, callSite: 'updateService.linux.checkForUpdates' }, CancellationToken.None)
-+		this.requestService.request({ url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
+-			.then<IUpdate | null>(asJson)
- 			.then<IUpdate | null>(asJson)
+-			.then(update => {
-@@ -51,5 +52,17 @@ export class LinuxUpdateService extends AbstractUpdateService {
+-				if (!update || !update.url || !update.version || !update.productVersion) {
- 					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
--				} else {
 +
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
++				if(!result) {
 +					return Promise.resolve(null);
 +				}
 +
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
++				if(result.lastest) {
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+ 					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
-+
+-				} else {
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
+-					this.setState(State.AvailableForDownload(update));
-+					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
-+				}
-+				else {
- 					this.setState(State.AvailableForDownload(update));
  				}
++				else {
++					this.setState(State.AvailableForDownload(result.update));
++				}
 +
 +				return Promise.resolve(null);
  			})
+-			.then(undefined, err => {
+-				this.logService.error(err);
++			.then(undefined, (error) => {
++				this.logService.error(error);
++
+ 				// only show message when explicitly checking for updates
+-				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
++
+ 				this.setState(State.Idle(UpdateType.Archive, message));
 diff --git a/src/vs/platform/update/electron-main/updateService.win32.ts b/src/vs/platform/update/electron-main/updateService.win32.ts
-index d02d7c3..4e8c541 100644
+index 222db559..0037e002 100644
 --- a/src/vs/platform/update/electron-main/updateService.win32.ts
 +++ b/src/vs/platform/update/electron-main/updateService.win32.ts
 @@ -14,3 +14,2 @@ import { CancellationToken, CancellationTokenSource } from '../../../base/common
  import { memoize } from '../../../base/common/decorators.js';
 -import { hash } from '../../../base/common/hash.js';
  import * as path from '../../../base/common/path.js';
-@@ -31,7 +30,8 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
+@@ -32,7 +31,7 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
-+import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
++import { IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
+ import { IApplicationStorageMainService } from '../../storage/electron-main/storageMainService.js';
  import { ITelemetryService } from '../../telemetry/common/telemetry.js';
 -import { AvailableForDownload, DisablementReason, IUpdate, State, StateType, UpdateType } from '../common/update.js';
 -import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdateURLOptions, UpdateErrorClassification } from './abstractUpdateService.js';
 +import { AvailableForDownload, DisablementReason, IUpdate, State, StateType, Target, UpdateType } from '../common/update.js';
-+import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdateURLOptions } from './abstractUpdateService.js';
++import { AbstractUpdateService, createUpdateURL, IUpdateURLOptions } from './abstractUpdateService.js';
- import { INodeProcess } from '../../../base/common/platform.js';
-+import * as semver from 'semver';
  
-@@ -49,5 +49,9 @@ function getUpdateType(): UpdateType {
+@@ -50,5 +49,9 @@ function getUpdateType(): UpdateType {
  	if (typeof _updateType === 'undefined') {
 -		_updateType = existsSync(path.join(path.dirname(process.execPath), 'unins000.exe'))
 -			? UpdateType.Setup
@@ -231,12 +300,12 @@ index d02d7c3..4e8c541 100644
 +			_updateType = UpdateType.Archive;
 +		}
  	}
-@@ -164,3 +168,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -158,3 +161,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  		} else {
 -			const fastUpdatesEnabled = this.configurationService.getValue('update.enableWindowsBackgroundUpdates');
 +			const fastUpdatesEnabled = getUpdateType() === UpdateType.Setup && this.configurationService.getValue('update.enableWindowsBackgroundUpdates');
  			// GC for background updates in system setup happens via inno_setup since it requires
-@@ -182,12 +186,22 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -178,12 +181,22 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string | undefined {
 -		let platform = `win32-${process.arch}`;
@@ -245,7 +314,7 @@ index d02d7c3..4e8c541 100644
 -			platform += '-archive';
 -		} else if (this.productService.target === 'user') {
 -			platform += '-user';
-+	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string | undefined {
++	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string {
 +		let target: Target;
 +
 +		switch (getUpdateType()) {
@@ -267,32 +336,60 @@ index d02d7c3..4e8c541 100644
 -		return createUpdateURL(this.productService.updateUrl!, platform, quality, commit, options);
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch, target);
  	}
-@@ -209,3 +223,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -195,6 +208,2 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
- 		const headers = getUpdateRequestHeaders(this.productService.version);
--		this.requestService.request({ url, headers, callSite: 'updateService.win32.checkForUpdates' }, CancellationToken.None)
-+		this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
- 			.then<IUpdate | null>(asJson)
-@@ -226,2 +240,10 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+-		const internalOrg = this.getInternalOrg();
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+-		const background = !explicit && !internalOrg;
+-		const url = this.buildUpdateFeedUrl(this.quality, pendingCommit ?? this.productService.commit!, { background, internalOrg });
+-
+ 		// Only set CheckingForUpdates if we're not already in Overwriting state
+@@ -204,9 +213,13 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 
+-		const headers = getUpdateRequestHeaders(this.productService.version);
+-		this.requestService.request({ url, headers, callSite: 'updateService.win32.checkForUpdates' }, CancellationToken.None)
+-			.then<IUpdate | null>(asJson)
+-			.then(update => {
++		const internalOrg = this.getInternalOrg();
++		const background = !explicit && !internalOrg;
++		const url = this.buildUpdateFeedUrl(this.quality, pendingCommit ?? this.productService.commit!, { background, internalOrg });
 +
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
++
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
+ 				const updateType = getUpdateType();
+ 
+-				if (!update || !update.url || !update.version || !update.productVersion) {
++				if(!result) {
+ 					// If we were checking for an overwrite update and found nothing newer,
+@@ -222,2 +235,9 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 
++				const { lastest, update } = result;
++
++				if(lastest) {
 +					this.setState(State.Idle(updateType, undefined, explicit || undefined));
 +					return Promise.resolve(null);
 +				}
 +
  				if (updateType === UpdateType.Archive) {
-@@ -258,3 +280,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -247,3 +267,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
 -							return this.requestService.request({ url: update.url, callSite: 'updateService.win32.downloadUpdate' }, CancellationToken.None)
 +							return this.requestService.request({ url: update.url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
  								.then(context => {
-@@ -304,3 +326,2 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -292,8 +312,7 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
- 			.then(undefined, err => {
+ 			})
+-			.then(undefined, err => {
 -				this.telemetryService.publicLog2<{ messageHash: string }, UpdateErrorClassification>('update:error', { messageHash: String(hash(String(err))) });
- 				this.logService.error(err);
+-				this.logService.error(err);
-@@ -368,20 +389,31 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
++			.then(undefined, (error) => {
++				this.logService.error(error);
+ 
+ 				// only show message when explicitly checking for updates
+-				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
+ 
+@@ -357,20 +376,31 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  		await pfs.Promises.writeFile(this.availableUpdate.updateFilePath, 'flag');
 -		const child = spawn(this.availableUpdate.packagePath,
 -			[

patches/12-update-add-cooldown.patch

@@ -0,0 +1,52 @@
+diff --git a/src/vs/platform/update/common/update.config.contribution.ts b/src/vs/platform/update/common/update.config.contribution.ts
+index 6061e15b..84246033 100644
+--- a/src/vs/platform/update/common/update.config.contribution.ts
++++ b/src/vs/platform/update/common/update.config.contribution.ts
+@@ -65,2 +65,8 @@ configurationRegistry.registerConfiguration({
+ 		},
++		'update.minReleaseAge': {
++			type: 'integer',
++			default: 7,
++			scope: ConfigurationScope.APPLICATION,
++			description: localize('update.cooldown', "Configure how old an update need to be before installing it (in days)."),
++		},
+ 		'update.enableWindowsBackgroundUpdates': {
+diff --git a/src/vs/platform/update/electron-main/abstractUpdateService.ts b/src/vs/platform/update/electron-main/abstractUpdateService.ts
+index 3767c907..9b3c17bf 100644
+--- a/src/vs/platform/update/electron-main/abstractUpdateService.ts
++++ b/src/vs/platform/update/electron-main/abstractUpdateService.ts
+@@ -470,3 +470,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+ 
+-				this.logService.info('update#isLatestVersion() - found version', fetchedVersion, currentVersion);
++				this.logService.info(`update#isLatestVersion() - found: ${fetchedVersion}, current: ${currentVersion}`);
+ 
+@@ -474,3 +474,28 @@ export abstract class AbstractUpdateService implements IUpdateService {
+ 
+-				return Promise.resolve({ lastest, update });
++				const minReleaseAge = this.configurationService.getValue<number>('update.minReleaseAge');
++
++				if(minReleaseAge === 0) {
++					return Promise.resolve({ lastest, update });
++				}
++
++				this.logService.info(`update#isLatestVersion() - ${update.timestamp} ${typeof update.timestamp}`);
++
++				const releaseDate = update.timestamp ? new Date(Number.parseInt(String(update.timestamp), 10)) : null;
++
++				this.logService.info(`update#isLatestVersion() - releaseDate: ${releaseDate}`);
++
++				if(!releaseDate || isNaN(releaseDate.getTime())) {
++					return Promise.resolve(undefined);
++				}
++
++				const age = Math.round(Math.abs(Date.now() - releaseDate.getTime()) / (1000 * 60 * 60 * 24));
++
++				this.logService.info(`update#isLatestVersion() - releaseAge: ${age}, minReleaseAge: ${minReleaseAge}`);
++
++				if(age >= minReleaseAge) {
++					return Promise.resolve({ lastest, update });
++				}
++				else {
++					return Promise.resolve(undefined);
++				}
+ 			})

patches/20-keymap-use-custom-lib.patch

@@ -1,5 +1,5 @@
 diff --git a/.npmrc b/.npmrc
-index a275846..87f881f 100644
+index 8255ca3e..98dc0d47 100644
 --- a/.npmrc
 +++ b/.npmrc
 @@ -6,2 +6,3 @@ ignore-scripts=false
@@ -7,7 +7,7 @@ index a275846..87f881f 100644
 +build_from_source_native_keymap="no"
  legacy-peer-deps="true"
 diff --git a/build/.moduleignore b/build/.moduleignore
-index ed36151..5b040cc 100644
+index f83624f8..aaa384bf 100644
 --- a/build/.moduleignore
 +++ b/build/.moduleignore
 @@ -65,7 +65,7 @@ fsevents/test/**
@@ -24,27 +24,27 @@ index ed36151..5b040cc 100644
 +!@vscodium/native-keymap/build/Release/*.node
  
 diff --git a/eslint.config.js b/eslint.config.js
-index 73f062a..f008259 100644
+index 51bda2c3..494a2c2c 100644
 --- a/eslint.config.js
 +++ b/eslint.config.js
-@@ -1481,3 +1481,3 @@ export default tseslint.config(
+@@ -1526,3 +1526,3 @@ export default tseslint.config(
  						'node:module',
 -						'native-keymap',
 +						'@vscodium/native-keymap',
  						'net',
 diff --git a/package-lock.json b/package-lock.json
-index bc72a21..ae566c1 100644
+index 75b98719..88c2aee4 100644
 --- a/package-lock.json
 +++ b/package-lock.json
-@@ -32,2 +32,3 @@
+@@ -39,2 +39,3 @@
          "@vscode/windows-registry": "^1.2.0",
 +        "@vscodium/native-keymap": "3.3.7-258424",
-         "@xterm/addon-clipboard": "^0.3.0-beta.191",
+         "@xterm/addon-clipboard": "^0.3.0-beta.197",
-@@ -49,3 +50,2 @@
+@@ -56,3 +57,2 @@
          "native-is-elevated": "0.9.0",
 -        "native-keymap": "^3.3.5",
-         "node-pty": "^1.2.0-beta.10",
+         "node-pty": "^1.2.0-beta.12",
-@@ -4862,2 +4862,9 @@
+@@ -4168,2 +4168,9 @@
      },
 +    "node_modules/@vscodium/native-keymap": {
 +      "version": "3.3.7-258424",
@@ -54,7 +54,7 @@ index bc72a21..ae566c1 100644
 +      "license": "MIT"
 +    },
      "node_modules/@wdio/config": {
-@@ -15159,5 +15166,6 @@
+@@ -14280,5 +14287,6 @@
      "node_modules/napi-build-utils": {
 -      "version": "1.0.2",
 -      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.2.tgz",
@@ -64,7 +64,7 @@ index bc72a21..ae566c1 100644
 +      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
 +      "license": "MIT"
      },
-@@ -15170,9 +15178,2 @@
+@@ -14291,9 +14299,2 @@
      },
 -    "node_modules/native-keymap": {
 -      "version": "3.3.9",
@@ -74,7 +74,7 @@ index bc72a21..ae566c1 100644
 -      "license": "MIT"
 -    },
      "node_modules/natural-compare": {
-@@ -16693,5 +16694,6 @@
+@@ -15805,5 +15806,6 @@
      "node_modules/prebuild-install": {
 -      "version": "7.1.2",
 -      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.2.tgz",
@@ -84,22 +84,22 @@ index bc72a21..ae566c1 100644
 +      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
 +      "license": "MIT",
        "dependencies": {
-@@ -16702,3 +16704,3 @@
+@@ -15814,3 +15816,3 @@
          "mkdirp-classic": "^0.5.3",
 -        "napi-build-utils": "^1.0.1",
 +        "napi-build-utils": "^2.0.0",
          "node-abi": "^3.3.0",
 diff --git a/package.json b/package.json
-index d727d5a..54d14ad 100644
+index b925a690..166f0cae 100644
 --- a/package.json
 +++ b/package.json
-@@ -119,3 +119,3 @@
+@@ -133,3 +133,3 @@
      "native-is-elevated": "0.9.0",
 -    "native-keymap": "^3.3.5",
 +    "@vscodium/native-keymap": "3.3.7-258424",
-     "node-pty": "^1.2.0-beta.10",
+     "node-pty": "^1.2.0-beta.12",
 diff --git a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
-index c30c6da..ca6cea2 100644
+index c30c6da5..ca6cea22 100644
 --- a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 +++ b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 @@ -44,8 +44,8 @@ flakySuite('Native Modules (all platforms)', () => {
@@ -116,7 +116,7 @@ index c30c6da..ca6cea2 100644
 +		assert.ok(result, testErrorMessage('@vscodium/native-keymap'));
  	});
 diff --git a/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts b/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts
-index 8950ce2..f31cea6 100644
+index 8950ce21..f31cea62 100644
 --- a/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts
 +++ b/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts
 @@ -5,3 +5,3 @@

patches/21-policy-use-custom-lib.patch

@@ -1,8 +1,8 @@
 diff --git a/build/.moduleignore b/build/.moduleignore
-index 5b040cc..8d5fd71 100644
+index aaa384bf..25adcdbf 100644
 --- a/build/.moduleignore
 +++ b/build/.moduleignore
-@@ -128,9 +128,11 @@ vsda/**
+@@ -153,9 +153,11 @@ vsda/**
  
 -@vscode/policy-watcher/build/**
 -@vscode/policy-watcher/.husky/**
@@ -22,7 +22,7 @@ index 5b040cc..8d5fd71 100644
 +!@vscodium/policy-watcher/build/Release/vscodium-policy-watcher.node
  
 diff --git a/build/lib/policies/basePolicy.ts b/build/lib/policies/basePolicy.ts
-index 7f650ba..db927cb 100644
+index 7f650ba7..db927cb4 100644
 --- a/build/lib/policies/basePolicy.ts
 +++ b/build/lib/policies/basePolicy.ts
 @@ -38,3 +38,3 @@ export abstract class BasePolicy implements Policy {
@@ -31,7 +31,7 @@ index 7f650ba..db927cb 100644
 +			`<policy name="${this.name}" class="Both" displayName="$(string.${this.name})" explainText="$(string.${this.name}_${this.description.nlsKey.replace(/\./g, '_')})" key="Software\\Policies\\!!ORG_NAME!!\\${regKey}" presentation="$(presentation.${this.name})">`,
  			`	<parentCategory ref="${this.category.name.nlsKey}" />`,
 diff --git a/build/lib/policies/render.ts b/build/lib/policies/render.ts
-index 47b485d..8437fd4 100644
+index 47b485d1..8437fd47 100644
 --- a/build/lib/policies/render.ts
 +++ b/build/lib/policies/render.ts
 @@ -49,3 +49,3 @@ export function renderADMX(regKey: string, versions: string[], categories: Categ
@@ -65,27 +65,27 @@ index 47b485d..8437fd4 100644
 +		<string>!!ORG_NAME!!</string>
  		<key>PayloadType</key>
 diff --git a/eslint.config.js b/eslint.config.js
-index f008259..f87fda1 100644
+index 494a2c2c..c53b46aa 100644
 --- a/eslint.config.js
 +++ b/eslint.config.js
-@@ -1464,3 +1464,3 @@ export default tseslint.config(
+@@ -1509,3 +1509,3 @@ export default tseslint.config(
  						'@vscode/native-watchdog',
 -						'@vscode/policy-watcher',
 +						'@vscodium/policy-watcher',
  						'@vscode/proxy-agent',
 diff --git a/package-lock.json b/package-lock.json
-index ae566c1..3b3a5dd 100644
+index 88c2aee4..d8852aa8 100644
 --- a/package-lock.json
 +++ b/package-lock.json
-@@ -21,3 +21,2 @@
+@@ -28,3 +28,2 @@
          "@vscode/native-watchdog": "^1.4.6",
 -        "@vscode/policy-watcher": "^1.3.2",
-         "@vscode/proxy-agent": "^0.39.1",
+         "@vscode/proxy-agent": "^0.41.0",
-@@ -33,2 +32,3 @@
+@@ -40,2 +39,3 @@
          "@vscodium/native-keymap": "3.3.7-258424",
 +        "@vscodium/policy-watcher": "^1.3.2-252465",
-         "@xterm/addon-clipboard": "^0.3.0-beta.191",
+         "@xterm/addon-clipboard": "^0.3.0-beta.197",
-@@ -4538,22 +4538,2 @@
+@@ -3844,22 +3844,2 @@
      },
 -    "node_modules/@vscode/policy-watcher": {
 -      "version": "1.3.7",
@@ -108,7 +108,7 @@ index ae566c1..3b3a5dd 100644
 -      }
 -    },
      "node_modules/@vscode/proxy-agent": {
-@@ -4869,2 +4849,22 @@
+@@ -4175,2 +4155,22 @@
      },
 +    "node_modules/@vscodium/policy-watcher": {
 +      "version": "1.3.2-255408",
@@ -132,16 +132,16 @@ index ae566c1..3b3a5dd 100644
 +    },
      "node_modules/@wdio/config": {
 diff --git a/package.json b/package.json
-index 54d14ad..47778c2 100644
+index 166f0cae..51cd5977 100644
 --- a/package.json
 +++ b/package.json
-@@ -91,3 +91,3 @@
+@@ -105,3 +105,3 @@
      "@vscode/native-watchdog": "^1.4.6",
 -    "@vscode/policy-watcher": "^1.3.2",
 +    "@vscodium/policy-watcher": "^1.3.2-252465",
-     "@vscode/proxy-agent": "^0.39.1",
+     "@vscode/proxy-agent": "^0.41.0",
 diff --git a/src/vs/base/test/node/uri.perf.data.txt b/src/vs/base/test/node/uri.perf.data.txt
-index ee0a24b..881ce36 100644
+index ee0a24b5..881ce36a 100644
 --- a/src/vs/base/test/node/uri.perf.data.txt
 +++ b/src/vs/base/test/node/uri.perf.data.txt
 @@ -14698,48 +14698,48 @@
@@ -240,7 +240,7 @@ index ee0a24b..881ce36 100644
 +/Users/example/node_modules/@vscodium/policy-watcher/src/windows/NumberPolicy.hh
  /Users/example/node_modules/@vscode/vscode-languagedetection/CODE_OF_CONDUCT.md
 diff --git a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
-index ca6cea2..32b22fe 100644
+index ca6cea22..32b22fed 100644
 --- a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 +++ b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 @@ -62,5 +62,5 @@ flakySuite('Native Modules (all platforms)', () => {
@@ -253,7 +253,7 @@ index ca6cea2..32b22fe 100644
 +		assert.ok(typeof watcher.createWatcher === 'function', testErrorMessage('@vscodium/policy-watcher'));
  	});
 diff --git a/src/vs/platform/policy/node/nativePolicyService.ts b/src/vs/platform/policy/node/nativePolicyService.ts
-index feb4ba1..4d9e0c3 100644
+index 6039dbb7..f2ea09cf 100644
 --- a/src/vs/platform/policy/node/nativePolicyService.ts
 +++ b/src/vs/platform/policy/node/nativePolicyService.ts
 @@ -8,3 +8,3 @@ import { IStringDictionary } from '../../../base/common/collections.js';
@@ -266,8 +266,8 @@ index feb4ba1..4d9e0c3 100644
 -		const { createWatcher } = await import('@vscode/policy-watcher');
 +		const { createWatcher } = await import('@vscodium/policy-watcher');
  
-@@ -31,3 +31,3 @@ export class NativePolicyService extends AbstractPolicyService implements IPolic
+@@ -32,3 +32,3 @@ export class NativePolicyService extends AbstractPolicyService implements IPolic
- 			try {
+ 				this.logService.trace(`Creating watcher for productName ${this.productName}`);
 -				this.watcher.value = createWatcher(this.productName, policyDefinitions, update => {
 +				this.watcher.value = createWatcher('VSCodium', this.productName, policyDefinitions, update => {
  					this._onDidPolicyChange(update);

patches/40-cli-use-reh-archive.patch

@@ -1,5 +1,5 @@
 diff --git a/cli/src/commands/serve_web.rs b/cli/src/commands/serve_web.rs
-index d3f7db8..988024b 100644
+index d3a9a88a..7cf60f0b 100644
 --- a/cli/src/commands/serve_web.rs
 +++ b/cli/src/commands/serve_web.rs
 @@ -756,3 +756,3 @@ impl ConnectionManager {
@@ -13,10 +13,10 @@ index d3f7db8..988024b 100644
 +			.join(args.release.quality.server_entrypoint().unwrap());
  
 diff --git a/cli/src/constants.rs b/cli/src/constants.rs
-index 1e277a8..97f17d3 100644
+index 9e2b066d..974ee57c 100644
 --- a/cli/src/constants.rs
 +++ b/cli/src/constants.rs
-@@ -35,3 +35,6 @@ pub const DOCUMENTATION_URL: Option<&'static str> = option_env!("VSCODE_CLI_DOCU
+@@ -37,3 +37,6 @@ pub const DOCUMENTATION_URL: Option<&'static str> = option_env!("VSCODE_CLI_DOCU
  pub const VSCODE_CLI_COMMIT: Option<&'static str> = option_env!("VSCODE_CLI_COMMIT");
 -pub const VSCODE_CLI_UPDATE_ENDPOINT: Option<&'static str> = option_env!("VSCODE_CLI_UPDATE_URL");
 +pub const VSCODE_CLI_UPDATE_ENDPOINT: Option<&'static str> = option_env!("VSCODE_CLI_UPDATE_ENDPOINT");
@@ -25,7 +25,7 @@ index 1e277a8..97f17d3 100644
 +pub const VSCODE_CLI_BINARY_NAME: Option<&'static str> = option_env!("VSCODE_CLI_BINARY_NAME");
  
 diff --git a/cli/src/options.rs b/cli/src/options.rs
-index 7d152c0..c0f2fb2 100644
+index 7d152c0e..c0f2fb2e 100644
 --- a/cli/src/options.rs
 +++ b/cli/src/options.rs
 @@ -9,3 +9,3 @@ use serde::{Deserialize, Serialize};
@@ -57,8 +57,17 @@ index 7d152c0..c0f2fb2 100644
 -		server_name
 +		Ok(server_name)
  	}
+diff --git a/cli/src/tunnels/agent_host.rs b/cli/src/tunnels/agent_host.rs
+index 9d1f240c..2e67da43 100644
+--- a/cli/src/tunnels/agent_host.rs
++++ b/cli/src/tunnels/agent_host.rs
+@@ -162,3 +162,3 @@ impl AgentHostManager {
+ 				.join("bin")
+-				.join(release.quality.server_entrypoint())
++				.join(release.quality.server_entrypoint().unwrap())
+ 		};
 diff --git a/cli/src/tunnels/code_server.rs b/cli/src/tunnels/code_server.rs
-index bbabadc..b454d0e 100644
+index bbabadcf..b454d0ea 100644
 --- a/cli/src/tunnels/code_server.rs
 +++ b/cli/src/tunnels/code_server.rs
 @@ -462,3 +462,3 @@ impl<'a> ServerBuilder<'a> {
@@ -67,7 +76,7 @@ index bbabadc..b454d0e 100644
 +							.join(self.server_params.release.quality.server_entrypoint().unwrap()),
  						&["--version"],
 diff --git a/cli/src/tunnels/paths.rs b/cli/src/tunnels/paths.rs
-index 3d7d718..98529bc 100644
+index 3d7d718a..98529bc6 100644
 --- a/cli/src/tunnels/paths.rs
 +++ b/cli/src/tunnels/paths.rs
 @@ -100,3 +100,3 @@ impl InstalledServer {
@@ -76,7 +85,7 @@ index 3d7d718..98529bc 100644
 +					.join(self.quality.server_entrypoint().unwrap())
  			},
 diff --git a/cli/src/update_service.rs b/cli/src/update_service.rs
-index 55f1dad..3b7ef5c 100644
+index 55f1dadc..3b7ef5c4 100644
 --- a/cli/src/update_service.rs
 +++ b/cli/src/update_service.rs
 @@ -10,3 +10,3 @@ use serde::{Deserialize, Serialize};
@@ -303,7 +312,7 @@ index 55f1dad..3b7ef5c 100644
 -
  	pub fn env_default() -> Option<Platform> {
 diff --git a/extensions/tunnel-forwarding/src/extension.ts b/extensions/tunnel-forwarding/src/extension.ts
-index 2f71999..e689f62 100644
+index 2f71999b..e689f628 100644
 --- a/extensions/tunnel-forwarding/src/extension.ts
 +++ b/extensions/tunnel-forwarding/src/extension.ts
 @@ -37,3 +37,3 @@ if (process.env.VSCODE_FORWARDING_IS_DEV) {

patches/50-build-improve-gulp-tasks.patch

@@ -0,0 +1,55 @@
+diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
+index 080d97f3..93b5f711 100644
+--- a/build/gulpfile.vscode.ts
++++ b/build/gulpfile.vscode.ts
+@@ -30,3 +30,3 @@ import { createAsar } from './lib/asar.ts';
+ import minimist from 'minimist';
+-import { compileBuildWithoutManglingTask, compileBuildWithManglingTask } from './gulpfile.compile.ts';
++import { compileBuildWithoutManglingTask } from './gulpfile.compile.ts';
+ import { compileNonNativeExtensionsBuildTask, compileNativeExtensionsBuildTask, compileAllExtensionsBuildTask, compileExtensionMediaBuildTask, cleanExtensionsBuildTask, compileCopilotExtensionBuildTask } from './gulpfile.extensions.ts';
+@@ -197,3 +197,2 @@ function runEsbuildBundle(outDir: string, minify: boolean, nls: boolean, target:
+ 			args.push('--minify');
+-			args.push('--mangle-privates');
+ 		}
+@@ -757,3 +756,4 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 			);
+-			vscodeTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}`, task.series(
++
++			const prepackTask = task.define(`vscode${dashed(minified)}-prepack`, task.series(
+ 				copyCodiconsTask,
+@@ -763,2 +763,6 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 				compileExtensionMediaBuildTask,
++			));
++			gulp.task(prepackTask);
++
++			const packingTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}-packing`, task.series(
+ 				writeISODate('out-build'),
+@@ -767,5 +771,11 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 			));
+-		} else {
++			gulp.task(packingTask);
++
+ 			vscodeTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}`, task.series(
+-				minified ? compileBuildWithManglingTask : compileBuildWithoutManglingTask,
++				prepackTask,
++				packingTask,
++			));
++		} else {
++			const prepackTask = task.define(`vscode${dashed(minified)}-prepack`, task.series(
++				compileBuildWithoutManglingTask,
+ 				cleanExtensionsBuildTask,
+@@ -775,4 +785,14 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 				minified ? minifyVSCodeTask : bundleVSCodeTask,
++			));
++			gulp.task(prepackTask);
++
++			const packingTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}-packing`, task.series(
+ 				vscodeTaskCI
+ 			));
++			gulp.task(packingTask);
++
++			vscodeTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}`, task.series(
++				prepackTask,
++				packingTask,
++			));
+ 		}

patches/disable-copilot.patch

@@ -1,133 +0,0 @@
-diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
-index 1998414..cdc533b 100644
---- a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
-+++ b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
-@@ -206,3 +206,4 @@ abstract class OpenChatGlobalAction extends Action2 {
- 				ChatContextKeys.Setup.hidden.negate(),
--				ChatContextKeys.Setup.disabled.negate()
-+				ChatContextKeys.Setup.disabled.negate(),
-+				ContextKeyExpr.has('config.chat.disableAIFeatures').negate()
- 			)
-@@ -1142,3 +1143,3 @@ export function registerChatActions() {
- 				precondition: ContextKeyExpr.and(
--					ChatContextKeys.Setup.installed,
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 					ChatContextKeys.Setup.disabled.negate(),
-@@ -1715,3 +1716,4 @@ MenuRegistry.appendMenuItem(MenuId.EditorContext, {
- 		ChatContextKeys.Setup.hidden.negate(),
--		ChatContextKeys.Setup.disabled.negate()
-+		ChatContextKeys.Setup.disabled.negate(),
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate()
- 	)
-diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
-index b8c8e03..512e40f 100644
---- a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
-+++ b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
-@@ -314,3 +314,4 @@ class AttachSelectionToChatAction extends Action2 {
- 						ResourceContextKey.Scheme.isEqualTo(Schemas.vscodeUserData)
--					)
-+					),
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 				)
-diff --git a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
-index be62dda..7b5f1ed 100644
---- a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
-@@ -1237,3 +1237,3 @@ configurationRegistry.registerConfiguration({
- 			description: nls.localize('chat.disableAIFeatures', "Disable and hide built-in AI features provided by GitHub Copilot, including chat and inline suggestions."),
--			default: false,
-+			default: true,
- 			scope: ConfigurationScope.WINDOW
-diff --git a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
-index ddb5df4..7831288 100644
---- a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
-@@ -70,10 +70,9 @@ const chatViewDescriptor: IViewDescriptor = {
- 	ctorDescriptor: new SyncDescriptor(ChatViewPane),
--	when: ContextKeyExpr.or(
--		ContextKeyExpr.or(
--			ChatContextKeys.Setup.hidden,
--			ChatContextKeys.Setup.disabled
--		)?.negate(),
--		ChatContextKeys.panelParticipantRegistered,
--		ChatContextKeys.extensionInvalid
--	)
-+	when: ContextKeyExpr.and(
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
-+		ChatContextKeys.Setup.disabled.negate(),
-+		ChatContextKeys.Setup.hidden.negate(),
-+ 		ChatContextKeys.panelParticipantRegistered,
-+		ChatContextKeys.extensionInvalid.negate()
-+ 	)
- };
-diff --git a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
-index 4a71579..f8b3e83 100644
---- a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
-@@ -228,2 +228,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
- 						ChatContextKeys.Setup.untrusted,
-+						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 						ChatContextKeys.Setup.installed.negate(),
-@@ -346,2 +347,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
- 							ChatContextKeys.Setup.hidden.negate(),
-+							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 							ChatContextKeys.Setup.installed.negate(),
-@@ -518,2 +520,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
- 			ChatContextKeys.Setup.disabled.negate(),
-+			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 			ChatContextKeys.Setup.installed.negate(),
-diff --git a/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts b/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts
-index c8fc17b..fbd2afd 100644
---- a/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts
-+++ b/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts
-@@ -163,3 +163,3 @@ export namespace ChatContextKeyExprs {
- 	export const chatSetupTriggerContext = ContextKeyExpr.or(
--		ChatContextKeys.Setup.installed.negate(),
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 		ChatContextKeys.Entitlement.canSignUp
-diff --git a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
-index e9b4077..b33d6f2 100644
---- a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
-+++ b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
-@@ -133,3 +133,9 @@ MenuRegistry.appendMenuItem(MenuId.InlineChatEditorAffordance, {
- 	order: 1,
--	when: ContextKeyExpr.and(EditorContextKeys.writable, EditorContextKeys.hasNonEmptySelection, CTX_INLINE_CHAT_FILE_BELONGS_TO_CHAT.negate(), ChatEntitlementContextKeys.Setup.hidden.negate()),
-+	when: ContextKeyExpr.and(
-+		EditorContextKeys.writable,
-+		EditorContextKeys.hasNonEmptySelection,
-+		CTX_INLINE_CHAT_FILE_BELONGS_TO_CHAT.negate(),
-+		ChatEntitlementContextKeys.Setup.hidden.negate(),
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
-+	),
- 	command: {
-diff --git a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
-index 864cc4f..b877a8e 100644
---- a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
-+++ b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
-@@ -554,3 +554,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
- 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{}]),
--				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
-+				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
- 				weight: 40,
-@@ -569,3 +569,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
- 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{ showWelcome: true }]),
--				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
-+				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
- 				weight: 40,
-diff --git a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
-index 8f2ea73..429e28f 100644
---- a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
-+++ b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
-@@ -705,3 +705,3 @@ registerAction2(class extends Action2 {
- 					ChatContextKeys.Setup.disabled.negate(),
--					ChatContextKeys.Setup.installed.negate(),
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 					ContextKeyExpr.in(ResourceContextKey.Resource.key, 'git.mergeChanges'),
-diff --git a/src/vs/workbench/contrib/scm/browser/scmInput.ts b/src/vs/workbench/contrib/scm/browser/scmInput.ts
-index a35d479..da5a449 100644
---- a/src/vs/workbench/contrib/scm/browser/scmInput.ts
-+++ b/src/vs/workbench/contrib/scm/browser/scmInput.ts
-@@ -850,2 +850,3 @@ registerAction2(class extends Action2 {
- 					ChatContextKeys.Setup.disabled.negate(),
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 					ChatContextKeys.Setup.installed.negate(),

patches/insider/system-extensions.patch

@@ -1,13 +1,13 @@
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts b/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-index 150908a..0759a8d 100644
+index 58422886..a1eac31e 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -104,2 +104,3 @@ export class Extension implements IExtension {
+@@ -112,2 +112,3 @@ export class Extension implements IExtension {
  		@IFileService private readonly fileService: IFileService,
 +		// @ts-ignore
  		@IProductService private readonly productService: IProductService
-@@ -325,3 +326,3 @@ export class Extension implements IExtension {
+@@ -341,3 +342,3 @@ export class Extension implements IExtension {
  			// Do not allow updating system extensions in stable
--			if (this.type === ExtensionType.System && this.productService.quality === 'stable') {
+-			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
-+			if (this.type === ExtensionType.System) {
++			if (this.type === ExtensionType.System && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
  				return false;