ci: re-set 180 days-before-stale

.github/dependabot.yml

@@ -1,12 +1,9 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: github-actions
-    directory: "/"
+    directory: /
     target-branch: insider
     schedule:
-      interval: "weekly"
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci-build-linux.yml

@@ -0,0 +1,371 @@
+name: CI - Build - Linux
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  DISABLE_UPDATE: yes
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: linux
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: ubuntu-22.04
+    env:
+      VSCODE_ARCH: x64
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+          image: vscodium/vscodium-linux-build-agent:focal-x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+          image: vscodium/vscodium-linux-build-agent:focal-arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+          image: vscodium/vscodium-linux-build-agent:focal-armhf
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+          image: vscodium/vscodium-linux-build-agent:focal-riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+          image: vscodium/vscodium-linux-build-agent:crimson-loong64
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+          image: vscodium/vscodium-linux-build-agent:focal-ppc64le
+    container:
+      image: ${{ matrix.image }}
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_APP_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install dependencies
+        run: ./build/linux/deps.sh
+        if: env.DISABLED != 'yes'
+
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes'
+
+      - name: Build
+        id: build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_bin.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Prepare assets
+        env:
+          SHOULD_BUILD_APPIMAGE: ${{ vars[format('DISABLE_{0}_APPIMAGE', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] == 'yes' && 'no' || 'yes' }}
+          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
+        run: ./prepare_assets.sh
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_linux:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+        - slug: S390X
+          vscode_arch: s390x
+          npm_arch: s390x
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.DISABLED != 'yes'
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-linux-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_alpine:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_ALPINE_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      OS_NAME: alpine
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/alpine/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-alpine-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-macos.yml

@@ -0,0 +1,90 @@
+name: CI - Build - macOS
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ${{ matrix.runner }}
+    env:
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-intel
+            vscode_arch: x64
+          - runner: [self-hosted, macOS, ARM64]
+            vscode_arch: arm64
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: . get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.VSCODE_ARCH == 'x64'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-windows.yml

@@ -0,0 +1,164 @@
+name: CI - Build - Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: windows
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: windows-2022
+    defaults:
+      run:
+        shell: bash
+    env:
+      VSCODE_ARCH: 'x64'
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        vscode_arch:
+          - x64
+          - arm64
+    defaults:
+      run:
+        shell: bash
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+
+      - name: Build
+        env:
+          DISABLE_MSI: ${{ vars[format('DISABLE_{0}_MSI', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.vscode_arch }}
+          npm_config_target_arch: ${{ matrix.vscode_arch }}
+        run: ./build/windows/package.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Prepare checksums
+        run: ./prepare_checksums.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: github.event.inputs.generate_assets == 'true'

.github/workflows/insider-spearhead.yml

@@ -1,98 +0,0 @@
-name: insider-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-      dont_dispatch:
-        type: boolean
-        description: Disable dispatch
-  schedule:
-    - cron: '0 7 * * *'
-
-jobs:
-  build:
-    runs-on: macos-15
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}-insiders
-      BINARY_NAME: codium-insiders
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: insider
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: insider
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload sourcemaps
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./upload_sourcemaps.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v4
-        with:
-          event-type: insider
-        if: github.event.inputs.dont_dispatch != 'true' && (env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true')

.github/workflows/lint-zizmor.yml

@@ -0,0 +1,30 @@
+name: Lint - zizmor
+
+on:
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2

.github/workflows/lock.yml

@@ -1,17 +0,0 @@
-name: Lock Closed Threads
-
-on:
-  schedule:
-    - cron: '0 2 * * *'
-
-jobs:
-  lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/lock-threads@v6
-        with:
-          github-token: ${{ github.token }}
-          issue-inactive-days: '90'
-          pr-inactive-days: '90'
-          discussion-inactive-days: '90'
-          log-output: true

.github/workflows/mod-lock-closed-threads.yml

@@ -0,0 +1,22 @@
+name: Moderation - Lock Closed Threads
+
+on:
+  schedule:
+    - cron: 0 2 * * *
+
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: "90"
+          pr-inactive-days: "90"
+          discussion-inactive-days: "90"
+          log-output: true

.github/workflows/mod-stale-issue-pr.yml

@@ -0,0 +1,24 @@
+name: Moderation - Stale Issues & PR
+
+on:
+  schedule:
+    - cron: 0 1 * * *
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          days-before-stale: 180
+          days-before-close: 30
+          operations-per-run: 1024
+          stale-issue-message: This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
+          close-issue-message: This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
+          exempt-issue-labels: discussion,never-stale
+          stale-pr-message: This PR has been automatically marked as stale.
+          close-pr-message: This PR has been closed due to inactivity, and will not be monitored.
+          only-pr-labels: needs-information

.github/workflows/publish-insider-linux.yml

@@ -1,37 +1,19 @@
-name: insider-linux
+name: Publish - Insider - Linux
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [insider]
+    types:
-  push:
+      - publish-insider
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -40,77 +22,66 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -123,8 +94,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +108,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +120,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -185,29 +159,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -221,16 +188,17 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Build
+        id: build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
@@ -241,37 +209,34 @@ jobs:
         env:
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -304,37 +269,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -345,7 +304,7 @@ jobs:
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -355,38 +314,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -405,34 +359,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -445,45 +393,38 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium-insiders-bin
         - package_name: vscodium-insiders
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
 
     steps:
       - name: Get version
@@ -492,7 +433,7 @@ jobs:
         run: echo "PACKAGE_VERSION=${RELEASE_VERSION/-*/}" >> "${GITHUB_ENV}"
 
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_version: ${{ env.PACKAGE_VERSION }}
@@ -505,6 +446,9 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium-insiders
@@ -514,21 +458,17 @@ jobs:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
-      - name: Switch to relevant branch
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
-
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
         with:
           path: stores/snapcraft/insider
           architecture: ${{ matrix.platform }}
@@ -539,7 +479,7 @@ jobs:
       #     snap: ${{ steps.build.outputs.snap }}
       #     isClassic: 'true'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -551,11 +491,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-insider-macos.yml

@@ -1,35 +1,17 @@
-name: insider-macos
+name: Publish - Insider - macOS
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [insider]
+    types:
-  push:
+      - publish-insider
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,6 +20,9 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
@@ -50,39 +35,29 @@ jobs:
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -98,30 +73,21 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-insider-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Insider - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 7 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}-insiders
+  BINARY_NAME: codium-insiders
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: insider
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-insider
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-insider-windows.yml

@@ -1,35 +1,17 @@
-name: insider-windows
+name: Publish - Insider - Windows
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [insider]
+    types:
-  push:
+      - publish-insider
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,41 +20,33 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: windows-2022
+    permissions: {}
     defaults:
       run:
         shell: bash
@@ -80,52 +54,38 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      # - name: Setup GCC
-      #   uses: egor-tensin/setup-gcc@v1
-      #   with:
-      #     version: 10
-      #     platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
-      # - name: Install libkrb5-dev
-      #   run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
-      #   if: env.SHOULD_BUILD == 'yes'
-
       - name: Clone VSCode repo
         run: ./get_repo.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -138,11 +98,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -150,6 +110,9 @@ jobs:
       - check
       - compile
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -164,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -203,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -218,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -242,52 +198,46 @@ jobs:
           artifact-configuration-slug: ${{ matrix.vscode_arch }}
           wait-for-completion: true
           # 3h to manually approve the request
-          wait-for-completion-timeout-in-seconds: 10800
+          wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   winget:
     needs: build
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium.Insiders
       ASSETS_REPOSITORY: vscodium-insiders
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -295,7 +245,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/publish-stable-linux.yml

@@ -1,36 +1,19 @@
-name: stable-linux
+name: Publish - Stable - Linux
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [stable]
+    types:
-  push:
+      - publish-stable
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -39,79 +22,67 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
+          FORCE_LINUX_SNAP: ${{ github.event.inputs.force_snap }}
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -124,8 +95,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -138,11 +109,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -150,6 +121,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -186,29 +160,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-        if: env.DISABLED != 'yes'
-
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -222,16 +189,17 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Build
+        id: build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
@@ -242,37 +210,34 @@ jobs:
         env:
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -305,37 +270,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -346,7 +305,7 @@ jobs:
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -356,38 +315,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -406,34 +360,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -446,51 +394,42 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium
           package_type: stable
-        # - package_name: vscodium-git
-        #   package_type: rolling
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_type: ${{ matrix.package_type }}
@@ -503,26 +442,25 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium
+      SNAP_PUBLISHER: vscodium
     strategy:
       fail-fast: false
       matrix:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Check version
         env:
@@ -532,23 +470,21 @@ jobs:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         run: ./stores/snapcraft/check_version.sh
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-        if: env.SHOULD_BUILD == 'yes'
 
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
         with:
           path: stores/snapcraft/stable
           architecture: ${{ matrix.platform }}
         id: build
-        if: env.SHOULD_BUILD == 'yes'
 
-      - uses: diddlesnaps/snapcraft-review-action@v1
+      - uses: diddlesnaps/snapcraft-review-action@40554b42331cf84dab19ef98c382620427f13482 # v1.3.1
         with:
           snap: ${{ steps.build.outputs.snap }}
           isClassic: 'true'
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes' || env.SHOULD_DEPLOY_TO_STORE == 'yes'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -556,7 +492,7 @@ jobs:
           tag: ${{ env.RELEASE_VERSION }}
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes'
 
-      - uses: snapcore/action-publish@master
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         with:
@@ -569,7 +505,8 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
@@ -582,11 +519,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-stable-macos.yml

@@ -1,34 +1,17 @@
-name: stable-macos
+name: Publish - Stable - macOS
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [stable]
+    types:
-  push:
+      - publish-stable
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,6 +20,9 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
@@ -49,39 +35,29 @@ jobs:
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -97,29 +73,20 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-stable-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Stable - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 18 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}
+  BINARY_NAME: codium
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: stable
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-stable
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-stable-windows.yml

@@ -1,34 +1,17 @@
-name: stable-windows
+name: Publish - Stable - Windows
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
   repository_dispatch:
-    types: [stable]
+    types:
-  push:
+      - publish-stable
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,41 +20,33 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
+          persist-credentials: false
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: windows-2022
+    permissions: {}
     defaults:
       run:
         shell: bash
@@ -79,52 +54,38 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      VSCODE_ARCH: 'x64'
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      # - name: Setup GCC
-      #   uses: egor-tensin/setup-gcc@v1
-      #   with:
-      #     version: 10
-      #     platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
-      # - name: Install libkrb5-dev
-      #   run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
-      #   if: env.SHOULD_BUILD == 'yes'
-
       - name: Clone VSCode repo
         run: ./get_repo.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH: no
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +98,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +110,9 @@ jobs:
       - check
       - compile
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -163,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
+          persist-credentials: false
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -202,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -217,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -243,48 +200,42 @@ jobs:
           # 8h to manually approve the request
           wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
 
   winget:
     needs: build
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -292,7 +243,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/stable-spearhead.yml

@@ -1,93 +0,0 @@
-name: stable-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-  schedule:
-    - cron: '0 18 * * *'
-
-jobs:
-  build:
-    runs-on: macos-15
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}
-      BINARY_NAME: codium
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: stable
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload sourcemaps
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./upload_sourcemaps.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v4
-        with:
-          event-type: stable
-        if: env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true'

.github/workflows/stale.yml

@@ -1,25 +0,0 @@
-name: Stale Issues
-
-on:
-  schedule:
-    - cron: '0 1 * * *'
-
-permissions:
-  issues: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v10
-        with:
-          days-before-stale: 180
-          days-before-close: 30
-          stale-issue-label: stale
-          operations-per-run: 1024
-          stale-issue-message: >
-            This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
-          close-issue-message: >
-            This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
-          exempt-issue-labels: discussion,never-stale
-          only-pr-labels: needs-information

build/alpine/check_tags.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+  if [[ -z $( contains "${APP_NAME_LC}-reh-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Alpine ${VSCODE_ARCH} because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Alpine REH ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Alpine ${VSCODE_ARCH} because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Alpine REH-web ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+else
+
+  # alpine-arm64
+  if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine arm64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine arm64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+  fi
+
+  # alpine-x64
+  if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine x64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine x64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+  fi
+fi

build/linux/check_tags.sh

@@ -0,0 +1,345 @@
+#!/usr/bin/env bash
+
+if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Linux ${VSCODE_ARCH} because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Linux REH ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Linux ${VSCODE_ARCH} because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Linux REH-web ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+
+else
+
+  # linux-arm64
+  if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "arm64.deb" ) ]]; then
+      echo "Building on Linux arm64 because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "aarch64.rpm" ) ]]; then
+      echo "Building on Linux arm64 because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ -z $( contains "arm64.snap" ) || "${FORCE_LINUX_SNAP}" == "true" ]]; then
+      echo "Building on Linux arm64 because we have no SNAP"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_SNAP="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux arm64 builds"
+    fi
+  fi
+
+  # linux-armhf
+  if [[ "${VSCODE_ARCH}" == "armhf" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "armhf.deb" ) ]]; then
+      echo "Building on Linux arm because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "armv7hl.rpm" ) ]]; then
+      echo "Building on Linux arm because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux arm builds"
+    fi
+  fi
+
+  # linux-ppc64le
+  if [[ "${VSCODE_ARCH}" == "ppc64le" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "ppc64el.deb" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "ppc64le.rpm" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux PowerPC64LE builds"
+    fi
+  fi
+
+  # linux-riscv64
+  if [[ "${VSCODE_ARCH}" == "riscv64" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_DEB="no"
+    export SHOULD_BUILD_RPM="no"
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME}-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux riscv64 builds"
+    fi
+  fi
+
+  # linux-loong64
+  if [[ "${VSCODE_ARCH}" == "loong64" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_DEB="no"
+    export SHOULD_BUILD_RPM="no"
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME}-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux Loong64 builds"
+    fi
+  fi
+
+  # linux-s390x
+  if [[ "${VSCODE_ARCH}" == "s390x" || "${CHECK_ALL}" == "yes" ]]; then
+    SHOULD_BUILD_APPIMAGE="no"
+    SHOULD_BUILD_DEB="no"
+    SHOULD_BUILD_RPM="no"
+    SHOULD_BUILD_TAR="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-reh-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux s390x because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux s390x because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux s390x builds"
+    fi
+  fi
+
+  # linux-x64
+  if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "amd64.deb" ) ]]; then
+      echo "Building on Linux x64 because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "x86_64.rpm" ) ]]; then
+      echo "Building on Linux x64 because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${DISABLE_APPIMAGE}" == "yes" ]]; then
+      export SHOULD_BUILD_APPIMAGE="no"
+    elif [[ -z $( contains "x86_64.AppImage" ) ]]; then
+      echo "Building on Linux x64 because we have no AppImage"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_APPIMAGE="no"
+    fi
+
+    if [[ -z $( contains "amd64.snap" ) || "${FORCE_LINUX_SNAP}" == "true" ]]; then
+      echo "Building on Linux x64 because we have no SNAP"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_SNAP="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux x64 builds"
+    fi
+  fi
+fi

build/linux/package_bin.sh

@@ -26,10 +26,12 @@ if [[ "${VSCODE_ARCH}" == "arm64" || "${VSCODE_ARCH}" == "armhf" ]]; then
 elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20240129-253798'
+  export VSCODE_SYSROOT_PREFIX="-glibc-2.28"
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
   export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_ELECTRON_REPOSITORY='lex-ibm/electron-ppc64le-build-scripts'
+  export IGNORE_ELECTRON_VERSION="yes"
 elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
   export VSCODE_ELECTRON_REPOSITORY='riscv-forks/electron-riscv-releases'
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
@@ -56,7 +58,7 @@ if [[ -f "../build/linux/${VSCODE_ARCH}/electron.sh" ]]; then
   TARGET=$( npm config get target )
 
   # Only fails at different major versions
-  if [[ "${ELECTRON_VERSION%%.*}" != "${TARGET%%.*}" ]]; then
+  if [[ "${ELECTRON_VERSION%%.*}" != "${TARGET%%.*}" ]] && [[ "${IGNORE_ELECTRON_VERSION}" != "yes" ]]; then
     # Fail the pipeline if electron target doesn't match what is used.
     echo "Electron ${VSCODE_ARCH} binary version doesn't match target electron version!"
     echo "Releases available at: https://github.com/${VSCODE_ELECTRON_REPOSITORY}/releases"
@@ -144,4 +146,10 @@ find "../VSCode-linux-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 
 . ../build_cli.sh
 
+if [[ -n "${GITHUB_OUTPUT}" ]]; then
+  echo "VSCODE_SYSROOT_REPOSITORY=${VSCODE_SYSROOT_REPOSITORY:-}" >> "${GITHUB_OUTPUT}"
+  echo "VSCODE_SYSROOT_VERSION=${VSCODE_SYSROOT_VERSION:-}" >> "${GITHUB_OUTPUT}"
+  echo "VSCODE_SYSROOT_PREFIX=${VSCODE_SYSROOT_PREFIX:-}" >> "${GITHUB_OUTPUT}"
+fi
+
 cd ..

build/linux/package_reh.sh

@@ -50,13 +50,13 @@ elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20240129-253798'
 elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
-  NODE_VERSION="20.16.0"
+  NODE_VERSION="22.21.1"
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:focal-devtoolset-riscv64"
 
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_NODEJS_SITE='https://unofficial-builds.nodejs.org'
 elif [[ "${VSCODE_ARCH}" == "loong64" ]]; then
-  NODE_VERSION="20.16.0"
+  NODE_VERSION="22.21.1"
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:beige-devtoolset-loong64"
 
   export VSCODE_SKIP_SETUPENV=1

build/linux/ppc64le/electron.sh

@@ -2,5 +2,5 @@
 
 set -ex
 
-export ELECTRON_VERSION="39.2.7"
+export ELECTRON_VERSION="41.0.3"
 export VSCODE_ELECTRON_TAG="v${ELECTRON_VERSION}"

build/linux/ppc64le/electron.sha256sums

@@ -1,10 +1,11 @@
-bacff46523cea806df9788d9e24f7f53fad2317f18afdcbc596b86863dd40805 *chromedriver-v39.2.7-linux-ppc64le.zip
+120e0e5915c8f1a49904737e82bf50bc72563f8556fc3c5997c118908b377874 *chromedriver-v41.0.3-linux-ppc64le.zip
-b83820b37325c0a6ce0bbb98344b54f70ef7c2a949eea61bcb423b18c623a742 *electron-v39.2.7-linux-ppc64le-debug.zip
+4601e7692cac011610c245d8c58f14a73b415fccf520194f14674f81e4ce2c41 *electron-v41.0.3-linux-ppc64le-debug.zip
-7d3b4ff4320a54572f9e1e0286702a0bed3e1596a2cb34f8fdc455acf3b9234f *electron-v39.2.7-linux-ppc64le-symbols.zip
+498a74b78699ff9d4819310262d96e861dd7d899f38f8f625a311968b076b29b *electron-v41.0.3-linux-ppc64le-symbols.zip
-6974cf1c8a550019b04762222742b8f1d9d76387594a191d3522cd65da075db1 *electron-v39.2.7-linux-ppc64le.zip
+77e86aa200d9e19b5eb3a51f273ee410788c21977f2ea76b1239d79aa2e1adbf *electron-v41.0.3-linux-ppc64le.zip
-40c772eb189d100087b75da6c2ad1aeb044f1d661c90543592546a654b0b6d5b *electron.d.ts
+e246066ccc328729e6a9f2a0d829bc893391cf54ed199b809bb7e47993fed88f *electron.d.ts
-0c923001d08e474d0dcd3b747b4f9a4bfca685d755ec08de8e44556a63f9ad3a *hunspell_dictionaries.zip
+687a36388a7cf06427d7fa7e3db7fca4ab0118c5eab2baeac128c1989a600cff *ffmpeg-v41.0.3-linux-ppc64le.zip
-ee57f79e88f50f199a6aeb87fa45c83d1bd0f92eb72e00787cfdf4cf11863562 *libcxx-objects-v39.2.7-linux-ppc64le.zip
+70ba677d4bea3e7164c82f6b5a36ac6b740317fb1dd149a0eaf1ff151da44cb2 *hunspell_dictionaries.zip
-a8709029737d3073758ccb384161a37d91f16e5a3f8110ca8e2c30f83ef8d7e6 *libcxx_headers.zip
+3e85df4843497ce567ad36ddf826cd1af7dfe9f883daad4623736ddd012dbfd1 *libcxx-objects-v41.0.3-linux-ppc64le.zip
-238dcec817528659a86b0cd3d7dabe301e65b4cab25e45c5bbab7642a8849c02 *libcxxabi_headers.zip
+5587472eeaf9bfb76d0f187ecc19d11d60bc05f5e7c8fa822f2370210c30b95d *libcxx_headers.zip
-be033ed825bd8be92bb6ca86ff81f0907e60aa999aa011f5ddf1360abb19429b *mksnapshot-v39.2.7-linux-ppc64le.zip
+f531ddd2782b4b19caf622c0355c93892965e22861279cc891675230c1310905 *libcxxabi_headers.zip
+6cb0e67dc5a23de0ebbe89253e1f24bf9d4ca41213a1b9f784f2afaa2cf61324 *mksnapshot-v41.0.3-linux-ppc64le.zip

build/linux/prepare_assets.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+if [[ -z "${VSCODE_SYSROOT_REPOSITORY}" ]]; then
+  unset VSCODE_SYSROOT_REPOSITORY
+fi
+
+if [[ -z "${VSCODE_SYSROOT_VERSION}" ]]; then
+  unset VSCODE_SYSROOT_VERSION
+fi
+
+if [[ -z "${VSCODE_SYSROOT_PREFIX}" ]]; then
+  unset VSCODE_SYSROOT_PREFIX
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" && "${VSCODE_ARCH}" != "x64" ]]; then
+  SHOULD_BUILD_APPIMAGE="no"
+fi
+
+if [[ "${SHOULD_BUILD_DEB}" != "no" || "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-deb"
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-build-deb"
+fi
+
+if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-rpm"
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-build-rpm"
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  . ../build/linux/appimage/build.sh
+fi
+
+cd ..
+
+if [[ "${CI_BUILD}" == "no" ]]; then
+  . ./stores/snapcraft/build.sh
+
+  if [[ "${SKIP_ASSETS}" == "no" ]]; then
+    mv stores/snapcraft/build/*.snap assets/
+  fi
+fi
+
+if [[ "${SHOULD_BUILD_TAR}" != "no" ]]; then
+  echo "Building and moving TAR"
+  cd "VSCode-linux-${VSCODE_ARCH}"
+  tar czf "../assets/${APP_NAME}-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" .
+  cd ..
+fi
+
+if [[ "${SHOULD_BUILD_DEB}" != "no" ]]; then
+  echo "Moving DEB"
+  mv vscode/.build/linux/deb/*/deb/*.deb assets/
+fi
+
+if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
+  echo "Moving RPM"
+  mv vscode/.build/linux/rpm/*/*.rpm assets/
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  echo "Moving AppImage"
+  mv build/linux/appimage/out/*.AppImage* assets/
+
+  find assets -name '*.AppImage*' -exec bash -c 'mv $0 ${0/_-_/-}' {} \;
+fi

build/osx/check_tags.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+if [[ -z $( contains "${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+  echo "Building on MacOS because we have no ZIP"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_ZIP="no"
+fi
+
+if [[ -z $( contains ".${VSCODE_ARCH}.${RELEASE_VERSION}.dmg" ) ]]; then
+  echo "Building on MacOS because we have no DMG"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_DMG="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-reh-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no REH archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_REH="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-reh-web-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no REH-web archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_REH_WEB="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-cli-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no CLI archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_CLI="no"
+fi
+
+if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+  echo "Already have all the MacOS builds"
+fi

build/osx/prepare_assets.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  if [[ "${CI_BUILD}" == "no" ]]; then
+    RUNNER_TEMP="${TMPDIR}"
+  fi
+
+  CERTIFICATE_P12="${APP_NAME}.p12"
+  KEYCHAIN="${RUNNER_TEMP}/buildagent.keychain"
+  AGENT_TEMPDIRECTORY="${RUNNER_TEMP}"
+  # shellcheck disable=SC2006
+  KEYCHAINS=`security list-keychains | xargs`
+
+  rm -f "${KEYCHAIN}"
+
+  echo "${CERTIFICATE_OSX_P12_DATA}" | base64 --decode > "${CERTIFICATE_P12}"
+
+  echo "+ create temporary keychain"
+  security create-keychain -p pwd "${KEYCHAIN}"
+  security set-keychain-settings -lut 21600 "${KEYCHAIN}"
+  security unlock-keychain -p pwd "${KEYCHAIN}"
+  # shellcheck disable=SC2086
+  security list-keychains -s $KEYCHAINS "${KEYCHAIN}"
+  # security show-keychain-info "${KEYCHAIN}"
+
+  echo "+ import certificate to keychain"
+  security import "${CERTIFICATE_P12}" -k "${KEYCHAIN}" -P "${CERTIFICATE_OSX_P12_PASSWORD}" -T /usr/bin/codesign
+  security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd "${KEYCHAIN}" > /dev/null
+  # security find-identity "${KEYCHAIN}"
+
+  CODESIGN_IDENTITY="$( security find-identity -v -p codesigning "${KEYCHAIN}" | grep -oEi "([0-9A-F]{40})" | head -n 1 )"
+
+  echo "+ signing"
+  export CODESIGN_IDENTITY AGENT_TEMPDIRECTORY
+
+  DEBUG="electron-osx-sign*" node vscode/build/darwin/sign.ts "$( pwd )"
+  # codesign --display --entitlements :- ""
+
+  echo "+ notarize"
+
+  cd "VSCode-darwin-${VSCODE_ARCH}"
+  ZIP_FILE="./${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip"
+
+  zip -r -X -y "${ZIP_FILE}" ./*.app
+
+  xcrun notarytool store-credentials "${APP_NAME}" --apple-id "${CERTIFICATE_OSX_ID}" --team-id "${CERTIFICATE_OSX_TEAM_ID}" --password "${CERTIFICATE_OSX_APP_PASSWORD}" --keychain "${KEYCHAIN}"
+  # xcrun notarytool history --keychain-profile "${APP_NAME}" --keychain "${KEYCHAIN}"
+  xcrun notarytool submit "${ZIP_FILE}" --keychain-profile "${APP_NAME}" --wait --keychain "${KEYCHAIN}"
+
+  echo "+ attach staple"
+  xcrun stapler staple ./*.app
+  # spctl --assess -vv --type install ./*.app
+
+  rm "${ZIP_FILE}"
+
+  cd ..
+fi
+
+if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
+  echo "Building and moving ZIP"
+  cd "VSCode-darwin-${VSCODE_ARCH}"
+  zip -r -X -y "../assets/${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ./*.app
+  cd ..
+fi
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" && "${SHOULD_BUILD_DMG}" != "no" ]]; then
+  echo "Building and moving DMG"
+  pushd "VSCode-darwin-${VSCODE_ARCH}"
+  npx create-dmg ./*.app .
+  mv ./*.dmg "../assets/${APP_NAME}.${VSCODE_ARCH}.${RELEASE_VERSION}.dmg"
+  popd
+fi
+
+if [[ "${SHOULD_BUILD_SRC}" == "yes" ]]; then
+  git archive --format tar.gz --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.tar.gz" HEAD
+  git archive --format zip --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.zip" HEAD
+fi
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  echo "+ clean"
+  security delete-keychain "${KEYCHAIN}"
+  # shellcheck disable=SC2086
+  security list-keychains -s $KEYCHAINS
+fi

build/windows/check_tags.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+# windows-arm64
+if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
+  if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows arm64 because we have no system setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_SYS="no"
+  fi
+
+  if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows arm64 because we have no user setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_USR="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    echo "Building on Windows arm64 because we have no zip"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_ZIP="no"
+  fi
+
+  export SHOULD_BUILD_REH="no"
+  export SHOULD_BUILD_REH_WEB="no"
+
+  if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows arm64 because we have no CLI archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_CLI="no"
+  fi
+
+  if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+    echo "Already have all the Windows arm64 builds"
+  fi
+
+# windows-x64
+else
+  if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows x64 because we have no system setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_SYS="no"
+  fi
+
+  if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows x64 because we have no user setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_USR="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    echo "Building on Windows x64 because we have no zip"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_ZIP="no"
+  fi
+
+  if [[ "${DISABLE_MSI}" == "yes" ]]; then
+      export SHOULD_BUILD_MSI="no"
+  elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
+    echo "Building on Windows x64 because we have no msi"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_MSI="no"
+  fi
+
+  if [[ "${DISABLE_MSI}" == "yes" ]]; then
+      export SHOULD_BUILD_MSI_NOUP="no"
+  elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
+    echo "Building on Windows x64 because we have no updates-disabled msi"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_MSI_NOUP="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no CLI archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_CLI="no"
+  fi
+
+  if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+    echo "Already have all the Windows x64 builds"
+  fi
+fi

build/windows/prepare_assets.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+npm run gulp "vscode-win32-${VSCODE_ARCH}-inno-updater"
+
+if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
+  7z.exe a -tzip "../assets/${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" -x!CodeSignSummary*.md -x!tools "../VSCode-win32-${VSCODE_ARCH}/*" -r
+fi
+
+# . ../build/windows/appx/build.sh
+
+if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
+  npm run gulp "vscode-win32-${VSCODE_ARCH}-system-setup"
+fi
+
+if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
+  npm run gulp "vscode-win32-${VSCODE_ARCH}-user-setup"
+fi
+
+if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
+  if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
+    . ../build/windows/msi/build.sh
+  fi
+
+  if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
+    . ../build/windows/msi/build-updates-disabled.sh
+  fi
+fi
+
+cd ..
+
+if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
+  echo "Moving System EXE"
+  mv "vscode\\.build\\win32-${VSCODE_ARCH}\\system-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
+fi
+
+if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
+  echo "Moving User EXE"
+  mv "vscode\\.build\\win32-${VSCODE_ARCH}\\user-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
+fi
+
+if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
+  if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
+    echo "Moving MSI"
+    mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" assets/
+  fi
+
+  if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
+    echo "Moving MSI with disabled updates"
+    mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" assets/
+  fi
+fi

build_cli.sh

@@ -81,6 +81,21 @@ else
       export CXX_armv7_unknown_linux_gnueabihf=arm-linux-gnueabihf-g++
       export PKG_CONFIG_ALLOW_CROSS=1
     fi
+  elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
+    VSCODE_CLI_TARGET="powerpc64le-unknown-linux-gnu"
+
+    # Use system libs instead of @vscode/openssl-prebuilt
+    mkdir -p openssl/out/ppc64le-linux/
+    ln -sf /usr/lib/powerpc64le-linux-gnu openssl/out/ppc64le-linux/lib
+    ln -sf /usr/include openssl/out/ppc64le-linux/include
+
+    if [[ "${CI_BUILD}" != "no" ]] && [[ "$(uname -m)" != "ppc64le" ]]; then
+      export CARGO_TARGET_POWERPC64LE_UNKNOWN_LINUX_GNU_LINKER=powerpc64le-linux-gnu-gcc-10
+      export CC_powerpc64le_unknown_linux_gnu=powerpc64le-linux-gnu-gcc-10
+      export CXX_powerpc64le_unknown_linux_gnu=powerpc64le-linux-gnu-g++-10
+      export PKG_CONFIG_ALLOW_CROSS=1
+    fi
+
   elif [[ "${VSCODE_ARCH}" == "x64" ]]; then
     VSCODE_CLI_TARGET="x86_64-unknown-linux-gnu"
   fi

check_tags.sh

@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 # shellcheck disable=SC2129
 
+# Env Paramaters
+# CHECK_ALL: yes | no
+# CHECK_REH: yes | no
+# CHECK_ONLY_REH: yes | no
+# FORCE_LINUX_SNAP: true
+
 set -e
 
 if [[ -z "${GH_TOKEN}" ]] && [[ -z "${GITHUB_TOKEN}" ]] && [[ -z "${GH_ENTERPRISE_TOKEN}" ]] && [[ -z "${GITHUB_ENTERPRISE_TOKEN}" ]]; then
@@ -77,546 +83,23 @@ elif [[ "${ASSETS}" != "null" ]]; then
     fi
   # macos
   elif [[ "${OS_NAME}" == "osx" ]]; then
-    if [[ -z $( contains "${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    . ./build/osx/check_tags.sh
-      echo "Building on MacOS because we have no ZIP"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_ZIP="no"
-    fi
-
-    if [[ -z $( contains ".${VSCODE_ARCH}.${RELEASE_VERSION}.dmg" ) ]]; then
-      echo "Building on MacOS because we have no DMG"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_DMG="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-reh-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no REH archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_REH="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-reh-web-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no REH-web archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_REH_WEB="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-cli-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no CLI archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_CLI="no"
-    fi
-
-    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-      echo "Already have all the MacOS builds"
-    fi
   elif [[ "${OS_NAME}" == "windows" ]]; then
-
+    . ./build/windows/check_tags.sh
-    # windows-arm64
-    if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows arm64 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows arm64 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows arm64 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      export SHOULD_BUILD_REH="no"
-      export SHOULD_BUILD_REH_WEB="no"
-
-      if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows arm64 because we have no CLI archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_CLI="no"
-      fi
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows arm64 builds"
-      fi
-
-    # windows-x64
-    else
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows x64 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows x64 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows x64 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows x64 because we have no msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI_NOUP="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows x64 because we have no updates-disabled msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI_NOUP="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no REH archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no REH-web archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH_WEB="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no CLI archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_CLI="no"
-      fi
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows x64 builds"
-      fi
-    fi
   else
     if [[ "${OS_NAME}" == "linux" ]]; then
-      if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+      . ./build/linux/check_tags.sh
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Linux ${VSCODE_ARCH} because we have no REH archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Linux REH ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH="no"
-        fi
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Linux ${VSCODE_ARCH} because we have no REH-web archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Linux REH-web ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH_WEB="no"
-        fi
-
-      else
-
-        # linux-arm64
-        if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "arm64.deb" ) ]]; then
-            echo "Building on Linux arm64 because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "aarch64.rpm" ) ]]; then
-            echo "Building on Linux arm64 because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ -z $( contains "arm64.snap" ) ]]; then
-            echo "Building on Linux arm64 because we have no SNAP"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_SNAP="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-cli-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no CLI archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_CLI="no"
-          fi
-
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux arm64 builds"
-          fi
-        fi
-
-        # linux-armhf
-        if [[ "${VSCODE_ARCH}" == "armhf" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "armhf.deb" ) ]]; then
-            echo "Building on Linux arm because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "armv7hl.rpm" ) ]]; then
-            echo "Building on Linux arm because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-cli-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no CLI archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_CLI="no"
-          fi
-
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux arm builds"
-          fi
-        fi
-
-        # linux-ppc64le
-        if [[ "${VSCODE_ARCH}" == "ppc64le" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_APPIMAGE="no"
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux PowerPC64LE builds"
-          fi
-        fi
-
-        # linux-riscv64
-        if [[ "${VSCODE_ARCH}" == "riscv64" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux riscv64 builds"
-          fi
-        fi
-
-        # linux-loong64
-        if [[ "${VSCODE_ARCH}" == "loong64" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-         export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux Loong64 builds"
-          fi
-        fi
-
-        # linux-s390x
-        if [[ "${VSCODE_ARCH}" == "s390x" || "${CHECK_ALL}" == "yes" ]]; then
-          SHOULD_BUILD_APPIMAGE="no"
-          SHOULD_BUILD_DEB="no"
-          SHOULD_BUILD_RPM="no"
-          SHOULD_BUILD_TAR="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-reh-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux s390x because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux s390x because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-         export SHOULD_BUILD_CLI="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux s390x builds"
-          fi
-        fi
-
-        # linux-x64
-        if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "amd64.deb" ) ]]; then
-            echo "Building on Linux x64 because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "x86_64.rpm" ) ]]; then
-            echo "Building on Linux x64 because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${DISABLE_APPIMAGE}" == "yes" ]]; then
-            export SHOULD_BUILD_APPIMAGE="no"
-          elif [[ -z $( contains "x86_64.AppImage" ) ]]; then
-            echo "Building on Linux x64 because we have no AppImage"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_APPIMAGE="no"
-          fi
-
-          if [[ -z $( contains "amd64.snap" ) ]]; then
-            echo "Building on Linux x64 because we have no SNAP"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_SNAP="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME_LC}-cli-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no CLI archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_CLI="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux x64 builds"
-          fi
-        fi
-      fi
     fi
 
     if [[ "${OS_NAME}" == "alpine" ]] || [[ "${OS_NAME}" == "linux" && "${CHECK_ALL}" == "yes" ]]; then
-
+      . ./build/alpine/check_tags.sh
-      if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
-        if [[ -z $( contains "${APP_NAME_LC}-reh-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Alpine ${VSCODE_ARCH} because we have no REH archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Alpine REH ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH="no"
-        fi
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-web-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Alpine ${VSCODE_ARCH} because we have no REH-web archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Alpine REH-web ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH_WEB="no"
-        fi
-      else
-
-        # alpine-arm64
-        if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine arm64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine arm64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-        fi
-
-        # alpine-x64
-        if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine x64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine x64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-        fi
-      fi
     fi
   fi
 else
   if [[ "${IS_SPEARHEAD}" == "yes" ]]; then
     export SHOULD_BUILD_SRC="yes"
   elif [[ "${OS_NAME}" == "linux" ]]; then
-    if [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
+    if [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
-      SHOULD_BUILD_DEB="no"
-      SHOULD_BUILD_RPM="no"
-      SHOULD_BUILD_TAR="no"
-      SHOULD_BUILD_CLI="no"
-    elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
       SHOULD_BUILD_DEB="no"
       SHOULD_BUILD_RPM="no"
       SHOULD_BUILD_CLI="no"

docs/extensions-compatibility.md

@@ -12,11 +12,11 @@
 
 ## <a id="incompatibility"></a>Incompatibility
 
-Most MS extensions are limited to run on only MS products by their license and by running additional checks in their proprietary code.
+Most Microsoft extensions are limited to run on only MS products by their license and by running additional checks in their proprietary code.
 
+Extensions incompatible with VSCodium **include**:
 - [C/C++](https://marketplace.visualstudio.com/items?itemName=ms-vscode.cpptools)
-- [LaTeX Workshop](https://marketplace.visualstudio.com/items?itemName=James-Yu.latex-workshop)
+- [LaTeX Workshop](https://marketplace.visualstudio.com/items?itemName=James-Yu.latex-workshop) (explicitly unsupported, as [indicated in the FAQ](https://github.com/James-Yu/LaTeX-Workshop/wiki/FAQ#vscodium-is-not-officially-supported))
-> It's officially unsupported: https://github.com/James-Yu/LaTeX-Workshop/wiki/FAQ#vscodium-is-not-officially-supported
 - [Live Share](https://marketplace.visualstudio.com/items?itemName=MS-vsliveshare.vsliveshare)
 - [Python](https://marketplace.visualstudio.com/items?itemName=ms-python.python)
 - [Remote - Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
@@ -40,6 +40,5 @@ The following extensions are functional replacements for incompatible extensions
 
 ### <a id="remote"></a>Remote Development
 
-- [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh)
+- [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh) (SSH server must be configured with the setting `AllowTcpForwarding yes`.)
-> SSH server must be configured with the setting `AllowTcpForwarding yes`.
 - [Open Remote - WSL](https://open-vsx.org/extension/jeanp413/open-remote-wsl)

docs/howto-build.md

@@ -46,11 +46,74 @@ see [the common dependencies](#dependencies)
 
 ### <a id="dependencies-windows"></a>Windows
 
-- powershell
+The build scripts are written in Bash, so on Windows you must run them inside **Git Bash** (bundled with [Git for Windows](https://gitforwindows.org/)) or **WSL2**.
-- sed
+
-- 7z
+#### Required tools
-- [WiX Toolset](http://wixtoolset.org/releases/)
+
-- 'Tools for Native Modules' from the official Node.js installer
+- **Git for Windows** — provides Git Bash, `sed`, and POSIX utilities used by the build scripts:
+
+  ```cmd
+  winget install --id Git.Git -e
+  ```
+
+- **Node.js** — exact version is specified in [`.nvmrc`](../.nvmrc). Use [nvm-windows](https://github.com/coreybutler/nvm-windows) to manage versions:
+
+  ```cmd
+  nvm install <version-from-.nvmrc>
+  nvm use <version-from-.nvmrc>
+  ```
+
+  Alternatively, download directly from [nodejs.org](https://nodejs.org/). During installation, enable **"Automatically install the necessary tools"** to get the C++ build tools (required for native Node addons).
+
+- **jq** — JSON processor used throughout the build scripts:
+
+  ```cmd
+  winget install --id jqlang.jq -e
+  ```
+
+- **7-Zip** — used to package `.zip` archives:
+
+  ```cmd
+  winget install --id 7zip.7zip -e
+  ```
+
+- **Python 3.11** — required by the VS Code build system:
+
+  ```cmd
+  winget install --id Python.Python.3.11 -e
+  ```
+
+  Ensure `python` / `python3` is on your `PATH` after installation.
+
+- **Rustup** — required to compile some native VS Code modules:
+
+  ```cmd
+  winget install --id Rustlang.Rustup -e
+  ```
+
+  Restart your shell afterwards so `cargo` and `rustc` are on your `PATH`.
+
+#### Optional tools
+
+- **WiX Toolset v3** _(only needed for `.msi` installer packaging, i.e., the `-p` flag)_:
+
+  Download from [wixtoolset.org](https://wixtoolset.org/releases/) and ensure `candle.exe` / `light.exe` are on your `PATH`.
+
+#### PATH verification
+
+After installing all tools, verify each is discoverable from Git Bash:
+
+```bash
+node --version    # should match .nvmrc
+npm --version
+jq --version
+python3 --version # should be 3.11.x
+cargo --version
+7z i 2>&1 | head -1
+git --version
+```
+
+If any command is not found, add its install directory to your `PATH` via **System Properties → Environment Variables → Path**.
 
 ## <a id="build-dev"></a>Build for Development
 
@@ -58,7 +121,10 @@ A build helper script can be found at `dev/build.sh`.
 
 - Linux: `./dev/build.sh`
 - MacOS: `./dev/build.sh`
-- Windows: `powershell -ExecutionPolicy ByPass -File .\dev\build.ps1` or `"C:\Program Files\Git\bin\bash.exe" ./dev/build.sh`
+- Windows (Git Bash — **recommended**): `"C:\Program Files\Git\bin\bash.exe" ./dev/build.sh`
+- Windows (PowerShell): `powershell -ExecutionPolicy ByPass -File .\dev\build.ps1`
+
+> **Note for Windows users**: Git Bash is the recommended shell because the build scripts rely on POSIX utilities (`sed`, `grep`, `find`, etc.) bundled with Git for Windows. If you use WSL2, follow the Linux dependencies section instead.
 
 ### Insider
 
@@ -95,6 +161,7 @@ export RELEASE_VERSION="${version}"
 ```
 
 To go further, you should look at how we build it:
+
 - Linux: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-linux.yml
 - macOS: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-macos.yml
 - Windows: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-windows.yml

docs/patches.md

@@ -0,0 +1,43 @@
+# Patches
+
+Documentation for VSCodium patches applied on top of VS Code.
+
+---
+
+## fix-policies
+
+**Replace `@vscode/policy-watcher` with `@vscodium/policy-watcher`**
+
+VS Code uses `@vscode/policy-watcher` to enforce Group Policy Objects (GPOs) on
+Windows. That package reads from:
+
+```
+HKLM\SOFTWARE\Policies\Microsoft\<productName>
+```
+
+VSCodium forks this into `@vscodium/policy-watcher`, which takes a separate
+`vendorName` argument. The `createWatcher()` call becomes:
+
+```ts
+createWatcher('VSCodium', this.productName, ...)
+```
+
+Because VSCodium sets `product.nameLong = 'VSCodium'` (via `prepare_vscode.sh`),
+`this.productName` resolves to `'VSCodium'` at runtime. Therefore, the final
+Windows registry key that VSCodium reads policies from is:
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>
+```
+
+(or `HKCU\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>` for per-user policies)
+
+This differs from VS Code's path (`Microsoft\VSCode`) and is the root cause of
+[issue #2714](https://github.com/VSCodium/vscodium/issues/2714) where users mirror
+VS Code's registry structure and find their GPOs ignored. Enterprise admins must
+use the VSCodium-specific registry path.
+
+### References
+
+- [VSCodium issue #2714](https://github.com/VSCodium/vscodium/issues/2714)
+- [VSCodium/policy-watcher — RegistryPolicy.hh](https://github.com/VSCodium/policy-watcher/blob/main/src/windows/RegistryPolicy.hh)

docs/telemetry.md

@@ -17,6 +17,7 @@ This page explains how VSCodium handles telemetry and how it enhances your priva
 Even though we do not pass the telemetry build flags and go out of our way to cripple the baked-in telemetry, Microsoft still can track usage by default depending on your settings.
 
 We disable all the following telemetry-related settings by default to enhance your privacy:
+
 ```
 telemetry.telemetryLevel
 telemetry.enableCrashReporter
@@ -26,28 +27,33 @@ workbench.enableExperiments
 workbench.settings.enableNaturalLanguageSearch
 workbench.commandPalette.experimental.enableNaturalLanguageSearch
 ```
+
 It is also recommended that you review all the settings that "use online services" by following [these instructions](https://code.visualstudio.com/docs/getstarted/telemetry#_managing-online-services). You can use the search filter `@tag:usesOnlineServices` to show such settings and review what to change.
 
-__Please note that some extensions send telemetry data to Microsoft as well. We have no control over this and can only recommend removing the extension.__  
+**Please note that some extensions send telemetry data to Microsoft as well. We have no control over this and can only recommend removing the extension.**  
 For example, the C# extension `ms-vscode.csharp` sends tracking data to Microsoft. Be sure to check each extension's settings page to disable their telemetry if applicable.
 
 ### Update services
+
 By default, the app periodically fetches connections to check for the latest version available to download and install.  
 Extensions are also checked for updates automatically from time to time.
 
 If you want to prevent such behaviors, modify the following preferences:
 
 For the app itself:
+
 - `update.mode` -> `manual` (or `none`)
 - `update.enableWindowsBackgroundUpdates` -> `false` (only applicable for Microsoft Windows)
 
 For extensions:
+
 - `extensions.autoUpdate` -> `false`
 - `extensions.autoCheckUpdates` -> `false`
 
-*Note: on Linux, the app update service is disabled completely at build-time even if the `update.mode` preference is configured. This is because users will more likely use their package managers to update the app rather than updating via the app itself.*
+_Note: on Linux, the app update service is disabled completely at build-time even if the `update.mode` preference is configured. This is because users will more likely use their package managers to update the app rather than updating via the app itself._
 
 ### Feedback telemetry
+
 By default, we keep the preference `telemetry.feedback.enabled` enabled. It's used to allow the button `Report Issue...` to be used on the app depending on the context. It does not send any data by having it enabled (other options already cover it). If you want, you can disable this behavior by toggling the preference value.
 
 ## <a id="replacements"></a>Replacements to Microsoft Online Services
@@ -66,7 +72,7 @@ If you want to verify that no telemetry is being sent, you can use network monit
 
 Look for connections to Microsoft domains and telemetry endpoints.
 
-## <a id="announcements"></a>VSCodium anouncements
+## <a id="announcements"></a>VSCodium announcements
 
 The welcome page in VSCodium displays announcements that are fetched via the internet from the project's GitHub repository.
 

docs/troubleshooting.md

@@ -11,10 +11,14 @@
   - [Flatpak most common issues](#linux-flatpak-most-common-issues)
   - [Remote SSH doesn't work](#linux-remote-ssh)
   - [The window doesn't show up](#linux-no-window)
+- [Windows](#windows)
+  - [Group Policy Objects (GPOs) are ignored](#windows-gpo)
+  - ["Open with VSCodium" missing from context menu](#windows-context-menu)
+  - [Windows Defender flags the installer as malware](#windows-defender)
 
 ## <a id="linux"></a>Linux
 
-### <a id="linux-fonts-rectangle"></a>*Fonts showing up as rectangles*
+### <a id="linux-fonts-rectangle"></a>_Fonts showing up as rectangles_
 
 The following command should help:
 
@@ -24,27 +28,27 @@ rm -rf ~/snap/codium/common/.cache
 fc-cache -r
 ```
 
-### <a id="linux-rendering-glitches"></a>*Text and/or the entire interface not appearing*
+### <a id="linux-rendering-glitches"></a>_Text and/or the entire interface not appearing_
 
-You have likely encountered [a bug in Chromium and Electron](microsoft/vscode#190437) when compiling Mesa shaders, which has affected all Visual Studio Code and VSCodium versions for Linux distributions since 1.82.  The current workaround (see microsoft/vscode#190437) is to delete the GPU cache as follows:
+You have likely encountered [a bug in Chromium and Electron](microsoft/vscode#190437) when compiling Mesa shaders, which has affected all Visual Studio Code and VSCodium versions for Linux distributions since 1.82. The current workaround (see microsoft/vscode#190437) is to delete the GPU cache as follows:
 
 ```bash
 rm -rf ~/.config/VSCodium/GPUCache
 ```
 
-### <a id="linux-kde-global-menu"></a>*Global menu workaround for KDE*
+### <a id="linux-kde-global-menu"></a>_Global menu workaround for KDE_
 
 Install these packages on Fedora:
 
-* libdbusmenu-devel
+- libdbusmenu-devel
-* dbus-glib-devel
+- dbus-glib-devel
-* libdbusmenu
+- libdbusmenu
 
 On Ubuntu this package is called `libdbusmenu-glib4`.
 
 Credits: [Gerson](https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/91)
 
-### <a id="linux-flatpak-most-common-issues"></a>*Flatpak most common issues*
+### <a id="linux-flatpak-most-common-issues"></a>_Flatpak most common issues_
 
 - blurry screen with HiDPI on wayland run:
   ```bash
@@ -64,7 +68,7 @@ Credits: [Gerson](https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/
 
 - If you have any other problems with the flatpak package try to look on the [FAQ](https://github.com/flathub/com.vscodium.codium?tab=readme-ov-file#faq) maybe the solution is already there or open an [issue](https://github.com/flathub/com.vscodium.codium/issues).
 
-### <a id="linux-remote-ssh"></a>*Remote SSH doesn't work*
+### <a id="linux-remote-ssh"></a>_Remote SSH doesn't work_
 
 Use the VSCodium's compatible extension [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh).
 
@@ -72,9 +76,79 @@ On the server, in the `sshd` config, `AllowTcpForwarding` need to be set to `yes
 
 It might requires additional dependencies due to the OS/distro (alpine).
 
-### <a id="linux-no-window"></a>*The window doesn't show up*
+### <a id="linux-no-window"></a>_The window doesn't show up_
 
 If you are under Wayland:
+
 - try the command `codium --verbose`
 - if you see an error like `:ERROR:ui/gl/egl_util.cc:92] EGL Driver message (Error) eglCreateContext: Requested version is not supported`
 - try `codium --ozone-platform=x11`
+
+## <a id="windows"></a>Windows
+
+### <a id="windows-gpo"></a>_Group Policy Objects (GPOs) are ignored_
+
+VSCodium uses its own policy-watcher library (`@vscodium/policy-watcher`) which reads GPO values from a **different registry path** than VS Code.
+
+**VSCodium reads policies from:**
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium
+```
+
+**VS Code reads policies from:**
+
+```
+HKLM\SOFTWARE\Policies\Microsoft\VSCode
+```
+
+If you are deploying VSCodium in an enterprise environment via Group Policy:
+
+1. Copy the `.admx` template file to `C:\Windows\PolicyDefinitions\`
+2. Copy the `.adml` language file to `C:\Windows\PolicyDefinitions\en-US\`
+3. Open `gpedit.msc` and configure policies under the VSCodium group
+4. Verify the resulting registry key exists at `HKLM\SOFTWARE\Policies\VSCodium\VSCodium` (not `Microsoft\VSCodium`)
+
+If you set policies manually via Registry Editor, make sure you create the key at the correct path:
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>  (REG_SZ or REG_DWORD)
+```
+
+For example, to set `Update: Mode` to `none`:
+
+```
+Registry key: HKLM\SOFTWARE\Policies\VSCodium\VSCodium
+Value name:   update.mode
+Value type:   REG_SZ
+Value data:   none
+```
+
+Per-user policies are also supported under `HKCU\SOFTWARE\Policies\VSCodium\VSCodium` (machine policies take precedence).
+
+### <a id="windows-context-menu"></a>_"Open with VSCodium" missing from context menu_
+
+If the **"Open with VSCodium"** option does not appear after installation (even with the checkbox checked during setup):
+
+1. **Run the installer again** and ensure _"Add 'Open with VSCodium' action to Windows Explorer file context menu"_ is checked.
+2. **Windows 11 note**: Windows 11 hides most context menu entries behind **Shift + Right-click** ("Show more options"). VSCodium's entry may be present but hidden in the new condensed menu. Try Shift + Right-click to see the classic context menu.
+3. If the entry still does not appear, you can add it manually via Registry Editor:
+
+   ```
+   Key:   HKEY_CLASSES_ROOT\*\shell\Open with VSCodium
+   Value: (Default) = "Open with VSCodium"
+
+   Key:   HKEY_CLASSES_ROOT\*\shell\Open with VSCodium\command
+   Value: (Default) = "C:\Program Files\VSCodium\VSCodium.exe" "%1"
+   ```
+
+   Adjust the install path to match your actual installation directory.
+
+### <a id="windows-defender"></a>_Windows Defender flags the installer as malware_
+
+Some users report Windows Defender detecting the VSCodium installer as `Cinjo` or another threat. This is a **false positive** caused by the unsigned nature of certain build artifacts.
+
+- Download VSCodium **only from the official [GitHub Releases page](https://github.com/VSCodium/vscodium/releases)**.
+- Verify the SHA256/SHA512 checksum of the downloaded file against the `.sha256` or `.sha512` file published alongside each release.
+- If Defender blocks the installer, add an exclusion for the downloaded file, run the install, then remove the exclusion.
+- You can also report the false positive directly to Microsoft via the [Windows Defender Security Intelligence submission portal](https://www.microsoft.com/en-us/wdsi/filesubmission).

font-size/package-lock.json

@@ -4835,16 +4835,16 @@
 			}
 		},
 		"node_modules/lodash": {
-			"version": "4.17.23",
+			"version": "4.18.1",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
 			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/lodash-es": {
-			"version": "4.17.23",
+			"version": "4.18.1",
-			"resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
+			"resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
-			"integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+			"integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
 			"dev": true,
 			"license": "MIT"
 		},
@@ -5506,9 +5506,9 @@
 			"license": "ISC"
 		},
 		"node_modules/picomatch": {
-			"version": "2.3.1",
+			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=8.6"
@@ -6782,9 +6782,9 @@
 			}
 		},
 		"node_modules/ts-declaration-location/node_modules/picomatch": {
-			"version": "4.0.3",
+			"version": "4.0.4",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-			"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+			"integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {

justfile

@@ -0,0 +1,10 @@
+set shell := ["bash", "-uc"]
+
+ci-lint:
+	zizmor .
+
+ci-lint-fix:
+  zizmor . --fix=all
+
+ci-update:
+	PINACT_MIN_AGE=7 pinact run

patches/fix-policies.patch

@@ -1,3 +1,5 @@
+# Fix: Replace @vscode/policy-watcher with @vscodium/policy-watcher
+# Documentation: docs/patches.md#fix-policies
 diff --git a/build/.moduleignore b/build/.moduleignore
 index 5b040cc..8d5fd71 100644
 --- a/build/.moduleignore

patches/linux/arch-1-ppc64le.patch

@@ -27,17 +27,18 @@ index 5294177..1e33aeb 100755
 +  TRIPLE="powerpc64le-linux-gnu"
  fi
 diff --git a/build/checksums/vscode-sysroot.txt b/build/checksums/vscode-sysroot.txt
-index 847383e..37186f4 100644
+index 847383e..04962e7 100644
 --- a/build/checksums/vscode-sysroot.txt
 +++ b/build/checksums/vscode-sysroot.txt
-@@ -7 +7,2 @@ ac4b6b14b4cec027a22a51bbbb049b3504958a78106c8a8d5cec144206b767d1  x86_64-linux-g
+@@ -7 +7,3 @@ ac4b6b14b4cec027a22a51bbbb049b3504958a78106c8a8d5cec144206b767d1  x86_64-linux-g
  1ebb6ef1fe2983269fd0855a88f9c9a37f9b515d16524a9146198e4cabdf34f7  x86_64-linux-gnu-glibc-2.28-gcc-8.5.0.tar.gz
 +fa8176d27be18bb0eeb7f55b0fa22255050b430ef68c29136599f02976eb0b1b  powerpc64le-linux-gnu-glibc-2.28.tar.gz
++bdab0a372cf5bfdc154226cc5ed72d417096c725085d193509d1f12e0debec66  powerpc64le-linux-gnu-glibc-2.28-gcc-10.5.0.tar.gz
 diff --git a/build/gulpfile.reh.ts b/build/gulpfile.reh.ts
-index 012df0b..a7da071 100644
+index 904130f..42888f0 100644
 --- a/build/gulpfile.reh.ts
 +++ b/build/gulpfile.reh.ts
-@@ -52,2 +52,3 @@ const BUILD_TARGETS = [
+@@ -56,2 +56,3 @@ const BUILD_TARGETS = [
  	{ platform: 'linux', arch: 'arm64' },
 +	{ platform: 'linux', arch: 'ppc64le' },
  	{ platform: 'alpine', arch: 'arm64' },
@@ -66,10 +67,10 @@ index c5d2163..da4fc1f 100644
 +	{ arch: 'ppc64le' },
  ];
 diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
-index ce46a41..3389ede 100644
+index 5e373f6..4e1fcf6 100644
 --- a/build/gulpfile.vscode.ts
 +++ b/build/gulpfile.vscode.ts
-@@ -614,2 +614,3 @@ const BUILD_TARGETS = [
+@@ -702,2 +702,3 @@ const BUILD_TARGETS = [
  	{ platform: 'linux', arch: 'arm64' },
 +	{ platform: 'linux', arch: 'ppc64le' },
  ];
@@ -134,12 +135,13 @@ index 78bfb66..5acd3a0 100644
 +	],
  };
 diff --git a/build/linux/debian/install-sysroot.ts b/build/linux/debian/install-sysroot.ts
-index 7b6ac8b..dde47ba 100644
+index 7b6ac8b..ef7dd2b 100644
 --- a/build/linux/debian/install-sysroot.ts
 +++ b/build/linux/debian/install-sysroot.ts
-@@ -158,2 +158,6 @@ export async function getVSCodeSysroot(arch: DebianArchString, isMusl: boolean =
+@@ -158,2 +158,7 @@ export async function getVSCodeSysroot(arch: DebianArchString, isMusl: boolean =
  			break;
 +		case 'ppc64le':
++		case 'ppc64el':
 +			expectedName = `powerpc64le-linux-gnu${prefix}.tar.gz`;
 +			triple = `powerpc64le-linux-gnu`;
 +			break;
@@ -277,6 +279,19 @@ index c6a01da..3f3c3f5 100644
 -	return ['x86_64', 'armv7hl', 'aarch64'].includes(s);
 +	return ['x86_64', 'armv7hl', 'aarch64', 'ppc64le'].includes(s);
  }
+diff --git a/build/npm/preinstall.ts b/build/npm/preinstall.ts
+index dd53ff4..ca427d9 100644
+--- a/build/npm/preinstall.ts
++++ b/build/npm/preinstall.ts
+@@ -149,3 +149,7 @@ function installHeaders() {
+ 			} catch (error) {
+-				throw new Error(`Error applying v8-source-location.patch: ${(error as Error).message}`);
++				if (process.env['VSCODE_ARCH'] === 'ppc64le') {
++						console.log('Ignoring patch error for ppc64le architecture');
++				} else {
++						throw new Error(`Error applying v8-source-location.patch: ${(error as Error).message}`);
++				}
+ 			}
 diff --git a/cli/src/update_service.rs b/cli/src/update_service.rs
 index 3b7ef5c..ec97760 100644
 --- a/cli/src/update_service.rs
@@ -303,7 +318,7 @@ index 3b7ef5c..ec97760 100644
 +			Platform::LinuxPPC64LE => "LinuxPPC64LE",
  			Platform::DarwinX64 => "DarwinX64",
 diff --git a/cli/src/util/prereqs.rs b/cli/src/util/prereqs.rs
-index 44c8597..679aacb 100644
+index 44c8597..205c274 100644
 --- a/cli/src/util/prereqs.rs
 +++ b/cli/src/util/prereqs.rs
 @@ -82,2 +82,4 @@ impl PreReqChecker {
@@ -311,6 +326,11 @@ index 44c8597..679aacb 100644
 +				} else if cfg!(target_arch = "powerpc64") {
 +					Platform::LinuxPPC64LE
  				} else {
+@@ -207,2 +209,4 @@ async fn check_glibcxx_version() -> Result<bool, String> {
+ 	const DEFAULT_LIB_PATH: &str = "/usr/lib64/libstdc++.so.6";
++	#[cfg(target_arch = "powerpc64")]
++	const DEFAULT_LIB_PATH: &str = "/usr/lib64/libstdc++.so.6";
+ 	#[cfg(any(target_arch = "x86", target_arch = "arm"))]
 diff --git a/resources/server/bin/helpers/check-requirements-linux.sh b/resources/server/bin/helpers/check-requirements-linux.sh
 index 8ea4c0b..94028e3 100644
 --- a/resources/server/bin/helpers/check-requirements-linux.sh
@@ -338,10 +358,10 @@ index ab11f6b..fd1ec31 100644
 +			}
  			return TargetPlatform.UNKNOWN;
 diff --git a/src/vs/platform/extensions/common/extensions.ts b/src/vs/platform/extensions/common/extensions.ts
-index 021ad01..60cd058 100644
+index 3e5b309..0fbbb67 100644
 --- a/src/vs/platform/extensions/common/extensions.ts
 +++ b/src/vs/platform/extensions/common/extensions.ts
-@@ -342,2 +342,3 @@ export const enum TargetPlatform {
+@@ -343,2 +343,3 @@ export const enum TargetPlatform {
  	LINUX_ARMHF = 'linux-armhf',
 +	LINUX_PPC64LE = 'linux-ppc64le',
  

patches/linux/arch-4-s390x.patch

@@ -1,5 +1,5 @@
 diff --git a/build/azure-pipelines/linux/setup-env.sh b/build/azure-pipelines/linux/setup-env.sh
-index 6ff90d4..381150d 100755
+index 67bc741..4f0521b 100755
 --- a/build/azure-pipelines/linux/setup-env.sh
 +++ b/build/azure-pipelines/linux/setup-env.sh
 @@ -88,2 +88,14 @@ elif [ "$npm_config_arch" == "ppc64" ]; then
@@ -18,17 +18,17 @@ index 6ff90d4..381150d 100755
 +	export VSCODE_REMOTE_LDFLAGS="--sysroot=$VSCODE_REMOTE_SYSROOT_DIR/s390x-linux-gnu/s390x-linux-gnu/sysroot -L$VSCODE_REMOTE_SYSROOT_DIR/s390x-linux-gnu/s390x-linux-gnu/sysroot/usr/lib/s390x-linux-gnu -L$VSCODE_REMOTE_SYSROOT_DIR/s390x-linux-gnu/s390x-linux-gnu/sysroot/lib/s390x-linux-gnu"
  fi
 diff --git a/build/checksums/vscode-sysroot.txt b/build/checksums/vscode-sysroot.txt
-index 3fedbe9..3c4e291 100644
+index dd159f8..8e8cbe9 100644
 --- a/build/checksums/vscode-sysroot.txt
 +++ b/build/checksums/vscode-sysroot.txt
-@@ -8 +8,2 @@ f82c8dacbb9dd85819e4801909eb4e842ac12c899632aa75b4839383a18c7501  arm-rpi-linux-
+@@ -8 +8,2 @@ ac4b6b14b4cec027a22a51bbbb049b3504958a78106c8a8d5cec144206b767d1  x86_64-linux-g
- fa8176d27be18bb0eeb7f55b0fa22255050b430ef68c29136599f02976eb0b1b  powerpc64le-linux-gnu-glibc-2.28.tar.gz
+ bdab0a372cf5bfdc154226cc5ed72d417096c725085d193509d1f12e0debec66  powerpc64le-linux-gnu-glibc-2.28-gcc-10.5.0.tar.gz
 +7055f3d40e7195fb1e13f0fbaf5ffadf781bddaca5fd5e0d9972f4157a203fb5  s390x-linux-gnu-glibc-2.28.tar.gz
 diff --git a/build/gulpfile.reh.ts b/build/gulpfile.reh.ts
-index af8403a..a697f8c 100644
+index e6ff02c..65f7efe 100644
 --- a/build/gulpfile.reh.ts
 +++ b/build/gulpfile.reh.ts
-@@ -55,2 +55,3 @@ const BUILD_TARGETS = [
+@@ -59,2 +59,3 @@ const BUILD_TARGETS = [
  	{ platform: 'linux', arch: 'loong64' },
 +	{ platform: 'linux', arch: 's390x' },
  	{ platform: 'alpine', arch: 'arm64' },
@@ -57,10 +57,10 @@ index e146586..ca18865 100644
 +	{ arch: 's390x' },
  ];
 diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
-index d5f3ed8..ac87a54 100644
+index e1e5265..295a755 100644
 --- a/build/gulpfile.vscode.ts
 +++ b/build/gulpfile.vscode.ts
-@@ -520,2 +520,3 @@ const BUILD_TARGETS = [
+@@ -705,2 +705,3 @@ const BUILD_TARGETS = [
  	{ platform: 'linux', arch: 'loong64' },
 +	{ platform: 'linux', arch: 's390x' },
  ];
@@ -78,7 +78,7 @@ index 5ee005e..71fb92e 100644
 +			break;
  	}
 diff --git a/build/linux/debian/dep-lists.ts b/build/linux/debian/dep-lists.ts
-index 7ea5910..9498993 100644
+index 0e28f90..6e81b12 100644
 --- a/build/linux/debian/dep-lists.ts
 +++ b/build/linux/debian/dep-lists.ts
 @@ -221,2 +221,42 @@ export const referenceGeneratedDepsByArch = {
@@ -125,10 +125,10 @@ index 7ea5910..9498993 100644
 +	],
  };
 diff --git a/build/linux/debian/install-sysroot.ts b/build/linux/debian/install-sysroot.ts
-index 6e5246c..89fac34 100644
+index aece9b9..52a25ce 100644
 --- a/build/linux/debian/install-sysroot.ts
 +++ b/build/linux/debian/install-sysroot.ts
-@@ -166,2 +166,6 @@ export async function getVSCodeSysroot(arch: DebianArchString, isMusl: boolean =
+@@ -167,2 +167,6 @@ export async function getVSCodeSysroot(arch: DebianArchString, isMusl: boolean =
  			break;
 +		case 's390x':
 +			expectedName = `s390x-linux-gnu${prefix}.tar.gz`;
@@ -149,10 +149,10 @@ index 5d63ed2..5f793e2 100644
 +	return ['amd64', 'armhf', 'arm64', 'ppc64el', 'ppc64le', 'riscv64', 's390x'].includes(s);
  }
 diff --git a/build/linux/rpm/dep-lists.ts b/build/linux/rpm/dep-lists.ts
-index fba6ee4..33efc80 100644
+index c7e0820..03528c0 100644
 --- a/build/linux/rpm/dep-lists.ts
 +++ b/build/linux/rpm/dep-lists.ts
-@@ -416,2 +416,102 @@ export const referenceGeneratedDepsByArch = {
+@@ -418,2 +418,102 @@ export const referenceGeneratedDepsByArch = {
  		'xdg-utils'
 +	],
 +	"s390x": [
@@ -277,7 +277,7 @@ index dc9faac..9078cc9 100644
 +    s390x)   LDCONFIG_ARCH="64bit";;
  esac
 diff --git a/src/vs/platform/extensionManagement/common/extensionManagement.ts b/src/vs/platform/extensionManagement/common/extensionManagement.ts
-index 7162d83..f6bb8fd 100644
+index 9a67e9d..aeb7dc0 100644
 --- a/src/vs/platform/extensionManagement/common/extensionManagement.ts
 +++ b/src/vs/platform/extensionManagement/common/extensionManagement.ts
 @@ -51,2 +51,3 @@ export function TargetPlatformToString(targetPlatform: TargetPlatform) {
@@ -295,10 +295,10 @@ index 7162d83..f6bb8fd 100644
 +			}
  			return TargetPlatform.UNKNOWN;
 diff --git a/src/vs/platform/extensions/common/extensions.ts b/src/vs/platform/extensions/common/extensions.ts
-index f93e0ca..c4cc8c9 100644
+index 7b11edb..b8a6193 100644
 --- a/src/vs/platform/extensions/common/extensions.ts
 +++ b/src/vs/platform/extensions/common/extensions.ts
-@@ -334,2 +334,3 @@ export const enum TargetPlatform {
+@@ -346,2 +346,3 @@ export const enum TargetPlatform {
  	LINUX_LOONG64 = 'linux-loong64',
 +	LINUX_S390X = 'linux-s390x',
  

patches/update-electron.patch

@@ -0,0 +1,203 @@
+diff --git a/.npmrc b/.npmrc
+index a275846..e31402c 100644
+--- a/.npmrc
++++ b/.npmrc
+@@ -1,3 +1,3 @@
+ disturl="https://electronjs.org/headers"
+-target="39.8.0"
++target="39.8.4"
+ ms_build_id="13470701"
+diff --git a/build/checksums/electron.txt b/build/checksums/electron.txt
+index 5d8343f..1fd0e54 100644
+--- a/build/checksums/electron.txt
++++ b/build/checksums/electron.txt
+@@ -1,75 +1,75 @@
+-d70954386008ad2c65d9849bb89955ab3c7dd08763256ae0d91d8604e8894d64 *chromedriver-v39.8.0-darwin-arm64.zip
+-2f6b654337133c13440aafdaf9e8b15f5ebb244e7d49f20977f03438e9bb8adb *chromedriver-v39.8.0-darwin-x64.zip
+-ef8681bb6b6af42cdf0e14c9ce188f035e01620781308c06cd3c6b922aaea2e6 *chromedriver-v39.8.0-linux-arm64.zip
+-c03fea6ac2b743d771407dc5f58809f44d2a885b1830b847957823cac2e7b222 *chromedriver-v39.8.0-linux-armv7l.zip
+-4bb7c6d9b3a7bfdd89edd0db98e63599ebf6dacdb888d5985bbb73f6153acc0c *chromedriver-v39.8.0-linux-x64.zip
+-aad1f6f970b5636d637c1c242766fbaa5bebe2707a605a38aadc7b40724b3d11 *chromedriver-v39.8.0-mas-arm64.zip
+-e89ebebe3a135d3ce40168152a0aabfd055b9fa6b118262a6df18405fd2ea433 *chromedriver-v39.8.0-mas-x64.zip
+-232e1a0460f6a59056499cccfff3265bf92eae22f20f02f2419e5e49552aaed7 *chromedriver-v39.8.0-win32-arm64.zip
+-ab92f46cc55da7c719175b50203c734781828389b8b3a1a535204bf0dc7d1296 *chromedriver-v39.8.0-win32-ia32.zip
+-a40eb521063e4ea6791ed4005815fa8ac259c1febc850246a83a47ce120121ce *chromedriver-v39.8.0-win32-x64.zip
+-d6a33b4c3c0de845ea23d1e2614c6c6d3bbe35b771bb63ae521c4db11373b021 *electron-api.json
+-5425323fdb23167870075e944ec6cf3ae383fbe45ad141d08b1d9689030ccd05 *electron-v39.8.0-darwin-arm64-dsym-snapshot.zip
+-aa32ab00ee58d8827cd53ca561b8c26b7cb7e2ad8cb0801acdda117ee728388e *electron-v39.8.0-darwin-arm64-dsym.zip
+-f94e589804a3394a4735543b888927be873f8f402899d0debe32a9dc570d6285 *electron-v39.8.0-darwin-arm64-symbols.zip
+-681d82c2ec6677ff0bf12f5bb1808b5a51dcbf10894bd0298641015119a3e04d *electron-v39.8.0-darwin-arm64.zip
+-a95e83b5cde762a37e64229e5669b0c19b95aac148689d96ca344535109eb983 *electron-v39.8.0-darwin-x64-dsym-snapshot.zip
+-8c989d8ca835ecdd93d49d9627f5548272c0ed03e263392b21ed287960b29e41 *electron-v39.8.0-darwin-x64-dsym.zip
+-b4b6fda9c5b9063a104318645aa29ef4738dd099da2b722e3e9b6dde5e098418 *electron-v39.8.0-darwin-x64-symbols.zip
+-ec53f2ba79498410323bb96a19ce98741bf28666cc9d83e07d11dadcc5506f38 *electron-v39.8.0-darwin-x64.zip
+-9141e64f9d4ea7f0e6a43ae364c8232a0dac79ecec44de2d4a0e5d688fbb742c *electron-v39.8.0-linux-arm64-debug.zip
+-5fac949d5331abaff0643dbcda7cc187e548cd4bf9d198c1ffc361383bfaa79f *electron-v39.8.0-linux-arm64-symbols.zip
+-c9db883fa671237fbc16256cf89aba55b9fcfbd9825fec32a6d57724a6446fe1 *electron-v39.8.0-linux-arm64.zip
+-b26ac10e84f6b7d338c13a38547aa66b5e9afbe2f1355b183ebc2ff8f428cfa9 *electron-v39.8.0-linux-armv7l-debug.zip
+-16c47c008a8783f6c8d6387fe01ea15425161befbf4211e4667bbdd6bb806ef0 *electron-v39.8.0-linux-armv7l-symbols.zip
+-b1b37fd450a5081a876c2b00b6ca007d454747a7d1d8f04feb16119d6ace94c6 *electron-v39.8.0-linux-armv7l.zip
+-1e8039cdf60b27785771c9e3f3c4c39fad37602bb0e6b75a30f83c57fdbef069 *electron-v39.8.0-linux-x64-debug.zip
+-ff9ca169c6e79649dd4c5a49a82a8d4b1761b62fbe14c15c61bf534381a9f653 *electron-v39.8.0-linux-x64-symbols.zip
+-854076cc4c63d6d6c320df1ca3f4bd7084ef9f9bb47c7b75d80feb2c2ed920b4 *electron-v39.8.0-linux-x64.zip
+-91bc313cbd009435552d8d5efff5d6ed0ff15465743c2629dac1cfe99ac34e4d *electron-v39.8.0-mas-arm64-dsym-snapshot.zip
+-974f10f80ec6c65f8d9f2ac1ccd8c4395bb34e24e2b09dc0ff80bd351099692e *electron-v39.8.0-mas-arm64-dsym.zip
+-b3878bc9198cff324b7c829ce2fbea7a4ee505f2f99b0bb3c11ac5e60651be59 *electron-v39.8.0-mas-arm64-symbols.zip
+-48dac99c757a850b0db7b38c1b95e08270f690a7ea1b58872e45308c2f7c8c93 *electron-v39.8.0-mas-arm64.zip
+-1a6e4df1092f89ed46833938d6dd1b3036640037bd09f0630a369ae386a7c872 *electron-v39.8.0-mas-x64-dsym-snapshot.zip
+-81425eb867527341af64c00726bd462957fec4d5f073922df891d830addbc5bc *electron-v39.8.0-mas-x64-dsym.zip
+-748ce154e894a27b117b46354cc288dc9442fade844c637b59fe1c1f3f7c625d *electron-v39.8.0-mas-x64-symbols.zip
+-91f8f7d4eb1a42ac4fa0eaa93034c8e6155ccb50718f9f55541ce2be4a4ed6d0 *electron-v39.8.0-mas-x64.zip
+-b775b7584afb84e52b0a770e1e63a2f17384b66eeebe845e0c5c82beacaf7e93 *electron-v39.8.0-win32-arm64-pdb.zip
+-ac62373d11ed682b4fcdae27de2bd72ebf7d46d3b569f5fcf242de01786d0948 *electron-v39.8.0-win32-arm64-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-arm64-toolchain-profile.zip
+-08b79fa5deabbcace447f1e15eb99b3b117b42a84b71ad5b0f52d2da68a34192 *electron-v39.8.0-win32-arm64.zip
+-f4fb798d76a0c2f80717ef1607571537dbbb07f1cc5f177048bcfd17046c2255 *electron-v39.8.0-win32-ia32-pdb.zip
+-37c1d2988793604294724b648589fca6459472021189abab1550d5e1eecff1a7 *electron-v39.8.0-win32-ia32-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-ia32-toolchain-profile.zip
+-59b70a12abedb550795614bc74c5803787e824da3529a631fdb5c2b5aad00196 *electron-v39.8.0-win32-ia32.zip
+-0357c6fb0d7198c45cba0e8c939473ea1d971e1efe801bc84e2c559141b368e7 *electron-v39.8.0-win32-x64-pdb.zip
+-8e6f4e8516d15aecde5244beac315067c13513c7074383086523eef2638a5e8d *electron-v39.8.0-win32-x64-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-x64-toolchain-profile.zip
+-9edc111b22aee1a0efb5103d6d3b48645af57b48214eeb48f75f9edfc3e271d6 *electron-v39.8.0-win32-x64.zip
+-b6eca0e05fcff2464382278dff52367f6f21eb1a580dd8a0a954fc16397ab085 *electron.d.ts
+-27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.0-darwin-arm64.zip
+-321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.0-darwin-x64.zip
+-52ae6eccbdb4a9403a6c3eb46b356a28940ec25958b6b9181fb2f38e612e40ed *ffmpeg-v39.8.0-linux-arm64.zip
+-622cb781fb1e3b9617e7e60c36384427f7b0d9b5ad888e9bc356a83b050e13f1 *ffmpeg-v39.8.0-linux-armv7l.zip
+-ba441851788008362f013bf2983b22b0042af8df31bf90123328f928cc067492 *ffmpeg-v39.8.0-linux-x64.zip
+-27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.0-mas-arm64.zip
+-321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.0-mas-x64.zip
+-3ba7c7507181e0d4836f70f3d8800b4e9ba379e1086e9e89fda7ff9b3b9ad2cb *ffmpeg-v39.8.0-win32-arm64.zip
+-f37e7d51b8403e2ed8ca192bc6ae759cf63d80010e747b15eeb7120b575578b2 *ffmpeg-v39.8.0-win32-ia32.zip
+-b252e232438010f9683e8fd10c3bf0631df78e42a6ae11d6cb7aa7e6ac11185f *ffmpeg-v39.8.0-win32-x64.zip
+-365735192f58a7f7660100227ec348ba3df604415ff5264b54d93cb6cf5f6f6f *hunspell_dictionaries.zip
+-6384ee31daa39de4dd4bd3aa225cdb14cdddb7f463a2c1663b38a79e122a13e2 *libcxx-objects-v39.8.0-linux-arm64.zip
+-9748b3272e52a8274fe651def2d6ae2dad7a3771b520dd105f46f4020ba9d63b *libcxx-objects-v39.8.0-linux-armv7l.zip
+-74d47a155ecc6c2054418c7c3e0540f32b983ebdc65e8b4ea5d3e257d29b3f4f *libcxx-objects-v39.8.0-linux-x64.zip
+-c0755fbb84011664bd36459fc6e06a603078dccd3b7b260f6ed6ad1d409f79f7 *libcxx_headers.zip
+-3ea41e9bd56e8f52ab8562c1406ba9416abe3993640935e981cbbd77c0f2654b *libcxxabi_headers.zip
+-befcd6067f35d911a6a87b927e79dc531cb7bea39e85f86a65e9ab82ef0cece1 *mksnapshot-v39.8.0-darwin-arm64.zip
+-f0e692655298ffed60630c3e6490ced69e9d8726e85bcaecfa34485f3a991469 *mksnapshot-v39.8.0-darwin-x64.zip
+-d5d0901cd1eafdf921d2a0d1565829cf60f454a71ce74fa60db98780fd8a1a96 *mksnapshot-v39.8.0-linux-arm64-x64.zip
+-1bc0a3294d258a59846aa5c5359cd8b0f43831ebd7c3e1dde9a6cfaa39d845bf *mksnapshot-v39.8.0-linux-armv7l-x64.zip
+-4e414dbe75f460cb34508608db984aa6f4d274f333fa327a3d631da4a516da8f *mksnapshot-v39.8.0-linux-x64.zip
+-c51c86e3a11ad75fb4f7559798f6d64ec7def19583c96ce08de7ee5796568841 *mksnapshot-v39.8.0-mas-arm64.zip
+-6544d1e93adea1e9a694f9b9f539d96f84df647d9c9319b29d4fc88751ff9075 *mksnapshot-v39.8.0-mas-x64.zip
+-372b4685c53f19ccc72c33d78c1283d9389c72f42cd48224439fe4f89199caa0 *mksnapshot-v39.8.0-win32-arm64-x64.zip
+-199e9244f4522a4a02aece09a6a33887b24d7ec837640d39c930170e4b3caa57 *mksnapshot-v39.8.0-win32-ia32.zip
+-970e979e7a8b70f300f7854cb571756d9049bc42b44a6153a9ce3a18e1a83243 *mksnapshot-v39.8.0-win32-x64.zip
++1e91e08b27242bfa38e3321eac27a76b4527b5240d9b7fa55b34b27272c7d20d *chromedriver-v39.8.4-darwin-arm64.zip
++e6036542dea19cf60b0d1ae6b7be1cdfb741363f7af8243720566363a9d04a23 *chromedriver-v39.8.4-darwin-x64.zip
++464e5f0c7ae0dcf4817436d6289bcee5cd655e7da96debf8e4723a10f2545362 *chromedriver-v39.8.4-linux-arm64.zip
++2be3059d746a33bf3e4c0cf89131401294ef270e152a0e567ffb279a77cd3bba *chromedriver-v39.8.4-linux-armv7l.zip
++dfce0407bf9304f1df3f053e305d8c7660ab7ac2b6f4b81bedab343d16bcc48d *chromedriver-v39.8.4-linux-x64.zip
++28c4f1b14580fc2a0b35cb9a9b29e8742e117311df8843c1ba31439249b368c3 *chromedriver-v39.8.4-mas-arm64.zip
++381581e0ba9ca49682d39b7cdf05d5f3c2c477c2db7878738103051bffb02c5d *chromedriver-v39.8.4-mas-x64.zip
++22c4c9e1fdbb80b02bfca06de84407ff4fae79072f192b4e4c9260ccd2d55ded *chromedriver-v39.8.4-win32-arm64.zip
++d2771daa0fdd9375b6b82b8fbdc61781fba3ab3aa104a57d0e4a5262b8aa7baa *chromedriver-v39.8.4-win32-ia32.zip
++984738998aa9f5947f11446386d5c26dc5836de5869be4a11a8db6c1a21a9801 *chromedriver-v39.8.4-win32-x64.zip
++21469b4c0fba6ff2470f3ca046c4fedaa0e7169de6849d3a515df1229583e72b *electron-api.json
++4ef051701b2d01f19f8d3d29d41d27e3a9c6881c9defefc3883b35157234ffb0 *electron-v39.8.4-darwin-arm64-dsym-snapshot.zip
++115a40e2f14a492cc5ea9948e61e8c00ad758c568a74c94551acde0a0c6ff892 *electron-v39.8.4-darwin-arm64-dsym.zip
++d744d733681a36a242abb8b997c58571b49edb12db616bbd966111b1ff9f2114 *electron-v39.8.4-darwin-arm64-symbols.zip
++47636d2c4e07dc587fad991d2e682a8a8aa42281732e33323418e16e4d31245d *electron-v39.8.4-darwin-arm64.zip
++8196638bd34cc5815bd91de60f2d5eaa1119c8d473519c208e640cf68a1d9410 *electron-v39.8.4-darwin-x64-dsym-snapshot.zip
++f6cc6d79870acb14efda0bfb33f1e78b96fcab3bdbecc6d91c505dddb519f09f *electron-v39.8.4-darwin-x64-dsym.zip
++14204efe7f170b82e9c369d060f8b05d5a32aceb9800330861dbc05482ada505 *electron-v39.8.4-darwin-x64-symbols.zip
++48bc4c03e3dab5678ddc447378ec639803d687d75939575675a273f054b98237 *electron-v39.8.4-darwin-x64.zip
++8c5e0eb3e15b90b2397dc641255c8bac797a0e4a2f999ea77e4461d667add977 *electron-v39.8.4-linux-arm64-debug.zip
++25df0c1a03bdad3a19f5a9d6385efadc249b48a512cbb7967bccffe1a123a007 *electron-v39.8.4-linux-arm64-symbols.zip
++67d9c084e664ee2a5f76dce2efb13f79aff60e014deb06174af82b6cfd43b101 *electron-v39.8.4-linux-arm64.zip
++514dbca9bf81f82f6574ae906057b78f13c4bd781eba9033ed58d6609ce944a8 *electron-v39.8.4-linux-armv7l-debug.zip
++3baa152b9ae413da46ced437291b7bd65dca390168a62f9ba01b7f8c9bc76ed4 *electron-v39.8.4-linux-armv7l-symbols.zip
++a2d835231443afc8022a99a3ab94b7b4a90ebfbda77c2fbefafca430753174fe *electron-v39.8.4-linux-armv7l.zip
++8ea7223c43a03779fafc6272742ebca104f584b3952abcf17b186af3624803d7 *electron-v39.8.4-linux-x64-debug.zip
++4d834e7574dda95f1bd10a7758ed93fbc12d2aa4aa6cc6fad091a37ea422d196 *electron-v39.8.4-linux-x64-symbols.zip
++66f1ea702595deda724f6c6246acfddc84a317c7f0262bd7fd350af50dbbe4e9 *electron-v39.8.4-linux-x64.zip
++ce85bfbd66c6731004e7d035a2bf65b2c0cb95a9716ee7e156061c791bd723a7 *electron-v39.8.4-mas-arm64-dsym-snapshot.zip
++b745d57275df62904d779fe757446adfe515252edc00fe8e8667fe63e9975dda *electron-v39.8.4-mas-arm64-dsym.zip
++14706a26e78fcdc34be2f12229920cc178b6b773eeede0aee87875336e4a6a0c *electron-v39.8.4-mas-arm64-symbols.zip
++9a30bfe87c8d62f39798a5a69a63085429f6f1ba1975e7d552dc35c6c7c41a59 *electron-v39.8.4-mas-arm64.zip
++8ee820ece1f08d637ddbea9dae1b9fbe014be88fa20feb1e261a6921c2977e6c *electron-v39.8.4-mas-x64-dsym-snapshot.zip
++044c25405f83c6012c238990b534f47430e308c2c787e1f6d7fe0fb41728b818 *electron-v39.8.4-mas-x64-dsym.zip
++05c1f4fc148222481dc3e88388cbd5451bffdd436293cc0613a9ab1904e76cfa *electron-v39.8.4-mas-x64-symbols.zip
++51c310921e5740a91a75d89819f89757210707a913691fe07d60e84100102d42 *electron-v39.8.4-mas-x64.zip
++3aacf6f224b5438350c1ea5524cb0c962f6d60f8e00f297fc872dce9633aed7d *electron-v39.8.4-win32-arm64-pdb.zip
++180f870fbe3aff8d4ca837ff41b5e1dd04d63b0ae0cc2fcf8d7e20e518f4fcb6 *electron-v39.8.4-win32-arm64-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-arm64-toolchain-profile.zip
++4316324e59d8bceee77366a4ed7a8d3f087ccdf2232b9cac61d600c28fcf0876 *electron-v39.8.4-win32-arm64.zip
++110fa00b9defb546e6110022be00c2f8ef2306b7104e2a1f749dc2b74d467e57 *electron-v39.8.4-win32-ia32-pdb.zip
++ae8c656e2d43493a6c245235ca17f1ddd8ae9632f73348a8f76d76240c5f33f6 *electron-v39.8.4-win32-ia32-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-ia32-toolchain-profile.zip
++f260df3274199f29e32e89efb7bcd846db30d6ccdcc46cc3be9c19be9bc16566 *electron-v39.8.4-win32-ia32.zip
++2e37fd5956a3b73d99e569ea71cc463ba550440835f7672d0651c309d2489c52 *electron-v39.8.4-win32-x64-pdb.zip
++b1601c04324691324b2943aeda1309dbd8dac20cc5f4df32f4aa12d5a68c4b0c *electron-v39.8.4-win32-x64-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-x64-toolchain-profile.zip
++8acc4bb73f05a32eba18bd08e7bc4636e41b2fd00cb538cb90becffbca997789 *electron-v39.8.4-win32-x64.zip
++3675395eef7139544965c3408f1426e4af36055627c5ec0c2fe5abf4cecf6977 *electron.d.ts
++27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.4-darwin-arm64.zip
++321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.4-darwin-x64.zip
++52ae6eccbdb4a9403a6c3eb46b356a28940ec25958b6b9181fb2f38e612e40ed *ffmpeg-v39.8.4-linux-arm64.zip
++622cb781fb1e3b9617e7e60c36384427f7b0d9b5ad888e9bc356a83b050e13f1 *ffmpeg-v39.8.4-linux-armv7l.zip
++ba441851788008362f013bf2983b22b0042af8df31bf90123328f928cc067492 *ffmpeg-v39.8.4-linux-x64.zip
++27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.4-mas-arm64.zip
++321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.4-mas-x64.zip
++71d478432519dda32a53c47eb5fcb97d23265273ff7939da54cccf7a19f6f87e *ffmpeg-v39.8.4-win32-arm64.zip
++3c52c43a62ebf1ebbe0c02611ad4399eb0131257849b707156417ffcbaa144c8 *ffmpeg-v39.8.4-win32-ia32.zip
++5613f1bd387d6c91f4c3901b22643c5400c696e2dacbb7d9893d0e63edc51ae9 *ffmpeg-v39.8.4-win32-x64.zip
++d720519f7417fe58d60d54085a0c32e8e7b65883cad909ee55d1b9b78f86362d *hunspell_dictionaries.zip
++a4c6e3aef474b21e7f002858ddef194da1b64e8b20ecabdaea9533d1d2712738 *libcxx-objects-v39.8.4-linux-arm64.zip
++bd9f1876dddbc413fc3328707f4f7f9daa2df7cb81d4d9e13f520168ec9eb76a *libcxx-objects-v39.8.4-linux-armv7l.zip
++8403bc29cd82a40f422c63fdbaa61b85d28ff58e5e90e378a97c0715133b87c4 *libcxx-objects-v39.8.4-linux-x64.zip
++9bbb19892567a3a9abd0f6288f9f203fa3051387c3e4625fc52eb49adcbe96e5 *libcxx_headers.zip
++9b988e2bb379c6d3094872f600944ad3284510cf225f86368c4f43270b89673c *libcxxabi_headers.zip
++f106faec00f811971cce77bb39a2ef08ddeb3e6b3b6f96991a4ab889c06636a3 *mksnapshot-v39.8.4-darwin-arm64.zip
++23ca2a8fbe7d870c745c6808dced54889883d259fd6a601174b81891dfd1a052 *mksnapshot-v39.8.4-darwin-x64.zip
++23b78843edf3ad2ad2a38eb88578105a75335c397bd4f7cc1fdf54f890fb9d9b *mksnapshot-v39.8.4-linux-arm64-x64.zip
++582d768b97f13d5991fb96dbbba54f7c5da4248634952d77eac342ecd5db29a5 *mksnapshot-v39.8.4-linux-armv7l-x64.zip
++677e242eca2487d1427e035cc9e54750a3bb2528f761af483e5a6d67f81f69dc *mksnapshot-v39.8.4-linux-x64.zip
++fadb9ec8cbf598ef49d5dac34c764a2d2487d41111e3201dd13ad6f09d48c591 *mksnapshot-v39.8.4-mas-arm64.zip
++2a912c91dffeae2e8a97b7e49fe67f7dfb7d13f8e441bb5c2c40d2583ae504ca *mksnapshot-v39.8.4-mas-x64.zip
++fc5478a848c95a1412efdc550d16e4e83c7c2db5f98c658da2430c4275e5f6cb *mksnapshot-v39.8.4-win32-arm64-x64.zip
++b279c6292e1937a9c6aa7421415434e8f40ed7ba818851f57227cdedbdd19e7b *mksnapshot-v39.8.4-win32-ia32.zip
++c5b457d293d35f98d9d548613fce3c6ee111242760d381ed39d6c721b3d09918 *mksnapshot-v39.8.4-win32-x64.zip
+\ No newline at end of file
+diff --git a/cgmanifest.json b/cgmanifest.json
+index 1b1e171..09d805b 100644
+--- a/cgmanifest.json
++++ b/cgmanifest.json
+@@ -531,4 +531,4 @@
+ 					"repositoryUrl": "https://github.com/electron/electron",
+-					"commitHash": "69c8cbf259da0f84e9c1db04958516a68f7170aa",
+-					"tag": "39.8.0"
++					"commitHash": "7007907df08d02da98f513dcbdb430ab51be59c7",
++					"tag": "39.8.4"
+ 				}
+diff --git a/package-lock.json b/package-lock.json
+index 3795213..9d261de 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -104,3 +104,3 @@
+         "deemon": "^1.13.6",
+-        "electron": "39.8.0",
++        "electron": "39.8.4",
+         "eslint": "^9.36.0",
+@@ -8389,5 +8389,5 @@
+     "node_modules/electron": {
+-      "version": "39.8.0",
+-      "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.0.tgz",
+-      "integrity": "sha512-K+f3YelSyh9Q4LgUXuIhLB4kq73LJrqnIbe8ih9vpWi+iSdPebj0w7FRYwILCMDoyBQMFC9LicYHuIPmZzdKlg==",
++      "version": "39.8.4",
++      "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.4.tgz",
++      "integrity": "sha512-eXYKxr4y+s31xs78keVJYg+XY20tGQMQzyIhZvc5L0XRDH2Gp08mbeFlbR1OjAeM5h5l/T2JYT2MFK2kYe2fMg==",
+       "dev": true,
+diff --git a/package.json b/package.json
+index 295d4b3..6e707ed 100644
+--- a/package.json
++++ b/package.json
+@@ -174,3 +174,3 @@
+     "deemon": "^1.13.6",
+-    "electron": "39.8.0",
++    "electron": "39.8.4",
+     "eslint": "^9.36.0",

patches/update-electron.patch.no

@@ -1,203 +0,0 @@
-diff --git a/.npmrc b/.npmrc
-index e4a5cc2..e3be238 100644
---- a/.npmrc
-+++ b/.npmrc
-@@ -1,3 +1,3 @@
- disturl="https://electronjs.org/headers"
--target="39.2.3"
-+target="39.2.7"
- ms_build_id="12895514"
-diff --git a/build/checksums/electron.txt b/build/checksums/electron.txt
-index ace84ba..5da4475 100644
---- a/build/checksums/electron.txt
-+++ b/build/checksums/electron.txt
-@@ -1,75 +1,75 @@
--1e88807c749e69c9a1b2abef105cf30dbec4fddc365afcaa624b1e2df80fe636 *chromedriver-v39.2.3-darwin-arm64.zip
--5cadee0db7684ae48a7f9f4f1310c3f6e1518b0fa88cf3efb36f58984763d43d *chromedriver-v39.2.3-darwin-x64.zip
--8de5ed25a12029ca999455c1cadf28341ec5e0de87a3a0c27dbb24df99f154b1 *chromedriver-v39.2.3-linux-arm64.zip
--766b16d8b1297738a0d1fa7e44d992142558f6e12820197746913385590f033e *chromedriver-v39.2.3-linux-armv7l.zip
--f35049fe3d8dbfdb7c541b59bdca6982b571761bb8cb7fc85515ceaea9451de9 *chromedriver-v39.2.3-linux-x64.zip
--bffe049ac205d87d14d8d2fb61c8f4dfd72b6d60fcd72ebedf7ef78c90ed52d9 *chromedriver-v39.2.3-mas-arm64.zip
--95a7142ba2ba6a418c6d804729dbe4f1fee897cd9ecaf32e554bb9cabff52b9c *chromedriver-v39.2.3-mas-x64.zip
--da1a59e49c16f7b0924b8b43847a19c93110f7d3b5d511cc41d7ec43a5d3807a *chromedriver-v39.2.3-win32-arm64.zip
--9ba84c1e03e31dd630439d53c975b51c21aa4038526dc01970b94464303db5c7 *chromedriver-v39.2.3-win32-ia32.zip
--82d88829e894277d737188afe22a2c82611107f7b31aeb221ae67e56a580dceb *chromedriver-v39.2.3-win32-x64.zip
--aca80a76b97d4b0aa3001882bd8cb7a8fb3f1df75cbc4f0d74eaad0c9df53c9b *electron-api.json
--0fb6f376da5f1bb06125134cd8e33d79a76c4d47b0bc51d20c3359e092095b98 *electron-v39.2.3-darwin-arm64-dsym-snapshot.zip
--6a9e67878637191edcefbd36b070137c3ca4f674307c255864eb9720128905c4 *electron-v39.2.3-darwin-arm64-dsym.zip
--30fd6a23a4a70de3882525c1666af98a2cf07e0826c54bef8f466efb25b1d2ec *electron-v39.2.3-darwin-arm64-symbols.zip
--2128a27c1b0fd80be9d608fb293639f76611b4108eca1e045c933fd04097a7b1 *electron-v39.2.3-darwin-arm64.zip
--68435db35b408d7eb3b9f208f2a7aa803bb8578f409ee99bab435118951a21a5 *electron-v39.2.3-darwin-x64-dsym-snapshot.zip
--59e821dbe0083d4e28a77dff5f72fa65c0db7e7966d760ebb5a41af92da43958 *electron-v39.2.3-darwin-x64-dsym.zip
--cdbe6988a9c9277d5a1acd2f3aaf08e603050f3dae0c10dee4b10d7a6f7cf818 *electron-v39.2.3-darwin-x64-symbols.zip
--f8085a04dc35bfe0c32c36e6feffde07de16459bf36dfab422760181717f5ac0 *electron-v39.2.3-darwin-x64.zip
--ce57eb6bd0ddfa1d37d8a35615276aeb60c19ae0636f21da3270cf07844074b4 *electron-v39.2.3-linux-arm64-debug.zip
--d2652381b24dc05c57a4ce4835b6efc796e6af14419ec80a9ab31f1c3c53f143 *electron-v39.2.3-linux-arm64-symbols.zip
--c58c5904d6015cbbfa5f04fbda5c83b9a276a3565b5f3fa166795c789b055cdd *electron-v39.2.3-linux-arm64.zip
--f0f0be5ea43c0fe84b9609dd5d2b98904c2d4bb8ced9c7c72b72cef377f2734a *electron-v39.2.3-linux-armv7l-debug.zip
--f08ae5371aca8a9f3775a6855c74da71d8817bd9f135c3ba975d428d14f3c42f *electron-v39.2.3-linux-armv7l-symbols.zip
--d7c2f0b5038c49b1e637f8dbda945be4e6f3a6d7ebf802543e6ef5093c9641ff *electron-v39.2.3-linux-armv7l.zip
--aa8b9e4b5eed3a0d2271c01d34551d7dc3e9be30a68af06604c1e2cd3cf93223 *electron-v39.2.3-linux-x64-debug.zip
--d5ebf9628e055b03c90d2d6d4ed86f443b900e264ff34061c953541e27fad5f9 *electron-v39.2.3-linux-x64-symbols.zip
--5eb51ebcb60487c4fc3a5b74ffb57a03eefd48def32200adf310ffaba4153d64 *electron-v39.2.3-linux-x64.zip
--f6cc53c0a45c73779c837d71693f54cc18b12b7148c82c689e2b059772182b84 *electron-v39.2.3-mas-arm64-dsym-snapshot.zip
--0caf9b7b958a7d2ba7e6f757f885842efda3ebc794a2ac048b90cde2926281ee *electron-v39.2.3-mas-arm64-dsym.zip
--c3164da6588c546e728b6fa0754042328cdb43e28dbb0fbcfbda740ed58038fe *electron-v39.2.3-mas-arm64-symbols.zip
--36ea0a98a0480096b4bc6e22c194e999cdfd7f1263c51f08d2815985a8a39ef7 *electron-v39.2.3-mas-arm64.zip
--73d356aa3b51cb261d30f0c27ce354b904d17c3c05c124a1f41112d085e66852 *electron-v39.2.3-mas-x64-dsym-snapshot.zip
--083f53e15a93404b309754df6b5e785785b28e01fdab08a89a45e5024f44e046 *electron-v39.2.3-mas-x64-dsym.zip
--cdd8aaf3b90aedc8c09a44efa03ec67e8426102fad7333ff6bfc257dc6fa01b7 *electron-v39.2.3-mas-x64-symbols.zip
--517d26f9b76b23976d0fc1dcc366e2b50b782592d9b0fc1d814dd1e7ce66efef *electron-v39.2.3-mas-x64.zip
--1a83af2259feb361f7ceb79e047b701ea8297d616487d9d6a79530014d5000c7 *electron-v39.2.3-win32-arm64-pdb.zip
--a154f036378a81859804f660773f6d434770fc311af86dfe01ace5346b9dc788 *electron-v39.2.3-win32-arm64-symbols.zip
--4aae37230f86b1590f102aa038268299bfb55ce2bf3b76ac4d6159e7b6a69f8e *electron-v39.2.3-win32-arm64-toolchain-profile.zip
--b68d623d70c4d0ed76c979027d2a4f6a16bc8dee6f243f5bc2064b4bb52bb34d *electron-v39.2.3-win32-arm64.zip
--be73842257d098ac911b3363e0c11b1d51ab8f6ebd641e512a2e15ccbea73193 *electron-v39.2.3-win32-ia32-pdb.zip
--5f65391f51b5d46d5e0ec7018f3febc0f5b6f072b57310d6d6c9b014de911ff4 *electron-v39.2.3-win32-ia32-symbols.zip
--4aae37230f86b1590f102aa038268299bfb55ce2bf3b76ac4d6159e7b6a69f8e *electron-v39.2.3-win32-ia32-toolchain-profile.zip
--6668fadbdd0283225f4bc60c711f8cd8ac316f43f486cd8a1f62a6a35f89cf7a *electron-v39.2.3-win32-ia32.zip
--430aa905803772476fc1f943e87e4a319d33880d88e08472504531b96834dff1 *electron-v39.2.3-win32-x64-pdb.zip
--9adb254e6ee0d96311cc8056049814436b7e973757d026aac3b533820be027ec *electron-v39.2.3-win32-x64-symbols.zip
--4aae37230f86b1590f102aa038268299bfb55ce2bf3b76ac4d6159e7b6a69f8e *electron-v39.2.3-win32-x64-toolchain-profile.zip
--d4365ad128bbdcb3df99dc4a0ad9de85c5e920903070a473b55377253b6c3fdd *electron-v39.2.3-win32-x64.zip
--feb2f068cd1e2f70bdd7816c13e58dcff9add18fdc8c8e19145a5fd343be541a *electron.d.ts
--4fe4db7f974c64497ddc07c3955a7d83dcfeba61bcec704b33638a4848038d49 *ffmpeg-v39.2.3-darwin-arm64.zip
--8fa2eb8ce5bdf2ecc4cf1f5ebc0f46a4e466fb4841513d482b99838b265995af *ffmpeg-v39.2.3-darwin-x64.zip
--bc72228a7380bc491783602d823bbe2d75e9e417d9b93a40a64be6ff5e3a1bcc *ffmpeg-v39.2.3-linux-arm64.zip
--322698b5ebfae62c34e98c2589b0906b99c15a8181ca3b6d1ffe166ec7d99ab1 *ffmpeg-v39.2.3-linux-armv7l.zip
--40d23294d7bcc48cb3f647f278672021e969a6332cd3cbb06ee681833759626a *ffmpeg-v39.2.3-linux-x64.zip
--4fe4db7f974c64497ddc07c3955a7d83dcfeba61bcec704b33638a4848038d49 *ffmpeg-v39.2.3-mas-arm64.zip
--8fa2eb8ce5bdf2ecc4cf1f5ebc0f46a4e466fb4841513d482b99838b265995af *ffmpeg-v39.2.3-mas-x64.zip
--d324af171e0ae820ec72075924ace2bda96e837ccc79e22b652dda6f82b673b6 *ffmpeg-v39.2.3-win32-arm64.zip
--d982077305d0e4296bed95eb7d2f1048a90b06cfb84d5ddf2a1928e1f07c4dba *ffmpeg-v39.2.3-win32-ia32.zip
--fa65c30f970f9724f4353d068a640592b09a15593b943fa7544cd07e9cace90e *ffmpeg-v39.2.3-win32-x64.zip
--244cd79cf68540e83449ad7d73183416413b3d603cee4496ec07705cbd9338ee *hunspell_dictionaries.zip
--f995e05259eeae64f0e6fbb6d2863aa2fc5846e3ff2dfb3cd22defc3bbbb68d7 *libcxx-objects-v39.2.3-linux-arm64.zip
--3607b4a15aa5f2dbd9e2338ca5451ad8ff646bdac415f9845352d53be1c26ddf *libcxx-objects-v39.2.3-linux-armv7l.zip
--b5020533566dbf22b0b890caa766eb2f4d11675fb1c79c2f41bc54da45a34fc2 *libcxx-objects-v39.2.3-linux-x64.zip
--919a2cc35920b21fbcc5834e858c400f51b607f084c593883c637dba27b9d29a *libcxx_headers.zip
--34e4b44f9c5e08b557a2caed55456ce7690abab910196a783a2a47b58d2b9ac9 *libcxxabi_headers.zip
--661d3578cabe5c98d806d5eeeaee48ac0c997114b9cd76388581e58f6d1c2ce1 *mksnapshot-v39.2.3-darwin-arm64.zip
--c3032c90522e4491e3de641fade3c90be109269108d4ff39b55dbf7331e6eb9a *mksnapshot-v39.2.3-darwin-x64.zip
--bcd8fb45f3b093208346dc2dd2e0b5b70d117e26a70b9619921b26a7f99ba310 *mksnapshot-v39.2.3-linux-arm64-x64.zip
--647762d3d8b01b5123ec11ea5b6984d7b78a26c79ea4d159a3b9fa780de03321 *mksnapshot-v39.2.3-linux-armv7l-x64.zip
--86c0febd8e9ddd8b700c6fb633ec1406bf4fe19ddc2801cb50c01ad345c8ce6e *mksnapshot-v39.2.3-linux-x64.zip
--3676ffc5f489b7d7faafe36fdb5f0f4ce98c8d6fcedfacf6feded7f21b2a50ea *mksnapshot-v39.2.3-mas-arm64.zip
--728936a18c11727d32730c89060dca2d998e7df9159f12bcba2bdf1b51584aad *mksnapshot-v39.2.3-mas-x64.zip
--a3ef9ab1ad5c8172c029dcc36abdc979ecf01f235516120f666595d4d5d02aee *mksnapshot-v39.2.3-win32-arm64-x64.zip
--02584df98255591438ffcc6589bd1ee60af8b8897d08079e7a7dd054e09614fe *mksnapshot-v39.2.3-win32-ia32.zip
--d4dd9de8637d7d8240b7a0686916c0fe84058ad00db9422f5491fbbd7a53cf4b *mksnapshot-v39.2.3-win32-x64.zip
-+ab4c5ce64b92082b15f11ed2a89766fa5542b33d656872678ca0aee99e51a7c8 *chromedriver-v39.2.7-darwin-arm64.zip
-+976f03f6e5e1680e5f8449bd04da531aabec0b664ff462a14f0d41fad0b437af *chromedriver-v39.2.7-darwin-x64.zip
-+28649b04333820f826ea658d18f8111e0a187b3afc498af05b5c59b27ac00155 *chromedriver-v39.2.7-linux-arm64.zip
-+149033ccf7f909214c7d69788bdef2e4ce164cae1091a2f8220f62e495576f9b *chromedriver-v39.2.7-linux-armv7l.zip
-+6a071551518eddc688dd348d3e63b0c55f744589a041943e5706bebfd5337f19 *chromedriver-v39.2.7-linux-x64.zip
-+824ea4699fd6aa6822e453496ebf576174d04e0f0991843b77eb346a842725bc *chromedriver-v39.2.7-mas-arm64.zip
-+aa991650a765b2bc168f8b742341048fa030ee9e3bd0d0799e1b1d29a4c55d0b *chromedriver-v39.2.7-mas-x64.zip
-+a8fc4467bf9be10de3e341648ccd6ad6d618b4456a744137e9f19bd5f9d9bd37 *chromedriver-v39.2.7-win32-arm64.zip
-+01b247563a054617530e454646b086352bc03e02ad4f18e5b65b4e3dfd276a1e *chromedriver-v39.2.7-win32-ia32.zip
-+a8bc2b9052ac8dadeaf88ea9cd6e46ec0032eee2345a0548741bfed922520579 *chromedriver-v39.2.7-win32-x64.zip
-+23486b3effffe5b3bc3ca70261fc9abe2396fd5d018652494f73e3f48cfe57cf *electron-api.json
-+8bee9e905544e60e08468efca91481ec467ab8f108a81846c365782ba0fc737c *electron-v39.2.7-darwin-arm64-dsym-snapshot.zip
-+3be97c3152cd4a84a6fe4013f7e4712422015f4beeb13eb35f8b4d223307d39a *electron-v39.2.7-darwin-arm64-dsym.zip
-+6d5551120d0564fc5596a3b724258da2ce632663d12782c8fdf15a2cc461ed95 *electron-v39.2.7-darwin-arm64-symbols.zip
-+bda657a77c074ee0c6a0e5d5f6de17918d7cf959306b454f6fadb07a08588883 *electron-v39.2.7-darwin-arm64.zip
-+39f0aab332506455337edff540d007c509e72d8c419cdc57f88a0312848f51c9 *electron-v39.2.7-darwin-x64-dsym-snapshot.zip
-+1efed54563ede59d7ae9ba3d548b3e93ede1a4e5dfa510ca22036ea2dd8a2956 *electron-v39.2.7-darwin-x64-dsym.zip
-+3b9bfe84905870c9c36939ffac545d388213ffbb296b969f35ae2a098f6a32b7 *electron-v39.2.7-darwin-x64-symbols.zip
-+d7535e64ad54efcf0fae84d7fea4c2ee4727eec99c78d2a5acc695285cb0a9f0 *electron-v39.2.7-darwin-x64.zip
-+59a3bd71f9c1b355dfbc43f233126cd32b82a53439f0d419e6349044d39e8bbf *electron-v39.2.7-linux-arm64-debug.zip
-+1b326f1a5bea47d9be742554434ddf4f094d7bcdd256f440b808359dc78fcd33 *electron-v39.2.7-linux-arm64-symbols.zip
-+445465a43bd2ffaec09877f4ed46385065632a4683c2806cc6211cc73c110024 *electron-v39.2.7-linux-arm64.zip
-+300c8d11d82cd1257b08e5a08c5e315f758133b627c0271a0f249ba3cb4533d2 *electron-v39.2.7-linux-armv7l-debug.zip
-+034dca3c137c7bfe0736456c1aa0941721e3a9f3a8a72a2786cb817d4edb0f9d *electron-v39.2.7-linux-armv7l-symbols.zip
-+5de99e9f4de8c9ac2fb93df725e834e3e93194c08c99968def7f7b78594fc97c *electron-v39.2.7-linux-armv7l.zip
-+64ef2ae24ae0869ebadb34b178fd7e8375d750d7afe39b42cfa28824f0d11445 *electron-v39.2.7-linux-x64-debug.zip
-+63466c4b6024ae38fdb38ff116abd561b9e36b8d4cd8f8aefbe41289950dba0c *electron-v39.2.7-linux-x64-symbols.zip
-+2f5285ef563dca154aa247696dddef545d3d895dd9b227ed423ea0d43737c22c *electron-v39.2.7-linux-x64.zip
-+ef5a108c1d10148aa031300da10c78feee797afe4ca2a2839819fd8434529860 *electron-v39.2.7-mas-arm64-dsym-snapshot.zip
-+9dd01dc9071b1db9d8fb5e9c81eaa96f551db0a982994881e5750cde2432b0f0 *electron-v39.2.7-mas-arm64-dsym.zip
-+2cf34289d79906c81b3dfd043fbe19a9604cecedd9ebda6576fa3c6f27edfe23 *electron-v39.2.7-mas-arm64-symbols.zip
-+5658d58eacb99fb2a22df0d52ca0507d79f03c85515a123d5e9bee5e0749b93d *electron-v39.2.7-mas-arm64.zip
-+92cd45c3fa64e2889fd1bc6b165c4d12bea40786ce59d6d204cadec6039a8e2a *electron-v39.2.7-mas-x64-dsym-snapshot.zip
-+21464abc837aeab1609fbfa33aa82793e9d32a597db28ea4da483a9d6b6c668a *electron-v39.2.7-mas-x64-dsym.zip
-+8d6e7ffee482514b62465e418049bdf717d308118461e5d97480f5a0eb0b9e20 *electron-v39.2.7-mas-x64-symbols.zip
-+e3b4169ab7bf3bc35cc720ef99032acd3d0eb1521524b5c4667898758dd4e9a3 *electron-v39.2.7-mas-x64.zip
-+3f1d549214a2430d57e5ab8d3cc9d89363340b16905014e35417c632a94732f6 *electron-v39.2.7-win32-arm64-pdb.zip
-+984e1d7718bc920e75a38b114ff73fa52647349763f76e91b64458e5d0fde65f *electron-v39.2.7-win32-arm64-symbols.zip
-+ed66f333ff7b385b2f40845178dc2dc4f25cc887510d766433392733fdd272a3 *electron-v39.2.7-win32-arm64-toolchain-profile.zip
-+56c6f8d957239b7e8d5a214255f39007d44abc98f701ab61054afa83ad46e80f *electron-v39.2.7-win32-arm64.zip
-+c885a8af3226f28081106fa89106f4668b907a53ab3997f3b101b487a76d2878 *electron-v39.2.7-win32-ia32-pdb.zip
-+34edebab8fb5458d97a23461213b39360b5652f8dd6fe8bf7f9c10a17b25a1d2 *electron-v39.2.7-win32-ia32-symbols.zip
-+ed66f333ff7b385b2f40845178dc2dc4f25cc887510d766433392733fdd272a3 *electron-v39.2.7-win32-ia32-toolchain-profile.zip
-+85acd7db5dbb39e16d6c798a649342969569caa2c71d6b5bb1f0c8ae96bca32e *electron-v39.2.7-win32-ia32.zip
-+e6a8e1164106548a1cdf266c615d259feada249e1449df8af1f7e04252575e86 *electron-v39.2.7-win32-x64-pdb.zip
-+90e1feeff5968265b68d8343e27b9f329b27882747633dd10555740de67d58cc *electron-v39.2.7-win32-x64-symbols.zip
-+ed66f333ff7b385b2f40845178dc2dc4f25cc887510d766433392733fdd272a3 *electron-v39.2.7-win32-x64-toolchain-profile.zip
-+3464537fa4be6b7b073f1c9b694ac2eb1f632d6ec36f6eeac9e00d8a279f188c *electron-v39.2.7-win32-x64.zip
-+40c772eb189d100087b75da6c2ad1aeb044f1d661c90543592546a654b0b6d5b *electron.d.ts
-+5a904c2edd12542ce2b6685938cdafe21cf90cd552f2f654058353d1a3d8ee43 *ffmpeg-v39.2.7-darwin-arm64.zip
-+91fc23e9008f43ad3c46f690186d77b291a803451b6d89ac82aadb8ae2dd7995 *ffmpeg-v39.2.7-darwin-x64.zip
-+a44607619c6742c1f9d729265a687b467a25ba397081ac12bc2c0d9ab4bea37b *ffmpeg-v39.2.7-linux-arm64.zip
-+8128ec9be261e2c1017f9b8213f948426119306e5d3acdb59392f32b2c2f0204 *ffmpeg-v39.2.7-linux-armv7l.zip
-+a201a2a64a49ab39def2d38a73e92358ebb57ecae99b0bbc8058353c4be23ea1 *ffmpeg-v39.2.7-linux-x64.zip
-+5a904c2edd12542ce2b6685938cdafe21cf90cd552f2f654058353d1a3d8ee43 *ffmpeg-v39.2.7-mas-arm64.zip
-+91fc23e9008f43ad3c46f690186d77b291a803451b6d89ac82aadb8ae2dd7995 *ffmpeg-v39.2.7-mas-x64.zip
-+6fa4278a41d9c5d733369aa4cce694ba219eb72f7fd181060547c3a4920b5902 *ffmpeg-v39.2.7-win32-arm64.zip
-+12b9e02c0fd07e8bc233c7c4ebab5c737eca05c41f1c5178867cad313433561b *ffmpeg-v39.2.7-win32-ia32.zip
-+caedeb04aa648af14b5a20c9ca902c97eb531a456c7965639465f8764b5d95e0 *ffmpeg-v39.2.7-win32-x64.zip
-+f1320ff95f2cce0f0f7225b45f2b9340aeb38b341b4090f0e58f58dc2da2f3a9 *hunspell_dictionaries.zip
-+8f4ffd7534f21e40621c515bacd178b809c2e52d1687867c60dfdb97ed17fecb *libcxx-objects-v39.2.7-linux-arm64.zip
-+0497730c82e1e76b6a4c22b1af4ebb7821ff6ccb838b78503c0cc93d8a8f03ee *libcxx-objects-v39.2.7-linux-armv7l.zip
-+271e3538eb241f1bc83a103ea7d4c8408ee6bd38322ed50dca781f54d002a590 *libcxx-objects-v39.2.7-linux-x64.zip
-+9a243728553395448f783591737fb229a327499d6853b51e201c36e4aaa9796f *libcxx_headers.zip
-+db3018609bce502c307c59074b3d5273080a68fb50ac1e7fc580994a2e80cc25 *libcxxabi_headers.zip
-+509d0890d1a524efe2c68aae18d2c8fd6537e788b94c9f63fd9f9ca3be98fdb9 *mksnapshot-v39.2.7-darwin-arm64.zip
-+f0a98b428a6a1f8dc4a4663e876a3984157ac8757922cde7461f19755942c180 *mksnapshot-v39.2.7-darwin-x64.zip
-+22fda3b708ab14325b2bfba8e875fbf48b6eacea347ecf1ef41cf24b09b4af8f *mksnapshot-v39.2.7-linux-arm64-x64.zip
-+e7b89dbab3449c0a1862b4d129b3ee384cb5bcd53e149eae05df14744ee55cb5 *mksnapshot-v39.2.7-linux-armv7l-x64.zip
-+53b3ed9f3a69444915ef1eef688c8f8168d52c3d5232834b8aa249cf210b41b6 *mksnapshot-v39.2.7-linux-x64.zip
-+181d962eaa93d8d997b1daf99ae016b3d9d8a5ae037c96a8475490396a8d655f *mksnapshot-v39.2.7-mas-arm64.zip
-+de005b619da1c1afcd8f8b6c70facb1dc388c46a66f8eff3058c8a08323df173 *mksnapshot-v39.2.7-mas-x64.zip
-+6eea0bee6097cf2cfe3ae42b35f847304697c4a4eec84f5b60d1cbbe324a8490 *mksnapshot-v39.2.7-win32-arm64-x64.zip
-+3e769269aa0b51ef9664a982235bc9299fc58743dcf7bce585d49a9f4a074abd *mksnapshot-v39.2.7-win32-ia32.zip
-+51337124892bf76d214f89975d42ec0474199cdfac2f9e08664d86ae8e6ba43e *mksnapshot-v39.2.7-win32-x64.zip
-\ No newline at end of file
-diff --git a/cgmanifest.json b/cgmanifest.json
-index 1148b4e..88150cc 100644
---- a/cgmanifest.json
-+++ b/cgmanifest.json
-@@ -531,4 +531,4 @@
- 					"repositoryUrl": "https://github.com/electron/electron",
--					"commitHash": "14565211f7fd33f3fe2f75ec1254cfa57d5bc848",
--					"tag": "39.2.3"
-+					"commitHash": "4d18062d0f0ca34c455bc7ec032dd7959a0365b6",
-+					"tag": "39.2.7"
- 				}
-diff --git a/package-lock.json b/package-lock.json
-index 2b1154b..cbe427e 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -100,3 +100,3 @@
-         "deemon": "^1.13.6",
--        "electron": "39.2.3",
-+        "electron": "39.2.7",
-         "eslint": "^9.36.0",
-@@ -6188,5 +6188,5 @@
-     "node_modules/electron": {
--      "version": "39.2.3",
--      "resolved": "https://registry.npmjs.org/electron/-/electron-39.2.3.tgz",
--      "integrity": "sha512-j7k7/bj3cNA29ty54FzEMRUoqirE+RBQPhPFP+XDuM93a1l2WcDPiYumxKWz+iKcXxBJLFdMIAlvtLTB/RfCkg==",
-+      "version": "39.2.7",
-+      "resolved": "https://registry.npmjs.org/electron/-/electron-39.2.7.tgz",
-+      "integrity": "sha512-KU0uFS6LSTh4aOIC3miolcbizOFP7N1M46VTYVfqIgFiuA2ilfNaOHLDS9tCMvwwHRowAsvqBrh9NgMXcTOHCQ==",
-       "dev": true,
-diff --git a/package.json b/package.json
-index 9ef8381..f732fa8 100644
---- a/package.json
-+++ b/package.json
-@@ -162,3 +162,3 @@
-     "deemon": "^1.13.6",
--    "electron": "39.2.3",
-+    "electron": "39.2.7",
-     "eslint": "^9.36.0",

patches/version-1-update.patch

@@ -49,17 +49,18 @@ index bc90a03..f8885b9 100644
 +	| "user";
 \ No newline at end of file
 diff --git a/src/vs/platform/update/electron-main/abstractUpdateService.ts b/src/vs/platform/update/electron-main/abstractUpdateService.ts
-index c943bca..1395594 100644
+index c943bca..d216af7 100644
 --- a/src/vs/platform/update/electron-main/abstractUpdateService.ts
 +++ b/src/vs/platform/update/electron-main/abstractUpdateService.ts
-@@ -17,4 +17,4 @@ import { ILogService } from '../../log/common/log.js';
+@@ -17,4 +17,5 @@ import { ILogService } from '../../log/common/log.js';
  import { IProductService } from '../../product/common/productService.js';
 -import { IRequestService } from '../../request/common/request.js';
 -import { AvailableForDownload, DisablementReason, IUpdateService, State, StateType, UpdateType } from '../common/update.js';
-+import { IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
++import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
-+import { Architecture, AvailableForDownload, DisablementReason, IUpdateService, Platform, State, StateType, Target, UpdateType } from '../common/update.js';
++import { Architecture, AvailableForDownload, DisablementReason, IUpdate, IUpdateService, Platform, State, StateType, Target, UpdateType } from '../common/update.js';
++import * as semver from 'semver';
  
-@@ -25,12 +25,8 @@ export interface IUpdateURLOptions {
+@@ -25,12 +26,8 @@ export interface IUpdateURLOptions {
  
 -export function createUpdateURL(baseUpdateUrl: string, platform: string, quality: string, commit: string, options?: IUpdateURLOptions): string {
 -	const url = new URL(`${baseUpdateUrl}/api/update/${platform}/${quality}/${commit}`);
@@ -77,18 +78,64 @@ index c943bca..1395594 100644
 -
 -	return url.toString();
  }
-@@ -322,3 +318,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+@@ -322,3 +319,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
  
 -		if (mode === 'none') {
 +		if (mode === 'none' || mode === 'manual') {
  			return undefined;
-@@ -336,3 +332,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+@@ -332,18 +329,37 @@ export abstract class AbstractUpdateService implements IUpdateService {
- 		try {
+ 
++		return this._isLatestVersion(url, false)
++			.then((result) => {
++				return Promise.resolve(result ? result.lastest : result);
++			})
++			.then(undefined, (error) => {
++				this.logService.error('update#isLatestVersion(): failed to check for updates');
++				this.logService.error(error);
++
++				return Promise.resolve(undefined);
++			});
++	}
++
++	_isLatestVersion(url: string, explicit: boolean): Promise<{lastest: boolean, update: IUpdate} | undefined> {
+ 		const headers = getUpdateRequestHeaders(this.productService.version);
+-		this.logService.trace('update#isLatestVersion() - checking update server', { url, headers });
+ 
+-		try {
 -			const context = await this.requestService.request({ url, headers, callSite: 'updateService.isLatestVersion' }, token);
-+			const context = await this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, token);
+-			const statusCode = context.res.statusCode;
- 			const statusCode = context.res.statusCode;
+-			this.logService.trace('update#isLatestVersion() - response', { statusCode });
+-			// The update server replies with 204 (No Content) when no
+-			// update is available - that's all we want to know.
+-			return statusCode === 204;
++		this.logService.info('update#isLatestVersion() - checking update server', { url, headers });
+ 
+-		} catch (error) {
+-			this.logService.error('update#isLatestVersion(): failed to check for updates');
+-			this.logService.error(error);
+-			return undefined;
+-		}
++		return this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
++			.then<IUpdate | null>(asJson)
++			.then(update => {
++				if (!update || !update.url || !update.version || !update.productVersion) {
++					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
++
++					return Promise.resolve(undefined);
++				}
++
++				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3');
++				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3');
++
++				this.logService.info('update#isLatestVersion() - found version', fetchedVersion, currentVersion);
++
++				const lastest = semver.compareBuild(currentVersion, fetchedVersion) >= 0;
++
++				return Promise.resolve({ lastest, update });
++			})
+ 	}
 diff --git a/src/vs/platform/update/electron-main/updateService.darwin.ts b/src/vs/platform/update/electron-main/updateService.darwin.ts
-index 40b38a2..323919e 100644
+index 40b38a2..81f772d 100644
 --- a/src/vs/platform/update/electron-main/updateService.darwin.ts
 +++ b/src/vs/platform/update/electron-main/updateService.darwin.ts
 @@ -16,3 +16,3 @@ import { ILogService } from '../../log/common/log.js';
@@ -96,11 +143,7 @@ index 40b38a2..323919e 100644
 -import { asJson, IRequestService } from '../../request/common/request.js';
 +import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
  import { ITelemetryService } from '../../telemetry/common/telemetry.js';
-@@ -22,2 +22,3 @@ import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdat
+@@ -99,15 +99,4 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
- import { INodeProcess } from '../../../base/common/platform.js';
-+import * as semver from 'semver';
- 
-@@ -99,15 +100,4 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string | undefined {
 -		const assetID = this.productService.darwinUniversalAssetId ?? (process.arch === 'x64' ? 'darwin' : 'darwin-arm64');
@@ -118,107 +161,127 @@ index 40b38a2..323919e 100644
 +	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string | undefined {
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch);
  	}
-@@ -154,3 +144,30 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+@@ -153,4 +142,30 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
- 		this.logService.trace('update#doCheckForUpdates - using Electron autoUpdater', { url, explicit, background });
+ 
+-		this.logService.trace('update#doCheckForUpdates - using Electron autoUpdater', { url, explicit, background });
 -		electron.autoUpdater.checkForUpdates();
-+		this.requestService.request({ url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
-+			.then<IUpdate | null>(asJson)
-+			.then(update => {
-+				if (!update || !update.url || !update.version || !update.productVersion) {
-+					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
 +
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
++				if(!result) {
 +					return Promise.resolve(null);
 +				}
 +
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
++				if(result.lastest) {
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
 +					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
 +				}
 +				else {
++					this.logService.info('update#doCheckForUpdates - using Electron autoUpdater');
++
 +					electron.autoUpdater.setFeedURL({ url });
 +					electron.autoUpdater.checkForUpdates();
 +				}
 +
 +				return Promise.resolve(null);
 +			})
-+			.then(undefined, err => {
++			.then(undefined, (error) => {
-+				this.logService.error(err);
++				this.logService.error(error);
++
 +				// only show message when explicitly checking for updates
-+				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
++
 +				this.setState(State.Idle(UpdateType.Setup, message));
 +			});
  	}
-@@ -167,3 +184,3 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+@@ -167,3 +182,3 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
  		try {
 -			const context = await this.requestService.request({ url, headers, callSite: 'updateService.darwin.checkForUpdates' }, CancellationToken.None);
 +			const context = await this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None);
  			const statusCode = context.res.statusCode;
 diff --git a/src/vs/platform/update/electron-main/updateService.linux.ts b/src/vs/platform/update/electron-main/updateService.linux.ts
-index 0eb5d74..8ce708e 100644
+index 0eb5d74..16bd215 100644
 --- a/src/vs/platform/update/electron-main/updateService.linux.ts
 +++ b/src/vs/platform/update/electron-main/updateService.linux.ts
-@@ -13,5 +13,6 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
+@@ -5,3 +5,2 @@
+ 
+-import { CancellationToken } from '../../../base/common/cancellation.js';
+ import { IConfigurationService } from '../../configuration/common/configuration.js';
+@@ -13,4 +12,4 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
-+import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
+-import { AvailableForDownload, IUpdate, State, UpdateType } from '../common/update.js';
- import { AvailableForDownload, IUpdate, State, UpdateType } from '../common/update.js';
++import { IRequestService } from '../../request/common/request.js';
++import { AvailableForDownload, State, UpdateType } from '../common/update.js';
  import { AbstractUpdateService, createUpdateURL, IUpdateURLOptions } from './abstractUpdateService.js';
-+import * as semver from 'semver';
+@@ -32,4 +31,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
- 
-@@ -32,4 +33,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string {
 -		return createUpdateURL(this.productService.updateUrl!, `linux-${process.arch}`, quality, commit, options);
 +	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string {
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch);
  	}
-@@ -46,3 +47,3 @@ export class LinuxUpdateService extends AbstractUpdateService {
+@@ -41,2 +40,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
+ 
++		this.setState(State.CheckingForUpdates(explicit));
++
+ 		const internalOrg = this.getInternalOrg();
+@@ -44,17 +45,26 @@ export class LinuxUpdateService extends AbstractUpdateService {
+ 		const url = this.buildUpdateFeedUrl(this.quality, this.productService.commit!, { background, internalOrg });
+-		this.setState(State.CheckingForUpdates(explicit));
  
 -		this.requestService.request({ url, callSite: 'updateService.linux.checkForUpdates' }, CancellationToken.None)
-+		this.requestService.request({ url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
+-			.then<IUpdate | null>(asJson)
- 			.then<IUpdate | null>(asJson)
+-			.then(update => {
-@@ -51,5 +52,17 @@ export class LinuxUpdateService extends AbstractUpdateService {
+-				if (!update || !update.url || !update.version || !update.productVersion) {
- 					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
--				} else {
 +
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
++				if(!result) {
 +					return Promise.resolve(null);
 +				}
 +
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
++				if(result.lastest) {
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+ 					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
-+
+-				} else {
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
+-					this.setState(State.AvailableForDownload(update));
-+					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
-+				}
-+				else {
- 					this.setState(State.AvailableForDownload(update));
  				}
++				else {
++					this.setState(State.AvailableForDownload(result.update));
++				}
 +
 +				return Promise.resolve(null);
  			})
+-			.then(undefined, err => {
+-				this.logService.error(err);
++			.then(undefined, (error) => {
++				this.logService.error(error);
++
+ 				// only show message when explicitly checking for updates
+-				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
++
+ 				this.setState(State.Idle(UpdateType.Archive, message));
 diff --git a/src/vs/platform/update/electron-main/updateService.win32.ts b/src/vs/platform/update/electron-main/updateService.win32.ts
-index d02d7c3..4e8c541 100644
+index d02d7c3..d934da1 100644
 --- a/src/vs/platform/update/electron-main/updateService.win32.ts
 +++ b/src/vs/platform/update/electron-main/updateService.win32.ts
 @@ -14,3 +14,2 @@ import { CancellationToken, CancellationTokenSource } from '../../../base/common
  import { memoize } from '../../../base/common/decorators.js';
 -import { hash } from '../../../base/common/hash.js';
  import * as path from '../../../base/common/path.js';
-@@ -31,7 +30,8 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
+@@ -31,6 +30,6 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
-+import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
++import { IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
  import { ITelemetryService } from '../../telemetry/common/telemetry.js';
 -import { AvailableForDownload, DisablementReason, IUpdate, State, StateType, UpdateType } from '../common/update.js';
 -import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdateURLOptions, UpdateErrorClassification } from './abstractUpdateService.js';
 +import { AvailableForDownload, DisablementReason, IUpdate, State, StateType, Target, UpdateType } from '../common/update.js';
-+import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdateURLOptions } from './abstractUpdateService.js';
++import { AbstractUpdateService, createUpdateURL, IUpdateURLOptions } from './abstractUpdateService.js';
  import { INodeProcess } from '../../../base/common/platform.js';
-+import * as semver from 'semver';
+@@ -49,5 +48,9 @@ function getUpdateType(): UpdateType {
- 
-@@ -49,5 +49,9 @@ function getUpdateType(): UpdateType {
  	if (typeof _updateType === 'undefined') {
 -		_updateType = existsSync(path.join(path.dirname(process.execPath), 'unins000.exe'))
 -			? UpdateType.Setup
@@ -231,12 +294,12 @@ index d02d7c3..4e8c541 100644
 +			_updateType = UpdateType.Archive;
 +		}
  	}
-@@ -164,3 +168,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -164,3 +167,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  		} else {
 -			const fastUpdatesEnabled = this.configurationService.getValue('update.enableWindowsBackgroundUpdates');
 +			const fastUpdatesEnabled = getUpdateType() === UpdateType.Setup && this.configurationService.getValue('update.enableWindowsBackgroundUpdates');
  			// GC for background updates in system setup happens via inno_setup since it requires
-@@ -182,12 +186,22 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -182,12 +185,22 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string | undefined {
 -		let platform = `win32-${process.arch}`;
@@ -245,7 +308,7 @@ index d02d7c3..4e8c541 100644
 -			platform += '-archive';
 -		} else if (this.productService.target === 'user') {
 -			platform += '-user';
-+	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string | undefined {
++	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string {
 +		let target: Target;
 +
 +		switch (getUpdateType()) {
@@ -267,32 +330,60 @@ index d02d7c3..4e8c541 100644
 -		return createUpdateURL(this.productService.updateUrl!, platform, quality, commit, options);
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch, target);
  	}
-@@ -209,3 +223,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -199,6 +212,2 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
- 		const headers = getUpdateRequestHeaders(this.productService.version);
--		this.requestService.request({ url, headers, callSite: 'updateService.win32.checkForUpdates' }, CancellationToken.None)
-+		this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
- 			.then<IUpdate | null>(asJson)
-@@ -226,2 +240,10 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+-		const internalOrg = this.getInternalOrg();
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+-		const background = !explicit && !internalOrg;
+-		const url = this.buildUpdateFeedUrl(this.quality, pendingCommit ?? this.productService.commit!, { background, internalOrg });
+-
+ 		// Only set CheckingForUpdates if we're not already in Overwriting state
+@@ -208,9 +217,13 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 
+-		const headers = getUpdateRequestHeaders(this.productService.version);
+-		this.requestService.request({ url, headers, callSite: 'updateService.win32.checkForUpdates' }, CancellationToken.None)
+-			.then<IUpdate | null>(asJson)
+-			.then(update => {
++		const internalOrg = this.getInternalOrg();
++		const background = !explicit && !internalOrg;
++		const url = this.buildUpdateFeedUrl(this.quality, pendingCommit ?? this.productService.commit!, { background, internalOrg });
 +
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
++
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
+ 				const updateType = getUpdateType();
+ 
+-				if (!update || !update.url || !update.version || !update.productVersion) {
++				if(!result) {
+ 					// If we were checking for an overwrite update and found nothing newer,
+@@ -226,2 +239,9 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 
++				const { lastest, update } = result;
++
++				if(lastest) {
 +					this.setState(State.Idle(updateType, undefined, explicit || undefined));
 +					return Promise.resolve(null);
 +				}
 +
  				if (updateType === UpdateType.Archive) {
-@@ -258,3 +280,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -258,3 +278,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
 -							return this.requestService.request({ url: update.url, callSite: 'updateService.win32.downloadUpdate' }, CancellationToken.None)
 +							return this.requestService.request({ url: update.url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
  								.then(context => {
-@@ -304,3 +326,2 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -303,8 +323,7 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
- 			.then(undefined, err => {
+ 			})
+-			.then(undefined, err => {
 -				this.telemetryService.publicLog2<{ messageHash: string }, UpdateErrorClassification>('update:error', { messageHash: String(hash(String(err))) });
- 				this.logService.error(err);
+-				this.logService.error(err);
-@@ -368,20 +389,31 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
++			.then(undefined, (error) => {
++				this.logService.error(error);
+ 
+ 				// only show message when explicitly checking for updates
+-				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
+ 
+@@ -368,20 +387,31 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  		await pfs.Promises.writeFile(this.availableUpdate.updateFilePath, 'flag');
 -		const child = spawn(this.availableUpdate.packagePath,
 -			[

prepare_assets.sh

@@ -8,198 +8,15 @@ APP_NAME_LC="$( echo "${APP_NAME}" | awk '{print tolower($0)}' )"
 mkdir -p assets
 
 if [[ "${OS_NAME}" == "osx" ]]; then
-  if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  . ./build/osx/prepare_assets.sh
-    if [[ "${CI_BUILD}" == "no" ]]; then
-      RUNNER_TEMP="${TMPDIR}"
-    fi
-
-    CERTIFICATE_P12="${APP_NAME}.p12"
-    KEYCHAIN="${RUNNER_TEMP}/buildagent.keychain"
-    AGENT_TEMPDIRECTORY="${RUNNER_TEMP}"
-    # shellcheck disable=SC2006
-    KEYCHAINS=`security list-keychains | xargs`
-
-    rm -f "${KEYCHAIN}"
-
-    echo "${CERTIFICATE_OSX_P12_DATA}" | base64 --decode > "${CERTIFICATE_P12}"
-
-    echo "+ create temporary keychain"
-    security create-keychain -p pwd "${KEYCHAIN}"
-    security set-keychain-settings -lut 21600 "${KEYCHAIN}"
-    security unlock-keychain -p pwd "${KEYCHAIN}"
-    # shellcheck disable=SC2086
-    security list-keychains -s $KEYCHAINS "${KEYCHAIN}"
-    # security show-keychain-info "${KEYCHAIN}"
-
-    echo "+ import certificate to keychain"
-    security import "${CERTIFICATE_P12}" -k "${KEYCHAIN}" -P "${CERTIFICATE_OSX_P12_PASSWORD}" -T /usr/bin/codesign
-    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd "${KEYCHAIN}" > /dev/null
-    # security find-identity "${KEYCHAIN}"
-
-    CODESIGN_IDENTITY="$( security find-identity -v -p codesigning "${KEYCHAIN}" | grep -oEi "([0-9A-F]{40})" | head -n 1 )"
-
-    echo "+ signing"
-    export CODESIGN_IDENTITY AGENT_TEMPDIRECTORY
-
-    DEBUG="electron-osx-sign*" node vscode/build/darwin/sign.ts "$( pwd )"
-    # codesign --display --entitlements :- ""
-
-    echo "+ notarize"
-
-    cd "VSCode-darwin-${VSCODE_ARCH}"
-    ZIP_FILE="./${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip"
-
-    zip -r -X -y "${ZIP_FILE}" ./*.app
-
-    xcrun notarytool store-credentials "${APP_NAME}" --apple-id "${CERTIFICATE_OSX_ID}" --team-id "${CERTIFICATE_OSX_TEAM_ID}" --password "${CERTIFICATE_OSX_APP_PASSWORD}" --keychain "${KEYCHAIN}"
-    # xcrun notarytool history --keychain-profile "${APP_NAME}" --keychain "${KEYCHAIN}"
-    xcrun notarytool submit "${ZIP_FILE}" --keychain-profile "${APP_NAME}" --wait --keychain "${KEYCHAIN}"
-
-    echo "+ attach staple"
-    xcrun stapler staple ./*.app
-    # spctl --assess -vv --type install ./*.app
-
-    rm "${ZIP_FILE}"
-
-    cd ..
-  fi
-
-  if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
-    echo "Building and moving ZIP"
-    cd "VSCode-darwin-${VSCODE_ARCH}"
-    zip -r -X -y "../assets/${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ./*.app
-    cd ..
-  fi
-
-  if [[ -n "${CERTIFICATE_OSX_P12_DATA}" && "${SHOULD_BUILD_DMG}" != "no" ]]; then
-    echo "Building and moving DMG"
-    pushd "VSCode-darwin-${VSCODE_ARCH}"
-    npx create-dmg ./*.app .
-    mv ./*.dmg "../assets/${APP_NAME}.${VSCODE_ARCH}.${RELEASE_VERSION}.dmg"
-    popd
-  fi
-
-  if [[ "${SHOULD_BUILD_SRC}" == "yes" ]]; then
-    git archive --format tar.gz --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.tar.gz" HEAD
-    git archive --format zip --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.zip" HEAD
-  fi
-
-  if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
-    echo "+ clean"
-    security delete-keychain "${KEYCHAIN}"
-    # shellcheck disable=SC2086
-    security list-keychains -s $KEYCHAINS
-  fi
 
   VSCODE_PLATFORM="darwin"
 elif [[ "${OS_NAME}" == "windows" ]]; then
-  cd vscode || { echo "'vscode' dir not found"; exit 1; }
+  . ./build/windows/prepare_assets.sh
-
-  npm run gulp "vscode-win32-${VSCODE_ARCH}-inno-updater"
-
-  if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
-    7z.exe a -tzip "../assets/${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" -x!CodeSignSummary*.md -x!tools "../VSCode-win32-${VSCODE_ARCH}/*" -r
-  fi
-
-  # . ../build/windows/appx/build.sh
-
-  if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
-    npm run gulp "vscode-win32-${VSCODE_ARCH}-system-setup"
-  fi
-
-  if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
-    npm run gulp "vscode-win32-${VSCODE_ARCH}-user-setup"
-  fi
-
-  if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
-    if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
-      . ../build/windows/msi/build.sh
-    fi
-
-    if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
-      . ../build/windows/msi/build-updates-disabled.sh
-    fi
-  fi
-
-  cd ..
-
-  if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
-    echo "Moving System EXE"
-    mv "vscode\\.build\\win32-${VSCODE_ARCH}\\system-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
-  fi
-
-  if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
-    echo "Moving User EXE"
-    mv "vscode\\.build\\win32-${VSCODE_ARCH}\\user-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
-  fi
-
-  if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
-    if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
-      echo "Moving MSI"
-      mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" assets/
-    fi
-
-    if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
-      echo "Moving MSI with disabled updates"
-      mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" assets/
-    fi
-  fi
 
   VSCODE_PLATFORM="win32"
 else
-  cd vscode || { echo "'vscode' dir not found"; exit 1; }
+  . ./build/linux/prepare_assets.sh
-
-  if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" && "${VSCODE_ARCH}" != "x64" ]]; then
-    SHOULD_BUILD_APPIMAGE="no"
-  fi
-
-  if [[ "${SHOULD_BUILD_DEB}" != "no" || "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
-    npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-deb"
-    npm run gulp "vscode-linux-${VSCODE_ARCH}-build-deb"
-  fi
-
-  if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
-    npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-rpm"
-    npm run gulp "vscode-linux-${VSCODE_ARCH}-build-rpm"
-  fi
-
-  if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
-    . ../build/linux/appimage/build.sh
-  fi
-
-  cd ..
-
-  if [[ "${CI_BUILD}" == "no" ]]; then
-    . ./stores/snapcraft/build.sh
-
-    if [[ "${SKIP_ASSETS}" == "no" ]]; then
-      mv stores/snapcraft/build/*.snap assets/
-    fi
-  fi
-
-  if [[ "${SHOULD_BUILD_TAR}" != "no" ]]; then
-    echo "Building and moving TAR"
-    cd "VSCode-linux-${VSCODE_ARCH}"
-    tar czf "../assets/${APP_NAME}-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" .
-    cd ..
-  fi
-
-  if [[ "${SHOULD_BUILD_DEB}" != "no" ]]; then
-    echo "Moving DEB"
-    mv vscode/.build/linux/deb/*/deb/*.deb assets/
-  fi
-
-  if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
-    echo "Moving RPM"
-    mv vscode/.build/linux/rpm/*/*.rpm assets/
-  fi
-
-  if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
-    echo "Moving AppImage"
-    mv build/linux/appimage/out/*.AppImage* assets/
-
-    find assets -name '*.AppImage*' -exec bash -c 'mv $0 ${0/_-_/-}' {} \;
-  fi
 
   VSCODE_PLATFORM="linux"
 fi

release_notes.md

@@ -221,7 +221,15 @@ update vscode to [@@MS_TAG@@](@@MS_URL@@)
 
 <table>
   <tr>
-    <td rowspan="3">Linux</td>
+    <td rowspan="6">Linux</td>
+    <td>.deb</td>
+    <td><a href="https://github.com/@@ASSETS_REPOSITORY@@/releases/download/@@VERSION@@@@QUALITY@@/@@BINARY_NAME@@_@@VERSION@@_ppc64el.deb">@@BINARY_NAME@@_@@VERSION@@_ppc64el.deb</a></td>
+  </tr>
+  <tr>
+    <td>.rpm</td>
+    <td><a href="https://github.com/@@ASSETS_REPOSITORY@@/releases/download/@@VERSION@@@@QUALITY@@/@@BINARY_NAME@@-@@VERSION@@-el8.ppc64le.rpm">@@BINARY_NAME@@-@@VERSION@@-el8.ppc64le.rpm</a></td>
+  </tr>
+  <tr>
     <td>.tar.gz</td>
     <td><a href="https://github.com/@@ASSETS_REPOSITORY@@/releases/download/@@VERSION@@@@QUALITY@@/@@APP_NAME@@-linux-ppc64le-@@VERSION@@@@QUALITY@@.tar.gz">@@APP_NAME@@-linux-ppc64le-@@VERSION@@@@QUALITY@@.tar.gz</a></td>
   </tr>
@@ -233,6 +241,10 @@ update vscode to [@@MS_TAG@@](@@MS_URL@@)
     <td>Web Host</td>
     <td><a href="https://github.com/@@ASSETS_REPOSITORY@@/releases/download/@@VERSION@@@@QUALITY@@/@@APP_NAME_LC@@-reh-web-linux-ppc64le-@@VERSION@@@@QUALITY@@.tar.gz">@@APP_NAME_LC@@-reh-web-linux-ppc64le-@@VERSION@@@@QUALITY@@.tar.gz</a></td>
   </tr>
+  <tr>
+    <td>CLI</td>
+    <td><a href="https://github.com/@@ASSETS_REPOSITORY@@/releases/download/@@VERSION@@@@QUALITY@@/@@APP_NAME_LC@@-cli-linux-ppc64le-@@VERSION@@@@QUALITY@@.tar.gz">@@APP_NAME_LC@@-cli-linux-ppc64le-@@VERSION@@@@QUALITY@@.tar.gz</a></td>
+  </tr>
 </table>
 
 ## RISC-V 64bits

stores/snapcraft/check_version.sh

@@ -26,9 +26,15 @@ else
 
     sudo snap install --channel "${CHANNEL}" --classic snapcraft
 
+    if [[ ! "$( snapcraft whoami )" =~ "${SNAP_PUBLISHER}" ]]; then
+      echo "FATAL -- Not authentificated"
+
+      exit 1
+    fi
+
     echo "Architecture: ${ARCHITECTURE}"
 
-    SNAP_VERSION=$( snapcraft list-revisions "${SNAP_NAME}" | grep -F "${CHANNEL}*" | grep "${ARCHITECTURE}" | tr -s ' ' | cut -d ' ' -f 4 )
+    SNAP_VERSION=$( snapcraft revisions "${SNAP_NAME}" | grep -F "${CHANNEL}*" | grep "${ARCHITECTURE}" | tr -s ' ' | cut -d ' ' -f 4 )
     echo "Snap version: ${SNAP_VERSION}"
 
     if [[ -n "${SNAP_VERSION}" && "${SNAP_VERSION}" != "${RELEASE_VERSION}" ]]; then
@@ -45,4 +51,8 @@ if [[ "${GITHUB_ENV}" ]]; then
   echo "SHOULD_BUILD=${SHOULD_BUILD}" >> "${GITHUB_ENV}"
   echo "SHOULD_DEPLOY_TO_RELEASE=${SHOULD_DEPLOY_TO_RELEASE}" >> "${GITHUB_ENV}"
 	echo "SHOULD_DEPLOY_TO_STORE=${SHOULD_DEPLOY_TO_STORE}" >> "${GITHUB_ENV}"
+else
+  echo "SHOULD_BUILD=${SHOULD_BUILD}"
+  echo "SHOULD_DEPLOY_TO_RELEASE=${SHOULD_DEPLOY_TO_RELEASE}"
+	echo "SHOULD_DEPLOY_TO_STORE=${SHOULD_DEPLOY_TO_STORE}"
 fi