feat(1.116): update apis (#2808)

Three new patches extending workbench font customization to all areas:
- feat-workbench-zz-area-font-family: fontFamily for sidebar, statusbar,
  tabs, panel, activitybar + global fontSize setting
- feat-workbench-zz-area-font-size-core: fontSize for statusbar,
  activitybar, panel with proportional scaling via FONT object
- feat-workbench-zz-area-font-size-tabs: fontSize for tabs with CSS
  variable scaling for tab heights and widths

Includes fixes from audit review:
- Fix stale CSS var when fontSize reverts to default (cache isUserSet)
- Fix else-if config listener blocking simultaneous updates
- Trigger grid relayout after statusbar font-size change
- Apply activitybar font before show() for correct initial sizing
- Trigger tab relayout after font-size change
- Standardize CSS fallback chains to include global font-size
- Extract inspectFontSize() helper to reduce duplication
- Replace magic 1.833333 ratio with explicit CSS height variable

.github/dependabot.yml

@@ -1,11 +1,9 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: insider
     schedule:
-      interval: "weekly"
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci-build-linux.yml

@@ -0,0 +1,371 @@
+name: CI - Build - Linux
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  DISABLE_UPDATE: yes
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: linux
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: ubuntu-22.04
+    env:
+      VSCODE_ARCH: x64
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+          image: vscodium/vscodium-linux-build-agent:focal-x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+          image: vscodium/vscodium-linux-build-agent:focal-arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+          image: vscodium/vscodium-linux-build-agent:focal-armhf
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+          image: vscodium/vscodium-linux-build-agent:focal-riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+          image: vscodium/vscodium-linux-build-agent:crimson-loong64
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+          image: vscodium/vscodium-linux-build-agent:focal-ppc64le
+    container:
+      image: ${{ matrix.image }}
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_APP_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install dependencies
+        run: ./build/linux/deps.sh
+        if: env.DISABLED != 'yes'
+
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes'
+
+      - name: Build
+        id: build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_bin.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Prepare assets
+        env:
+          SHOULD_BUILD_APPIMAGE: ${{ vars[format('DISABLE_{0}_APPIMAGE', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] == 'yes' && 'no' || 'yes' }}
+          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
+        run: ./prepare_assets.sh
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_linux:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+        - slug: S390X
+          vscode_arch: s390x
+          npm_arch: s390x
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.DISABLED != 'yes'
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-linux-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_alpine:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_ALPINE_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      OS_NAME: alpine
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/alpine/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-alpine-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-macos.yml

@@ -0,0 +1,90 @@
+name: CI - Build - macOS
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ${{ matrix.runner }}
+    env:
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-intel
+            vscode_arch: x64
+          - runner: [self-hosted, macOS, ARM64]
+            vscode_arch: arm64
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: . get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.VSCODE_ARCH == 'x64'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-windows.yml

@@ -0,0 +1,166 @@
+name: CI - Build - Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: windows
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: windows-2022
+    defaults:
+      run:
+        shell: bash
+    env:
+      VSCODE_ARCH: 'x64'
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        vscode_arch:
+          - x64
+          - arm64
+    defaults:
+      run:
+        shell: bash
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD_REH: no
+      SHOULD_BUILD_REH_WEB: no
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+
+      - name: Build
+        env:
+          DISABLE_MSI: ${{ vars[format('DISABLE_{0}_MSI', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.vscode_arch }}
+          npm_config_target_arch: ${{ matrix.vscode_arch }}
+        run: ./build/windows/package.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Prepare checksums
+        run: ./prepare_checksums.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: github.event.inputs.generate_assets == 'true'

.github/workflows/insider-spearhead.yml

@@ -1,90 +0,0 @@
-name: insider-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-      dont_dispatch:
-        type: boolean
-        description: Disable dispatch
-  schedule:
-    - cron: '0 7 * * *'
-
-jobs:
-  build:
-    runs-on: macos-14
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}-insiders
-      BINARY_NAME: codium-insiders
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: insider
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: insider
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.18.2'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v6
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v3
-        with:
-          event-type: insider
-        if: github.event.inputs.dont_dispatch != 'true' && (env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true')

.github/workflows/lint-zizmor.yml

@@ -0,0 +1,30 @@
+name: Lint - zizmor
+
+on:
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

.github/workflows/lock.yml

@@ -1,16 +0,0 @@
-name: Lock Issues
-
-on:
-  schedule:
-    - cron: '0 2 * * *'
-
-jobs:
-  lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/lock-threads@v5
-        with:
-          github-token: ${{ github.token }}
-          issue-inactive-days: '90'
-          pr-inactive-days: '90'
-          log-output: true

.github/workflows/mod-lock-closed-threads.yml

@@ -0,0 +1,22 @@
+name: Moderation - Lock Closed Threads
+
+on:
+  schedule:
+    - cron: 0 2 * * *
+
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: "90"
+          pr-inactive-days: "90"
+          discussion-inactive-days: "90"
+          log-output: true

.github/workflows/mod-stale-issue-pr.yml

@@ -0,0 +1,24 @@
+name: Moderation - Stale Issues & PR
+
+on:
+  schedule:
+    - cron: 0 1 * * *
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          days-before-stale: 180
+          days-before-close: 30
+          operations-per-run: 1024
+          stale-issue-message: This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
+          close-issue-message: This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
+          exempt-issue-labels: discussion,never-stale
+          stale-pr-message: This PR has been automatically marked as stale.
+          close-pr-message: This PR has been closed due to inactivity, and will not be monitored.
+          only-pr-labels: needs-information

.github/workflows/publish-insider-linux.yml

@@ -1,37 +1,19 @@
-name: insider-linux
+name: Publish - Insider - Linux
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [insider]
-  push:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-insider
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -40,77 +22,66 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -123,8 +94,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +108,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +120,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -172,7 +146,7 @@ jobs:
         - slug: LOONG64
           vscode_arch: loong64
           npm_arch: loong64
-          image: vscodium/vscodium-linux-build-agent:beige-loong64
+          image: vscodium/vscodium-linux-build-agent:crimson-loong64
         - slug: PPC64
           vscode_arch: ppc64le
           npm_arch: ppc64
@@ -185,29 +159,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Install GH
-        run: ./install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -221,16 +188,17 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Build
+        id: build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
@@ -241,37 +209,34 @@ jobs:
         env:
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -304,37 +269,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -344,8 +303,8 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Install GH
-        run: ./install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -355,38 +314,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -405,29 +359,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
       - name: Install GH
-        run: ./install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
+        run: ./build/linux/install_gh.sh
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -440,45 +393,38 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium-insiders-bin
         - package_name: vscodium-insiders
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
 
     steps:
       - name: Get version
@@ -487,7 +433,7 @@ jobs:
         run: echo "PACKAGE_VERSION=${RELEASE_VERSION/-*/}" >> "${GITHUB_ENV}"
 
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_version: ${{ env.PACKAGE_VERSION }}
@@ -500,6 +446,9 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium-insiders
@@ -509,32 +458,28 @@ jobs:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
-      - uses: docker/setup-qemu-action@v3
-
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
         with:
           path: stores/snapcraft/insider
           architecture: ${{ matrix.platform }}
         id: build
 
-      - uses: diddlesnaps/snapcraft-review-action@v1
-        with:
-          snap: ${{ steps.build.outputs.snap }}
-          isClassic: 'true'
+      # - uses: diddlesnaps/snapcraft-review-action@v1
+      #   with:
+      #     snap: ${{ steps.build.outputs.snap }}
+      #     isClassic: 'true'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -546,11 +491,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-insider-macos.yml

@@ -1,35 +1,17 @@
-name: insider-macos
+name: Publish - Insider - macOS
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [insider]
-  push:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-insider
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,51 +20,44 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - runner: macos-13
+          - runner: macos-15-intel
             vscode_arch: x64
           - runner: [self-hosted, macOS, ARM64]
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
+          persist-credentials: false
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -98,30 +73,21 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-insider-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Insider - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 7 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}-insiders
+  BINARY_NAME: codium-insiders
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: insider
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-insider
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-insider-windows.yml

@@ -1,35 +1,17 @@
-name: insider-windows
+name: Publish - Insider - Windows
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [insider]
-  push:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-insider
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,81 +20,62 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
-    runs-on: ubuntu-22.04
+    runs-on: windows-2022
+    permissions: {}
+    defaults:
+      run:
+        shell: bash
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
-        with:
-          version: 10
-          platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Install libkrb5-dev
-        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Clone VSCode repo
@@ -121,8 +84,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -135,18 +98,21 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
     needs:
       - check
       - compile
-    runs-on: windows-2019
+    runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -161,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -200,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -215,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v1
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -239,52 +198,46 @@ jobs:
           artifact-configuration-slug: ${{ matrix.vscode_arch }}
           wait-for-completion: true
           # 3h to manually approve the request
-          wait-for-completion-timeout-in-seconds: 10800
+          wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
   winget:
     needs: build
-    runs-on: windows-latest
+    runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium.Insiders
       ASSETS_REPOSITORY: vscodium-insiders
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -292,7 +245,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/publish-stable-linux.yml

@@ -1,36 +1,19 @@
-name: stable-linux
+name: Publish - Stable - Linux
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [stable]
-  push:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-stable
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -39,79 +22,67 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
+          FORCE_LINUX_SNAP: ${{ github.event.inputs.force_snap }}
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -124,8 +95,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -138,11 +109,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -150,6 +121,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -173,7 +147,7 @@ jobs:
         - slug: LOONG64
           vscode_arch: loong64
           npm_arch: loong64
-          image: vscodium/vscodium-linux-build-agent:beige-loong64
+          image: vscodium/vscodium-linux-build-agent:crimson-loong64
         - slug: PPC64
           vscode_arch: ppc64le
           npm_arch: ppc64
@@ -186,29 +160,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-        if: env.DISABLED != 'yes'
-
       - name: Install GH
-        run: ./install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -222,16 +189,17 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Build
+        id: build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
@@ -242,37 +210,34 @@ jobs:
         env:
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -305,37 +270,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -345,8 +304,8 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Install GH
-        run: ./install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -356,38 +315,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -406,29 +360,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
       - name: Install GH
-        run: ./install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
+        run: ./build/linux/install_gh.sh
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -441,51 +394,42 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium
           package_type: stable
-        # - package_name: vscodium-git
-        #   package_type: rolling
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_type: ${{ matrix.package_type }}
@@ -498,26 +442,25 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium
+      SNAP_PUBLISHER: vscodium
     strategy:
       fail-fast: false
       matrix:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Check version
         env:
@@ -527,23 +470,21 @@ jobs:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         run: ./stores/snapcraft/check_version.sh
 
-      - uses: docker/setup-qemu-action@v3
-        if: env.SHOULD_BUILD == 'yes'
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
         with:
           path: stores/snapcraft/stable
           architecture: ${{ matrix.platform }}
         id: build
-        if: env.SHOULD_BUILD == 'yes'
 
-      - uses: diddlesnaps/snapcraft-review-action@v1
+      - uses: diddlesnaps/snapcraft-review-action@40554b42331cf84dab19ef98c382620427f13482 # v1.3.1
         with:
           snap: ${{ steps.build.outputs.snap }}
           isClassic: 'true'
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes' || env.SHOULD_DEPLOY_TO_STORE == 'yes'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -551,7 +492,7 @@ jobs:
           tag: ${{ env.RELEASE_VERSION }}
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes'
 
-      - uses: snapcore/action-publish@master
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         with:
@@ -564,7 +505,8 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
@@ -577,11 +519,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-stable-macos.yml

@@ -1,34 +1,17 @@
-name: stable-macos
+name: Publish - Stable - macOS
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [stable]
-  push:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-stable
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,51 +20,44 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - runner: macos-13
+          - runner: macos-15-intel
             vscode_arch: x64
           - runner: [self-hosted, macOS, ARM64]
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
+          persist-credentials: false
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -97,29 +73,20 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-stable-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Stable - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 18 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}
+  BINARY_NAME: codium
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: stable
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-stable
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-stable-windows.yml

@@ -1,34 +1,17 @@
-name: stable-windows
+name: Publish - Stable - Windows
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [stable]
-  push:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-stable
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,81 +20,62 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
-    runs-on: ubuntu-22.04
+    runs-on: windows-2022
+    permissions: {}
+    defaults:
+      run:
+        shell: bash
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v1
-        with:
-          version: 10
-          platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Install libkrb5-dev
-        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Clone VSCode repo
@@ -120,8 +84,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -134,18 +98,21 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
     needs:
       - check
       - compile
-    runs-on: windows-2019
+    runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -160,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20.18.2'
+          node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -199,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -214,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v1
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -237,51 +197,45 @@ jobs:
           github-artifact-id: ${{ steps.upload-unsigned-artifacts.outputs.artifact-id }}
           artifact-configuration-slug: ${{ matrix.vscode_arch }}
           wait-for-completion: true
-          # 3h to manually approve the request
-          wait-for-completion-timeout-in-seconds: 10800
+          # 8h to manually approve the request
+          wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
   winget:
     needs: build
-    runs-on: windows-latest
+    runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -289,7 +243,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/stable-spearhead.yml

@@ -1,85 +0,0 @@
-name: stable-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-  schedule:
-    - cron: '0 18 * * *'
-
-jobs:
-  build:
-    runs-on: macos-14
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}
-      BINARY_NAME: codium
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: stable
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.18.2'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v6
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v3
-        with:
-          event-type: stable
-        if: env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true'

.github/workflows/stale.yml

@@ -1,25 +0,0 @@
-name: Stale Issues
-
-on:
-  schedule:
-    - cron: '0 1 * * *'
-
-permissions:
-  issues: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v9
-        with:
-          days-before-stale: 180
-          days-before-close: 30
-          stale-issue-label: stale
-          operations-per-run: 1024
-          stale-issue-message: >
-            This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
-          close-issue-message: >
-            This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
-          exempt-issue-labels: discussion,never-stale
-          only-pr-labels: needs-information

.gitignore

@@ -14,5 +14,8 @@ build/linux/appimage/VSCodium
 build/windows/msi/releasedir
 build/windows/msi/Files*.wxs
 build/windows/msi/Files*.wixobj
+sourcemaps/
 stores/snapcraft/insider/*.snap
 stores/snapcraft/stable/*.snap
+font-size/node_modules/
+font-size/generate-css.js

.nvmrc

@@ -1 +1 @@
-20.18.1
+22.22.1

README.md

@@ -2,7 +2,7 @@
     <br />
     <img src="./icons/stable/codium_cnl.svg" alt="VSCodium Logo" width="200"/>
     <h1>VSCodium</h1>
-    <h3>Free/Libre Open Source Software Binaries of VS Code</h3>
+    <h3>Free/Libre Open Source Software Binaries of Visual Studio Code</h3>
 </div>
 
 <div id="badges" align="center">
@@ -59,8 +59,6 @@ brew install --cask vscodium
 brew install --cask vscodium@insiders
 ```
 
-*Note for macOS users: if you can't open the App, please read [the following troubleshooting](https://github.com/VSCodium/vscodium/blob/master/docs/troubleshooting.md#macos).*
-
 #### <a id="install-with-winget"></a>Install with Windows Package Manager (WinGet)
 
 If you use Windows and have [Windows Package Manager](https://github.com/microsoft/winget-cli) installed:
@@ -133,7 +131,7 @@ Build instructions can be found [here](https://github.com/VSCodium/vscodium/blob
 
 ## <a id="why"></a>Why Does This Exist
 
-This repository contains build files to generate free release binaries of Microsoft's VS Code. When we speak of "free software", we're talking about freedom, not price.
+This repository contains build files to generate free release binaries of Microsoft's Visual Studio Code. When we speak of "free software", we're talking about freedom, not price.
 
 Microsoft's releases of Visual Studio Code are licensed under [this not-FLOSS license](https://code.visualstudio.com/license) and contain telemetry/tracking. According to [this comment](https://github.com/Microsoft/vscode/issues/60#issuecomment-161792005) from a Visual Studio Code maintainer:
 
@@ -143,7 +141,7 @@ Microsoft's releases of Visual Studio Code are licensed under [this not-FLOSS li
 
 This repo exists so that you don't have to download+build from source. The build scripts in this repo clone Microsoft's vscode repo, run the build commands, and upload the resulting binaries to [GitHub releases](https://github.com/VSCodium/vscodium/releases). __These binaries are licensed under the MIT license. Telemetry is disabled.__
 
-If you want to build from source yourself, head over to [Microsoft's vscode repo](https://github.com/Microsoft/vscode) and follow their [instructions](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#build-and-run). This repo exists to make it easier to get the latest version of MIT-licensed VS Code.
+If you want to build from source yourself, head over to [Microsoft's vscode repo](https://github.com/Microsoft/vscode) and follow their [instructions](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#build-and-run). This repo exists to make it easier to get the latest version of MIT-licensed Visual Studio Code.
 
 Microsoft's build process (which we are running to build the binaries) does download additional files. Those packages downloaded during build are:
 
@@ -167,9 +165,9 @@ If you have any issue, please check [the Troubleshooting page](https://github.co
 
 ### Extensions and the Marketplace
 
-According to the VS Code Marketplace [Terms of Use](https://aka.ms/vsmarketplace-ToU), _you may only install and use Marketplace Offerings with Visual Studio Products and Services._ For this reason, VSCodium uses [open-vsx.org](https://open-vsx.org/), an open source registry for VS Code extensions. See the [Extensions + Marketplace](https://github.com/VSCodium/vscodium/blob/master/docs/index.md#extensions-marketplace) section on the Docs page for more details.
+According to the Visual Studio Marketplace [Terms of Use](https://aka.ms/vsmarketplace-ToU), _you may only install and use Marketplace Offerings with Visual Studio Products and Services._ For this reason, VSCodium uses [open-vsx.org](https://open-vsx.org/), an open source registry for Visual Studio Code extensions. See the [Extensions + Marketplace](https://github.com/VSCodium/vscodium/blob/master/docs/index.md#extensions-marketplace) section on the Docs page for more details.
 
-Please note that some Visual Studio Code extensions have licenses that restrict their use to the official Visual Studio Code builds and therefore do not work with VSCodium. See [this note](https://github.com/VSCodium/vscodium/blob/master/docs/index.md#proprietary-debugging-tools) on the Docs page for what's been found so far and possible workarounds.
+Please note that some Visual Studio Code extensions have licenses that restrict their use to the official Visual Studio Code builds and therefore do not work with VSCodium. See [this note](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#proprietary-debugging-tools) on the Docs page for what's been found so far and possible workarounds.
 
 ### How are the VSCodium binaries built?
 

announcements-extra.json

@@ -1,7 +1,7 @@
 [
   {
-    "id": "#1227",
-    "title": "Issue(macOS): manual update to `1.90.x`",
-    "url": "https://github.com/VSCodium/vscodium/issues/1917"
+    "id": "#2668",
+    "title": "[Windows] broken update on 1.107, need manual update",
+    "url": "https://github.com/VSCodium/vscodium/issues/2668"
   }
 ]

build.sh

@@ -13,20 +13,19 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
   cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
   export NODE_OPTIONS="--max-old-space-size=8192"
+  export VSCODE_PUBLISH_COUNTER=1
 
-  npm run monaco-compile-check
-  npm run valid-layers-check
-
-  npm run gulp compile-build-without-mangling
-  npm run gulp compile-extension-media
-  npm run gulp compile-extensions-build
-  npm run gulp minify-vscode
+  npm run gulp vscode-min-prepack
 
   if [[ "${OS_NAME}" == "osx" ]]; then
-    # generate Group Policy definitions
-    node build/lib/policies darwin
+    # remove win32 node modules
+    rm -f .build/extensions/ms-vscode.js-debug/src/win32-app-container-tokens.*.node
 
-    npm run gulp "vscode-darwin-${VSCODE_ARCH}-min-ci"
+    # generate Group Policy definitions
+    npm run copy-policy-dto --prefix build
+    node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc darwin
+
+    npm run gulp "vscode-darwin-${VSCODE_ARCH}-min-packing"
 
     find "../VSCode-darwin-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 
@@ -34,14 +33,15 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
 
     VSCODE_PLATFORM="darwin"
   elif [[ "${OS_NAME}" == "windows" ]]; then
-    # generate Group Policy definitions
-    node build/lib/policies win32
-
     # in CI, packaging will be done by a different job
     if [[ "${CI_BUILD}" == "no" ]]; then
       . ../build/windows/rtf/make.sh
 
-      npm run gulp "vscode-win32-${VSCODE_ARCH}-min-ci"
+      # generate Group Policy definitions
+      npm run copy-policy-dto --prefix build
+      node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc win32
+
+      npm run gulp "vscode-win32-${VSCODE_ARCH}-min-packing"
 
       if [[ "${VSCODE_ARCH}" != "x64" ]]; then
         SHOULD_BUILD_REH="no"
@@ -53,9 +53,16 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
 
     VSCODE_PLATFORM="win32"
   else # linux
+    # remove win32 node modules
+    rm -f .build/extensions/ms-vscode.js-debug/src/win32-app-container-tokens.*.node
+
     # in CI, packaging will be done by a different job
     if [[ "${CI_BUILD}" == "no" ]]; then
-      npm run gulp "vscode-linux-${VSCODE_ARCH}-min-ci"
+      # generate Group Policy definitions
+      npm run copy-policy-dto --prefix build
+      node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc linux
+
+      npm run gulp "vscode-linux-${VSCODE_ARCH}-min-packing"
 
       find "../VSCode-linux-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 

build/alpine/check_tags.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+  if [[ -z $( contains "${APP_NAME_LC}-reh-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Alpine ${VSCODE_ARCH} because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Alpine REH ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Alpine ${VSCODE_ARCH} because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Alpine REH-web ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+else
+
+  # alpine-arm64
+  if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine arm64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine arm64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+  fi
+
+  # alpine-x64
+  if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine x64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Alpine x64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+  fi
+fi

build/alpine/package_reh.sh

@@ -34,14 +34,14 @@ fi
 
 for i in {1..5}; do # try 5 times
   npm ci && break
-  if [[ $i == 3 ]]; then
+  if [[ $i == 5 ]]; then
     echo "Npm install failed too many times" >&2
     exit 1
   fi
   echo "Npm install failed $i, trying again..."
 done
 
-node build/azure-pipelines/distro/mixin-npm
+node build/azure-pipelines/distro/mixin-npm.ts
 
 if [[ "${VSCODE_ARCH}" == "x64" ]]; then
   PA_NAME="linux-alpine"

build/linux/appimage/build.sh

@@ -22,19 +22,24 @@ if [[ "${VSCODE_ARCH}" == "x64" ]]; then
   ./pkg2appimage.AppImage --appimage-extract && mv ./squashfs-root ./pkg2appimage.AppDir
 
   # add update's url
-  sed -i 's/generate_type2_appimage/generate_type2_appimage -u "gh-releases-zsync|VSCodium|vscodium|latest|*.AppImage.zsync"/' pkg2appimage.AppDir/AppRun
-
+  if [[ "${VSCODE_QUALITY}" == "insider" ]]; then
+    sed -i 's/generate_type2_appimage/generate_type2_appimage -u "gh-releases-zsync|VSCodium|vscodium-insiders|latest|*.AppImage.zsync"/' pkg2appimage.AppDir/AppRun
+  else
+    sed -i 's/generate_type2_appimage/generate_type2_appimage -u "gh-releases-zsync|VSCodium|vscodium|latest|*.AppImage.zsync"/' pkg2appimage.AppDir/AppRun
+  fi
   # remove check so build in docker can succeed
   sed -i 's/grep docker/# grep docker/' pkg2appimage.AppDir/usr/share/pkg2appimage/functions.sh
 
+  APP_NAME_LC="$( echo "${APP_NAME}" | awk '{print tolower($0)}' )"
+
   if [[ "${VSCODE_QUALITY}" == "insider" ]]; then
-    sed -i 's|@@NAME@@|VSCodium-Insiders|g' recipe.yml
-    sed -i 's|@@APPNAME@@|codium-insiders|g' recipe.yml
-    sed -i 's|@@ICON@@|vscodium-insiders|g' recipe.yml
+    sed -i "s|@@NAME@@|${APP_NAME}-Insiders|g" recipe.yml
+    sed -i "s|@@APPNAME@@|${BINARY_NAME}|g" recipe.yml
+    sed -i "s|@@ICON@@|${APP_NAME_LC}-insiders|g" recipe.yml
   else
-    sed -i 's|@@NAME@@|VSCodium|g' recipe.yml
-    sed -i 's|@@APPNAME@@|codium|g' recipe.yml
-    sed -i 's|@@ICON@@|vscodium|g' recipe.yml
+    sed -i "s|@@NAME@@|${APP_NAME}|g" recipe.yml
+    sed -i "s|@@APPNAME@@|${BINARY_NAME}|g" recipe.yml
+    sed -i "s|@@ICON@@|${APP_NAME_LC}|g" recipe.yml
   fi
 
   # workaround that enforces x86 ARCH for pkg2appimage having /__w/vscodium/vscodium/build/linux/appimage/VSCodium/VSCodium.AppDir/usr/share/codium/resources/app/node_modules/rc/index.js is of architecture armhf

build/linux/check_tags.sh

@@ -0,0 +1,345 @@
+#!/usr/bin/env bash
+
+if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Linux ${VSCODE_ARCH} because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Linux REH ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Linux ${VSCODE_ARCH} because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    echo "Already have the Linux REH-web ${VSCODE_ARCH} archive"
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+
+else
+
+  # linux-arm64
+  if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "arm64.deb" ) ]]; then
+      echo "Building on Linux arm64 because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "aarch64.rpm" ) ]]; then
+      echo "Building on Linux arm64 because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ -z $( contains "arm64.snap" ) || "${FORCE_LINUX_SNAP}" == "true" ]]; then
+      echo "Building on Linux arm64 because we have no SNAP"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_SNAP="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm64 because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux arm64 builds"
+    fi
+  fi
+
+  # linux-armhf
+  if [[ "${VSCODE_ARCH}" == "armhf" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "armhf.deb" ) ]]; then
+      echo "Building on Linux arm because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "armv7hl.rpm" ) ]]; then
+      echo "Building on Linux arm because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux arm because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux arm builds"
+    fi
+  fi
+
+  # linux-ppc64le
+  if [[ "${VSCODE_ARCH}" == "ppc64le" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "ppc64el.deb" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "ppc64le.rpm" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux PowerPC64LE because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux PowerPC64LE builds"
+    fi
+  fi
+
+  # linux-riscv64
+  if [[ "${VSCODE_ARCH}" == "riscv64" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_DEB="no"
+    export SHOULD_BUILD_RPM="no"
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME}-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux RISC-V 64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux riscv64 builds"
+    fi
+  fi
+
+  # linux-loong64
+  if [[ "${VSCODE_ARCH}" == "loong64" || "${CHECK_ALL}" == "yes" ]]; then
+    export SHOULD_BUILD_DEB="no"
+    export SHOULD_BUILD_RPM="no"
+    export SHOULD_BUILD_APPIMAGE="no"
+
+    if [[ -z $( contains "${APP_NAME}-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux Loong64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux Loong64 builds"
+    fi
+  fi
+
+  # linux-s390x
+  if [[ "${VSCODE_ARCH}" == "s390x" || "${CHECK_ALL}" == "yes" ]]; then
+    SHOULD_BUILD_APPIMAGE="no"
+    SHOULD_BUILD_DEB="no"
+    SHOULD_BUILD_RPM="no"
+    SHOULD_BUILD_TAR="no"
+
+    if [[ -z $( contains "${APP_NAME_LC}-reh-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux s390x because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux s390x because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    export SHOULD_BUILD_CLI="no"
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux s390x builds"
+    fi
+  fi
+
+  # linux-x64
+  if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
+    if [[ -z $( contains "amd64.deb" ) ]]; then
+      echo "Building on Linux x64 because we have no DEB"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_DEB="no"
+    fi
+
+    if [[ -z $( contains "x86_64.rpm" ) ]]; then
+      echo "Building on Linux x64 because we have no RPM"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_RPM="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME}-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no TAR"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_TAR="no"
+    fi
+
+    if [[ "${DISABLE_APPIMAGE}" == "yes" ]]; then
+      export SHOULD_BUILD_APPIMAGE="no"
+    elif [[ -z $( contains "x86_64.AppImage" ) ]]; then
+      echo "Building on Linux x64 because we have no AppImage"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_APPIMAGE="no"
+    fi
+
+    if [[ -z $( contains "amd64.snap" ) || "${FORCE_LINUX_SNAP}" == "true" ]]; then
+      echo "Building on Linux x64 because we have no SNAP"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_SNAP="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no REH archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH="no"
+    fi
+
+    if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no REH-web archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_REH_WEB="no"
+    fi
+
+    if [[ -z $( contains "${APP_NAME_LC}-cli-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
+      echo "Building on Linux x64 because we have no CLI archive"
+      export SHOULD_BUILD="yes"
+    else
+      export SHOULD_BUILD_CLI="no"
+    fi
+
+    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+      echo "Already have all the Linux x64 builds"
+    fi
+  fi
+fi

build/linux/install_gh.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -ex
+
+GH_ARCH="amd64"
+
+for i in {1..5}; do
+  TAG=$( curl --retry 12 --retry-delay 30 "https://api.github.com/repos/cli/cli/releases/latest" 2>/dev/null | jq --raw-output '.tag_name' )
+
+  if [[ $? == 0 && "${TAG}" != "null" ]]; then
+    break
+  fi
+
+  if [[ $i == 5 ]]; then
+    echo "GH install failed too many times" >&2
+    exit 1
+  fi
+
+  echo "GH install failed $i, trying again..."
+
+  sleep $(( 15 * (i + 1)))
+done
+
+VERSION="${TAG#v}"
+
+curl --retry 12 --retry-delay 120 -sSL "https://github.com/cli/cli/releases/download/${TAG}/gh_${VERSION}_linux_${GH_ARCH}.tar.gz" -o "gh_${VERSION}_linux_${GH_ARCH}.tar.gz"
+
+tar xf "gh_${VERSION}_linux_${GH_ARCH}.tar.gz"
+
+cp "gh_${VERSION}_linux_${GH_ARCH}/bin/gh" /usr/local/bin/
+
+gh --version

build/linux/install_nodejs.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -ex
+
+NODEJS_VERSION=$( cat .nvmrc )
+
+curl -fsSL "${NODEJS_SITE}${NODEJS_URLROOT}/v${NODEJS_VERSION}/node-v${NODEJS_VERSION}-linux-${NODEJS_ARCH}${NODEJS_URLSUFFIX}.tar.xz" -o node.tar.xz
+
+tar -xf node.tar.xz
+
+sudo mv "node-v${NODEJS_VERSION}-linux-${NODEJS_ARCH}${NODEJS_URLSUFFIX}" /usr/local/node
+
+echo "/usr/local/node/bin" >> $GITHUB_PATH

build/linux/loong64/electron.sh

@@ -2,5 +2,5 @@
 
 set -ex
 
-export ELECTRON_VERSION="34.2.0"
+export ELECTRON_VERSION="39.2.3"
 export VSCODE_ELECTRON_TAG="v${ELECTRON_VERSION}"

build/linux/loong64/electron.sha256sums

@@ -1,11 +1,9 @@
-e47103e4191b781c9a166ec07f310b1d615866022fc896adf959f81a91615d33 *chromedriver-v34.2.0-linux-loong64.zip
-24ac8b4c6dae1e3bc31de1cda733176ac03b0a124788fe2000a07723c17aa3ad *electron-v34.2.0-linux-loong64-debug.zip
-0a2330d8aa615aa2faac3fc6d3d1924784cab9a1b9a498e00210cf90adc3e98a *electron-v34.2.0-linux-loong64-symbols.zip
-97687006d23a57ee35fc3d3ce8803dfb7e48538ccaf98a73fc8eef09afc35672 *electron-v34.2.0-linux-loong64.zip
-88f1d2e434c111203f06e17a5a23fe8ba5ea572473559055064784e37b804bb9 *hunspell-dictionaries.zip
-b085b7ae8b77b07a210026901816f440c841666222809af3ae9aaf16d95ee6a2 *libcxx-headers.zip
-1f8b7234dd1a8c219909aae8c8c4b5c064c7eb60b9b30efb2207b16a0991acfc *libcxx-objects-v34.2.0-linux-loong64.zip
-a34caad87f177ae6b6098fef84a832fb0887bd5819be9cdc1272d317f4036b96 *libcxxabi-headers.zip
-b7ea74bf6d6aac7eb96841c0c7539f5c8b853e715c4b4396c6cd097a872303b3 *mksnapshot-v34.2.0-linux-loong64.zip
-2e574c7bf182ae8dfdb302be68da8c5d783cd952391e61e166bd8069dc8752fc *node-v34.2.0-headers.tar.gz
-
+d26b2189e7466a08c73861d0225c9b28730fdfc30918f3ea70853b43a2581dc4 *chromedriver-v39.2.3-linux-loong64.zip
+8cc36f7468f5b2d98cde3f73c10c535555754c54be43e45c320a382c35b8e466 *electron-v39.2.3-linux-loong64.zip
+f6e7462d6fd795ae2b08344ee0fdca817eba148b62a62717b3f512c845d96a64 *ffmpeg-v39.2.3-linux-loong64.zip
+b122599dc84b81526ba4eecbca4794f3a2d25300242ad3829d1445cb6948f470 *hunspell-dictionaries.zip
+76ef17d2810df5e77c5071863e2a375df914cfb7a362ad0582ee0eedca2441b9 *libcxx-headers.zip
+9b61ba9f0780a57ee2749f7963759395784eadcaccc54af313de1a540240298e *libcxx-objects-v39.2.3-linux-loong64.zip
+9ae64aff9e391eae401142e55654b5b8cf54d0611b1ecb540f2f4e89a2b4f772 *libcxxabi-headers.zip
+7d7e6e08c84aa38b74037f5910534918bc792ffbe2ca6d667067f587f27f5118 *mksnapshot-v39.2.3-linux-loong64.zip
+db48f8a9d2271e8b3a1c3f26ea1ae9bd489deb1b464b6ae424a15d5df7529fdc *node-v39.2.3-headers.tar.gz

build/linux/package_bin.sh

@@ -7,6 +7,9 @@ if [[ "${CI_BUILD}" == "no" ]]; then
   exit 1
 fi
 
+npm -v
+node -v
+
 # include common functions
 . ./utils.sh
 
@@ -18,19 +21,20 @@ cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
 export VSCODE_PLATFORM='linux'
 export VSCODE_SKIP_NODE_VERSION_CHECK=1
-export VSCODE_SYSROOT_PREFIX='-glibc-2.28'
+export VSCODE_SYSROOT_PREFIX='-glibc-2.28-gcc-10.5.0'
 
 if [[ "${VSCODE_ARCH}" == "arm64" || "${VSCODE_ARCH}" == "armhf" ]]; then
   export VSCODE_SKIP_SYSROOT=1
-  export USE_GNUPP2A=1
+  # export USE_GNUPP2A=1
 elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20240129-253798'
-  export USE_GNUPP2A=1
+  export VSCODE_SYSROOT_PREFIX="-glibc-2.28"
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
   export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_ELECTRON_REPOSITORY='lex-ibm/electron-ppc64le-build-scripts'
+  export IGNORE_ELECTRON_VERSION="yes"
 elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
   export VSCODE_ELECTRON_REPOSITORY='riscv-forks/electron-riscv-releases'
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
@@ -57,7 +61,7 @@ if [[ -f "../build/linux/${VSCODE_ARCH}/electron.sh" ]]; then
   TARGET=$( npm config get target )
 
   # Only fails at different major versions
-  if [[ "${ELECTRON_VERSION%%.*}" != "${TARGET%%.*}" ]]; then
+  if [[ "${ELECTRON_VERSION%%.*}" != "${TARGET%%.*}" ]] && [[ "${IGNORE_ELECTRON_VERSION}" != "yes" ]]; then
     # Fail the pipeline if electron target doesn't match what is used.
     echo "Electron ${VSCODE_ARCH} binary version doesn't match target electron version!"
     echo "Releases available at: https://github.com/${VSCODE_ELECTRON_REPOSITORY}/releases"
@@ -102,7 +106,7 @@ fi
 
 for i in {1..5}; do # try 5 times
   npm ci --prefix build && break
-  if [[ $i == 3 ]]; then
+  if [[ $i == 5 ]]; then
     echo "Npm install failed too many times" >&2
     exit 1
   fi
@@ -119,16 +123,23 @@ fi
 
 for i in {1..5}; do # try 5 times
   npm ci && break
-  if [[ $i -eq 3 ]]; then
+  if [[ $i == 5 ]]; then
     echo "Npm install failed too many times" >&2
     exit 1
   fi
   echo "Npm install failed $i, trying again..."
 done
 
-node build/azure-pipelines/distro/mixin-npm
+node build/azure-pipelines/distro/mixin-npm.ts
 
-npm run gulp "vscode-linux-${VSCODE_ARCH}-min-ci"
+# delete native files built in the `compile` step
+find .build/extensions -type f -name '*.node' -print -delete
+
+# generate Group Policy definitions
+npm run copy-policy-dto --prefix build
+node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc linux
+
+npm run gulp "vscode-linux-${VSCODE_ARCH}-min-packing"
 
 if [[ -f "../build/linux/${VSCODE_ARCH}/ripgrep.sh" ]]; then
   bash "../build/linux/${VSCODE_ARCH}/ripgrep.sh" "../VSCode-linux-${VSCODE_ARCH}/resources/app/node_modules"
@@ -138,4 +149,10 @@ find "../VSCode-linux-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 
 . ../build_cli.sh
 
+if [[ -n "${GITHUB_OUTPUT}" ]]; then
+  echo "VSCODE_SYSROOT_REPOSITORY=${VSCODE_SYSROOT_REPOSITORY:-}" >> "${GITHUB_OUTPUT}"
+  echo "VSCODE_SYSROOT_VERSION=${VSCODE_SYSROOT_VERSION:-}" >> "${GITHUB_OUTPUT}"
+  echo "VSCODE_SYSROOT_PREFIX=${VSCODE_SYSROOT_PREFIX:-}" >> "${GITHUB_OUTPUT}"
+fi
+
 cd ..

build/linux/package_reh.sh

@@ -18,20 +18,14 @@ cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
 GLIBC_VERSION="2.28"
 GLIBCXX_VERSION="3.4.26"
-NODE_VERSION="20.18.2"
+NODE_VERSION="22.21.1"
 
 export VSCODE_NODEJS_URLROOT='/download/release'
 export VSCODE_NODEJS_URLSUFFIX=''
 
 if [[ "${VSCODE_ARCH}" == "x64" ]]; then
-  GLIBC_VERSION="2.17"
-  GLIBCXX_VERSION="3.4.22"
-
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:focal-devtoolset-x64"
 
-  export VSCODE_NODEJS_SITE='https://unofficial-builds.nodejs.org'
-  export VSCODE_NODEJS_URLSUFFIX='-glibc-217'
-
   export VSCODE_SKIP_SETUPENV=1
 elif [[ "${VSCODE_ARCH}" == "arm64" ]]; then
   EXPECTED_GLIBC_VERSION="2.30"
@@ -48,25 +42,30 @@ elif [[ "${VSCODE_ARCH}" == "armhf" ]]; then
   export VSCODE_SKIP_SYSROOT=1
   export USE_GNUPP2A=1
 elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
+  GLIBC_VERSION="2.28"
+
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:focal-devtoolset-ppc64le"
+  VSCODE_SYSROOT_PREFIX="-glibc-${GLIBC_VERSION}"
 
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20240129-253798'
-  export USE_GNUPP2A=1
 elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
-  NODE_VERSION="20.16.0"
+  NODE_VERSION="22.21.1"
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:focal-devtoolset-riscv64"
 
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_NODEJS_SITE='https://unofficial-builds.nodejs.org'
 elif [[ "${VSCODE_ARCH}" == "loong64" ]]; then
-  NODE_VERSION="20.16.0"
+  NODE_VERSION="22.21.1"
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:beige-devtoolset-loong64"
 
   export VSCODE_SKIP_SETUPENV=1
   export VSCODE_NODEJS_SITE='https://unofficial-builds.nodejs.org'
 elif [[ "${VSCODE_ARCH}" == "s390x" ]]; then
+  GLIBC_VERSION="2.28"
+
   VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME="vscodium/vscodium-linux-build-agent:focal-devtoolset-s390x"
+  VSCODE_SYSROOT_PREFIX="-glibc-${GLIBC_VERSION}"
 
   export VSCODE_SYSROOT_REPOSITORY='VSCodium/vscode-linux-build-agent'
   export VSCODE_SYSROOT_VERSION='20241108'
@@ -76,7 +75,12 @@ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
 export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
 export VSCODE_PLATFORM='linux'
 export VSCODE_SKIP_NODE_VERSION_CHECK=1
-export VSCODE_SYSROOT_PREFIX="-glibc-${GLIBC_VERSION}"
+
+if [[ -z "${VSCODE_SYSROOT_PREFIX}" ]]; then
+  export VSCODE_SYSROOT_PREFIX="-glibc-${GLIBC_VERSION}-gcc-10.5.0"
+else
+  export VSCODE_SYSROOT_PREFIX
+fi
 
 EXPECTED_GLIBC_VERSION="${EXPECTED_GLIBC_VERSION:=GLIBC_VERSION}"
 VSCODE_HOST_MOUNT="$( pwd )"
@@ -84,7 +88,7 @@ VSCODE_HOST_MOUNT="$( pwd )"
 export VSCODE_HOST_MOUNT
 export VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME
 
-sed -i "/target/s/\"20.*\"/\"${NODE_VERSION}\"/" remote/.npmrc
+sed -i "/target/s/\"22.*\"/\"${NODE_VERSION}\"/" remote/.npmrc
 
 if [[ -d "../patches/linux/reh/" ]]; then
   for file in "../patches/linux/reh/"*.patch; do
@@ -124,12 +128,9 @@ EOF
   echo "${INCLUDES}" > "${HOME}/.gyp/include.gypi"
 fi
 
-mv .npmrc .npmrc.bak
-cp ../npmrc .npmrc
-
 for i in {1..5}; do # try 5 times
   npm ci --prefix build && break
-  if [[ $i == 3 ]]; then
+  if [[ $i == 5 ]]; then
     echo "Npm install failed too many times" >&2
     exit 1
   fi
@@ -140,13 +141,28 @@ if [[ -z "${VSCODE_SKIP_SETUPENV}" ]]; then
   if [[ -n "${VSCODE_SKIP_SYSROOT}" ]]; then
     source ./build/azure-pipelines/linux/setup-env.sh --skip-sysroot
   else
+    cat ./build/checksums/vscode-sysroot.txt
+
     source ./build/azure-pipelines/linux/setup-env.sh
   fi
+
+  export VSCODE_SYSROOT_DIR="${VSCODE_REMOTE_SYSROOT_DIR}"
+else
+  mkdir -p .build/x86_64-linux-gnu/x86_64-linux-gnu/bin
+
+  ln -s $( which objdump ) .build/x86_64-linux-gnu/x86_64-linux-gnu/bin/objdump
+
+  export VSCODE_SYSROOT_DIR=".build"
 fi
 
+node build/npm/preinstall.ts
+
+mv .npmrc .npmrc.bak
+cp ../npmrc .npmrc
+
 for i in {1..5}; do # try 5 times
   npm ci && break
-  if [[ $i == 3 ]]; then
+  if [[ $i == 5 ]]; then
     echo "Npm install failed too many times" >&2
     exit 1
   fi
@@ -156,9 +172,26 @@ for i in {1..5}; do # try 5 times
   rm -rf node_modules/@vscode node_modules/node-pty
 done
 
+# if [[ "${VSCODE_ARCH}" == "x64" ]]; then
+#   pushd "remote"
+
+#   for LIB in @parcel/watcher @vscode/spdlog kerberos node-pty
+#   do
+#     pushd "node_modules/${LIB}"
+
+#     CXXFLAGS="-D_GLIBCXX_USE_CXX11_ABI=0" npx node-gyp rebuild
+
+#     popd
+#   done
+
+#   popd
+
+#   VERIFY_CXX11=1
+# fi
+
 mv .npmrc.bak .npmrc
 
-node build/azure-pipelines/distro/mixin-npm
+node build/azure-pipelines/distro/mixin-npm.ts
 
 export VSCODE_NODE_GLIBC="-glibc-${GLIBC_VERSION}"
 
@@ -169,10 +202,14 @@ if [[ "${SHOULD_BUILD_REH}" != "no" ]]; then
 
   EXPECTED_GLIBC_VERSION="${EXPECTED_GLIBC_VERSION}" EXPECTED_GLIBCXX_VERSION="${GLIBCXX_VERSION}" SEARCH_PATH="../vscode-reh-${VSCODE_PLATFORM}-${VSCODE_ARCH}" ./build/azure-pipelines/linux/verify-glibc-requirements.sh
 
+  # if [[ -n "${VERIFY_CXX11}" ]]; then
+  #   SEARCH_PATH="../vscode-reh-${VSCODE_PLATFORM}-${VSCODE_ARCH}" ../build/linux/verify_cxx11_requirements.sh
+  # fi
+
   pushd "../vscode-reh-${VSCODE_PLATFORM}-${VSCODE_ARCH}"
 
-  if [[ -f "../ripgrep_${VSCODE_PLATFORM}_${VSCODE_ARCH}.sh" ]]; then
-    bash "../ripgrep_${VSCODE_PLATFORM}_${VSCODE_ARCH}.sh" "node_modules"
+  if [[ -f "../build/linux/${VSCODE_ARCH}/ripgrep.sh" ]]; then
+    bash "../build/linux/${VSCODE_ARCH}/ripgrep.sh" "node_modules"
   fi
 
   echo "Archiving REH"
@@ -188,10 +225,14 @@ if [[ "${SHOULD_BUILD_REH_WEB}" != "no" ]]; then
 
   EXPECTED_GLIBC_VERSION="${EXPECTED_GLIBC_VERSION}" EXPECTED_GLIBCXX_VERSION="${GLIBCXX_VERSION}" SEARCH_PATH="../vscode-reh-web-${VSCODE_PLATFORM}-${VSCODE_ARCH}" ./build/azure-pipelines/linux/verify-glibc-requirements.sh
 
+  # if [[ -n "${VERIFY_CXX11}" ]]; then
+  #   SEARCH_PATH="../vscode-reh-${VSCODE_PLATFORM}-${VSCODE_ARCH}" ../build/linux/verify_cxx11_requirements.sh
+  # fi
+
   pushd "../vscode-reh-web-${VSCODE_PLATFORM}-${VSCODE_ARCH}"
 
-  if [[ -f "../ripgrep_${VSCODE_PLATFORM}_${VSCODE_ARCH}.sh" ]]; then
-    bash "../ripgrep_${VSCODE_PLATFORM}_${VSCODE_ARCH}.sh" "node_modules"
+  if [[ -f "../build/linux/${VSCODE_ARCH}/ripgrep.sh" ]]; then
+    bash "../build/linux/${VSCODE_ARCH}/ripgrep.sh" "node_modules"
   fi
 
   echo "Archiving REH-web"

build/linux/ppc64le/electron.sh

@@ -2,5 +2,5 @@
 
 set -ex
 
-export ELECTRON_VERSION="34.2.0"
+export ELECTRON_VERSION="41.0.3"
 export VSCODE_ELECTRON_TAG="v${ELECTRON_VERSION}"

build/linux/ppc64le/electron.sha256sums

@@ -1,11 +1,11 @@
-e28d3ffb1a4cdcef80b93cf2a73214c4a85b2fc2a414aefc14a03b212ce07a28 *chromedriver-v34.2.0-linux-ppc64le.zip
-4cfaa3e888b9d4acb9149ca521188dc2e945fa569230b026d5a74d8a85a6f8ce *electron-v34.2.0-linux-ppc64le-debug.zip
-3a82c9ef68f60234ea6d506205d3f37fc7821f7f2a9217c1f9027078da1b3a44 *electron-v34.2.0-linux-ppc64le-symbols.zip
-85d2ddaee9d5aa93ab341e3a6f9ac2b7fce3825efee7b885cdda7ad91244a158 *electron-v34.2.0-linux-ppc64le.zip
-5ca44a4ee9cc74a56c9556ce3f3774986dbb8b4f4953088c7f4577bfba4356a8 *electron.d.ts
-a5db064d9f82e2ad8be677d5c5bcf4e9bca68b38ca1e096c54029879098bf7ba *ffmpeg-v34.2.0-linux-ppc64le.zip
-d19ee157a394a258c0d2820ca0b3d6f3403065c54bdb4b35d8227c844ebc18d9 *hunspell_dictionaries.zip
-3ba2b632a70b16315c0f975a87ebaf47b24878396d4e5b7ba1d9db49eb1bfee9 *libcxx-objects-v34.2.0-linux-ppc64le.zip
-552fe6a9afe66b9efa054856553bb88c35ccafa31bc3bb398b483d77291be12c *libcxx_headers.zip
-71d695f56d7fbee44d18d503790951c17ba22f2f75c5b96131d4c65e865860f0 *libcxxabi_headers.zip
-6e25a04c8e19e475edbc8b7145df84372b0e8abdcde3c9ea42b5aaa6fb69ccda *mksnapshot-v34.2.0-linux-ppc64le.zip
+120e0e5915c8f1a49904737e82bf50bc72563f8556fc3c5997c118908b377874 *chromedriver-v41.0.3-linux-ppc64le.zip
+4601e7692cac011610c245d8c58f14a73b415fccf520194f14674f81e4ce2c41 *electron-v41.0.3-linux-ppc64le-debug.zip
+498a74b78699ff9d4819310262d96e861dd7d899f38f8f625a311968b076b29b *electron-v41.0.3-linux-ppc64le-symbols.zip
+77e86aa200d9e19b5eb3a51f273ee410788c21977f2ea76b1239d79aa2e1adbf *electron-v41.0.3-linux-ppc64le.zip
+e246066ccc328729e6a9f2a0d829bc893391cf54ed199b809bb7e47993fed88f *electron.d.ts
+687a36388a7cf06427d7fa7e3db7fca4ab0118c5eab2baeac128c1989a600cff *ffmpeg-v41.0.3-linux-ppc64le.zip
+70ba677d4bea3e7164c82f6b5a36ac6b740317fb1dd149a0eaf1ff151da44cb2 *hunspell_dictionaries.zip
+3e85df4843497ce567ad36ddf826cd1af7dfe9f883daad4623736ddd012dbfd1 *libcxx-objects-v41.0.3-linux-ppc64le.zip
+5587472eeaf9bfb76d0f187ecc19d11d60bc05f5e7c8fa822f2370210c30b95d *libcxx_headers.zip
+f531ddd2782b4b19caf622c0355c93892965e22861279cc891675230c1310905 *libcxxabi_headers.zip
+6cb0e67dc5a23de0ebbe89253e1f24bf9d4ca41213a1b9f784f2afaa2cf61324 *mksnapshot-v41.0.3-linux-ppc64le.zip

build/linux/prepare_assets.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+if [[ -z "${VSCODE_SYSROOT_REPOSITORY}" ]]; then
+  unset VSCODE_SYSROOT_REPOSITORY
+fi
+
+if [[ -z "${VSCODE_SYSROOT_VERSION}" ]]; then
+  unset VSCODE_SYSROOT_VERSION
+fi
+
+if [[ -z "${VSCODE_SYSROOT_PREFIX}" ]]; then
+  unset VSCODE_SYSROOT_PREFIX
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" && "${VSCODE_ARCH}" != "x64" ]]; then
+  SHOULD_BUILD_APPIMAGE="no"
+fi
+
+if [[ "${SHOULD_BUILD_DEB}" != "no" || "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-deb"
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-build-deb"
+fi
+
+if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-prepare-rpm"
+  npm run gulp "vscode-linux-${VSCODE_ARCH}-build-rpm"
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  . ../build/linux/appimage/build.sh
+fi
+
+cd ..
+
+if [[ "${CI_BUILD}" == "no" ]]; then
+  . ./stores/snapcraft/build.sh
+
+  if [[ "${SKIP_ASSETS}" == "no" ]]; then
+    mv stores/snapcraft/build/*.snap assets/
+  fi
+fi
+
+if [[ "${SHOULD_BUILD_TAR}" != "no" ]]; then
+  echo "Building and moving TAR"
+  cd "VSCode-linux-${VSCODE_ARCH}"
+  tar czf "../assets/${APP_NAME}-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" .
+  cd ..
+fi
+
+if [[ "${SHOULD_BUILD_DEB}" != "no" ]]; then
+  echo "Moving DEB"
+  mv vscode/.build/linux/deb/*/deb/*.deb assets/
+fi
+
+if [[ "${SHOULD_BUILD_RPM}" != "no" ]]; then
+  echo "Moving RPM"
+  mv vscode/.build/linux/rpm/*/*.rpm assets/
+fi
+
+if [[ "${SHOULD_BUILD_APPIMAGE}" != "no" ]]; then
+  echo "Moving AppImage"
+  mv build/linux/appimage/out/*.AppImage* assets/
+
+  find assets -name '*.AppImage*' -exec bash -c 'mv $0 ${0/_-_/-}' {} \;
+fi

build/linux/riscv64/electron.sh

@@ -2,5 +2,5 @@
 
 set -ex
 
-export ELECTRON_VERSION="34.2.0"
+export ELECTRON_VERSION="39.2.7"
 export VSCODE_ELECTRON_TAG="v${ELECTRON_VERSION}.riscv1"

build/linux/riscv64/electron.sha256sums

@@ -1,11 +1,11 @@
-1cbe2e0aa7ce41832781b867ab1899bd83bbebf37ea89036e2d1f2e4e8c231dd *chromedriver-v34.2.0-linux-riscv64.zip
-2a6dc0241a8f62e442833e8a6438b150206d824874b3c42d41220052ce2558d2 *electron-v34.2.0-linux-riscv64-debug.tar.zst
-54c6f5a7775ca09b7c61c89ce668d68bcbd3bf9d0f88bcebbfc93d68fcf53ca9 *electron-v34.2.0-linux-riscv64-symbols.tar.zst
-edc0e2b28a05eb4c812c09c072b091df1d90a74283ad58ac7b61c6c538048882 *electron-v34.2.0-linux-riscv64.zip
-e9a934eb94580f5ff18537a9afab8eac59f21784e07952c0511fe8db3e0b63a1 *ffmpeg-v34.2.0-linux-riscv64.zip
-0e162c2636b9583d39b40a383ee4ea41f177c82b20d168ec869a625a6f7a6f6b *hunspell-dictionaries.zip
-d12dfd2413e0151c8ba800b0fa8881d2910b49793e62576798c3358eef724eec *libcxx-headers.zip
-b2befbd4a5149b6f63925f833fcb40c247b5205e90a80426d6ba87e48e259575 *libcxx-objects-v34.2.0-linux-riscv64.zip
-f70f8fdea628beac7c90453f4f4c01a587c5e0c5f6cd12bcbba6019fe6c172f9 *libcxxabi-headers.zip
-ea85918270250a56ec1217d7c79ae8f0d8f1b8bd3e21c3f80e68e3b3fca20fbb *mksnapshot-v34.2.0-linux-riscv64.zip
-25ca4f68090ac1474d7306ca74fb64a57501216fd25aeeca7795c058f8124f57 *node-v34.2.0-headers.tar.gz
+6759ef2bd69a2e31a3f0e17c4e4c0bf239b54f08525572201ae7760851168487 *chromedriver-v39.2.7-linux-riscv64.zip
+89562e30982d8ac71fbc1e0f549a4a6e19abd5cb98ea904d5f3cfceb7c61e582 *electron-v39.2.7-linux-riscv64-debug.tar.zst
+71c6f265a2ef065f478ef910a06466a21009c02783dcb7053767549a6dbeb80d *electron-v39.2.7-linux-riscv64-symbols.tar.zst
+136804dbd04f1c6b9a6047c4e7bb648876214ff453b62fb3bdc81505b6f5aab2 *electron-v39.2.7-linux-riscv64.zip
+1059d6cb97b87464b3bd415bb5f96fceaf91d6e3af1c9733724ab9f2e14e2a08 *ffmpeg-v39.2.7-linux-riscv64.zip
+224a84d4aaceb5ed8be3c4f65f8404d492dc86ded8ab336c2562dfdd21752068 *hunspell-dictionaries.zip
+b6cb4f8902aad5de811efd106ddbdbca79e43cb7c8fa67f7eeddaedf2efd82d5 *libcxx-headers.zip
+0664e200ec1eab1ce1957bc6e17ad89f6c0d4d904a9492d64fcf4175cd81e537 *libcxx-objects-v39.2.7-linux-riscv64.zip
+96f9b66be7ff11e79ec2e781a0025938eb5ef97cbab429c05e9b45d24d421abf *libcxxabi-headers.zip
+be0774857454f81b9407f6b941200f8843a0b3ecb86e2bb072209ef9f9bfe74a *mksnapshot-v39.2.7-linux-riscv64.zip
+a8fca541e8f9a18de73c78f6862cbf439723c80c5eb60fe50405dfb751d2ee13 *node-v39.2.7-headers.tar.gz

build/linux/riscv64/ripgrep.sh

@@ -9,7 +9,7 @@ if [ "$#" -ne 1 ]; then
 fi
 
 RG_PATH="$1/@vscode/ripgrep/bin/rg"
-RG_VERSION="14.1.1-3"
+RG_VERSION="14.1.1-4"
 
 echo "Replacing ripgrep binary with riscv64 one"
 

build/linux/verify_abi_requirements.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -e
+
+FILES=$(
+  find "${SEARCH_PATH}" -type f -executable -name "node"
+  find "${SEARCH_PATH}" -name "*.node" -not -path "*prebuilds*" -not -path "*extensions/node_modules/@parcel/watcher*"
+)
+
+echo "Verifying requirements for files: ${FILES}"
+
+for FILE in ${FILES}; do
+  CXXABI_VERSION="0.0.0"
+
+  while IFS= read -r LINE; do
+    VERSION=${LINE#*_}
+
+    if [[ $( printf "%s\n%s" "${VERSION}" "${CXXABI_VERSION}" | sort -V | tail -n1 ) == "${VERSION}" ]]; then
+      CXXABI_VERSION="${VERSION}"
+    fi
+  done < <( strings "${FILE}" | grep -i ^CXXABI )
+
+  if [[ $( printf "%s\n%s" "${EXPECTED_CXXABI_VERSION}" "${CXXABI_VERSION}" | sort -V | tail -n1 ) == "${EXPECTED_CXXABI_VERSION}" ]]; then
+    echo "File ${FILE} has dependency on ABI ${CXXABI_VERSION} <= ${EXPECTED_CXXABI_VERSION}"
+  else
+    echo "Error: File ${FILE} has dependency on ABI ${CXXABI_VERSION} > ${EXPECTED_CXXABI_VERSION}"
+    exit 1
+  fi
+done

build/linux/verify_cxx11_requirements.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -e
+
+FILES=$( find "${SEARCH_PATH}" -name "*.node" -not -path "*prebuilds*" -not -path "*extensions/node_modules/@parcel/watcher*" )
+
+echo "Verifying requirements for files: ${FILES}"
+
+for FILE in ${FILES}; do
+  if [[ -n "$( strings "${FILE}" | grep cxx11 | tail -n1 )" ]]; then
+    echo "Error: File ${FILE} has dependency on CXX11"
+    exit 1
+  fi
+done

build/osx/check_tags.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+if [[ -z $( contains "${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+  echo "Building on MacOS because we have no ZIP"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_ZIP="no"
+fi
+
+if [[ -z $( contains ".${VSCODE_ARCH}.${RELEASE_VERSION}.dmg" ) ]]; then
+  echo "Building on MacOS because we have no DMG"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_DMG="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-reh-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no REH archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_REH="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-reh-web-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no REH-web archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_REH_WEB="no"
+fi
+
+if [[ -z $( contains "${APP_NAME_LC}-cli-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+  echo "Building on MacOS because we have no CLI archive"
+  export SHOULD_BUILD="yes"
+else
+  export SHOULD_BUILD_CLI="no"
+fi
+
+if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+  echo "Already have all the MacOS builds"
+fi

build/osx/prepare_assets.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  if [[ "${CI_BUILD}" == "no" ]]; then
+    RUNNER_TEMP="${TMPDIR}"
+  fi
+
+  CERTIFICATE_P12="${APP_NAME}.p12"
+  KEYCHAIN="${RUNNER_TEMP}/buildagent.keychain"
+  AGENT_TEMPDIRECTORY="${RUNNER_TEMP}"
+  # shellcheck disable=SC2006
+  KEYCHAINS=`security list-keychains | xargs`
+
+  rm -f "${KEYCHAIN}"
+
+  echo "${CERTIFICATE_OSX_P12_DATA}" | base64 --decode > "${CERTIFICATE_P12}"
+
+  echo "+ create temporary keychain"
+  security create-keychain -p pwd "${KEYCHAIN}"
+  security set-keychain-settings -lut 21600 "${KEYCHAIN}"
+  security unlock-keychain -p pwd "${KEYCHAIN}"
+  # shellcheck disable=SC2086
+  security list-keychains -s $KEYCHAINS "${KEYCHAIN}"
+  # security show-keychain-info "${KEYCHAIN}"
+
+  echo "+ import certificate to keychain"
+  security import "${CERTIFICATE_P12}" -k "${KEYCHAIN}" -P "${CERTIFICATE_OSX_P12_PASSWORD}" -T /usr/bin/codesign
+  security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd "${KEYCHAIN}" > /dev/null
+  # security find-identity "${KEYCHAIN}"
+
+  CODESIGN_IDENTITY="$( security find-identity -v -p codesigning "${KEYCHAIN}" | grep -oEi "([0-9A-F]{40})" | head -n 1 )"
+
+  echo "+ signing"
+  export CODESIGN_IDENTITY AGENT_TEMPDIRECTORY
+
+  DEBUG="electron-osx-sign*" node vscode/build/darwin/sign.ts "$( pwd )"
+  # codesign --display --entitlements :- ""
+
+  echo "+ notarize"
+
+  cd "VSCode-darwin-${VSCODE_ARCH}"
+  ZIP_FILE="./${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip"
+
+  zip -r -X -y "${ZIP_FILE}" ./*.app
+
+  xcrun notarytool store-credentials "${APP_NAME}" --apple-id "${CERTIFICATE_OSX_ID}" --team-id "${CERTIFICATE_OSX_TEAM_ID}" --password "${CERTIFICATE_OSX_APP_PASSWORD}" --keychain "${KEYCHAIN}"
+  # xcrun notarytool history --keychain-profile "${APP_NAME}" --keychain "${KEYCHAIN}"
+  xcrun notarytool submit "${ZIP_FILE}" --keychain-profile "${APP_NAME}" --wait --keychain "${KEYCHAIN}"
+
+  echo "+ attach staple"
+  xcrun stapler staple ./*.app
+  # spctl --assess -vv --type install ./*.app
+
+  rm "${ZIP_FILE}"
+
+  cd ..
+fi
+
+if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
+  echo "Building and moving ZIP"
+  cd "VSCode-darwin-${VSCODE_ARCH}"
+  zip -r -X -y "../assets/${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ./*.app
+  cd ..
+fi
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" && "${SHOULD_BUILD_DMG}" != "no" ]]; then
+  echo "Building and moving DMG"
+  pushd "VSCode-darwin-${VSCODE_ARCH}"
+  npx create-dmg ./*.app .
+  mv ./*.dmg "../assets/${APP_NAME}.${VSCODE_ARCH}.${RELEASE_VERSION}.dmg"
+  popd
+fi
+
+if [[ "${SHOULD_BUILD_SRC}" == "yes" ]]; then
+  git archive --format tar.gz --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.tar.gz" HEAD
+  git archive --format zip --output="./assets/${APP_NAME}-${RELEASE_VERSION}-src.zip" HEAD
+fi
+
+if [[ -n "${CERTIFICATE_OSX_P12_DATA}" ]]; then
+  echo "+ clean"
+  security delete-keychain "${KEYCHAIN}"
+  # shellcheck disable=SC2086
+  security list-keychains -s $KEYCHAINS
+fi

build/windows/appx/build.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -ex
+
+# Add Windows SDK to path
+SDK='/C/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x64'
+export PATH="${SDK}:${PATH}"
+
+APPX_NAME="${BINARY_NAME//-/_}"
+
+powershell "makeappx pack /d ..\\VSCode-win32-${VSCODE_ARCH}\\appx\\manifest /p ..\\VSCode-win32-${VSCODE_ARCH}\\appx\\${APPX_NAME}_${VSCODE_ARCH}.appx /nv"
+
+# Remove the raw manifest folder
+rm -rf "../VSCode-win32-${VSCODE_ARCH}/appx/manifest"

build/windows/check_tags.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+# windows-arm64
+if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
+  if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows arm64 because we have no system setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_SYS="no"
+  fi
+
+  if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows arm64 because we have no user setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_USR="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    echo "Building on Windows arm64 because we have no zip"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_ZIP="no"
+  fi
+
+  export SHOULD_BUILD_REH="no"
+  export SHOULD_BUILD_REH_WEB="no"
+
+  if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows arm64 because we have no CLI archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_CLI="no"
+  fi
+
+  if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+    echo "Already have all the Windows arm64 builds"
+  fi
+
+# windows-x64
+else
+  if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows x64 because we have no system setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_SYS="no"
+  fi
+
+  if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
+    echo "Building on Windows x64 because we have no user setup"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_EXE_USR="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
+    echo "Building on Windows x64 because we have no zip"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_ZIP="no"
+  fi
+
+  if [[ "${DISABLE_MSI}" == "yes" ]]; then
+      export SHOULD_BUILD_MSI="no"
+  elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
+    echo "Building on Windows x64 because we have no msi"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_MSI="no"
+  fi
+
+  if [[ "${DISABLE_MSI}" == "yes" ]]; then
+      export SHOULD_BUILD_MSI_NOUP="no"
+  elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
+    echo "Building on Windows x64 because we have no updates-disabled msi"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_MSI_NOUP="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no REH archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_REH="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no REH-web archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_REH_WEB="no"
+  fi
+
+  if [[ -z $( contains "${APP_NAME_LC}-cli-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
+    echo "Building on Windows x64 because we have no CLI archive"
+    export SHOULD_BUILD="yes"
+  else
+    export SHOULD_BUILD_CLI="no"
+  fi
+
+  if [[ "${SHOULD_BUILD}" != "yes" ]]; then
+    echo "Already have all the Windows x64 builds"
+  fi
+fi

build/windows/package.sh

@@ -13,18 +13,27 @@ cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
 for i in {1..5}; do # try 5 times
   npm ci && break
-  if [[ $i -eq 3 ]]; then
+  if [[ $i == 5 ]]; then
     echo "Npm install failed too many times" >&2
     exit 1
   fi
   echo "Npm install failed $i, trying again..."
 done
 
-node build/azure-pipelines/distro/mixin-npm
+node build/azure-pipelines/distro/mixin-npm.ts
+
+# delete native files built in the `compile` step
+find .build/extensions -type f -name '*.node' -print -delete
 
 . ../build/windows/rtf/make.sh
 
-npm run gulp "vscode-win32-${VSCODE_ARCH}-min-ci"
+# generate Group Policy definitions
+npm run copy-policy-dto --prefix build
+node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc win32
+
+# node build/win32/explorer-dll-fetcher.ts .build/win32/appx
+
+npm run gulp "vscode-win32-${VSCODE_ARCH}-min-packing"
 
 . ../build_cli.sh
 

build/windows/prepare_assets.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+npm run gulp "vscode-win32-${VSCODE_ARCH}-inno-updater"
+
+# . ../build/windows/appx/build.sh
+
+if [[ "${SHOULD_BUILD_ZIP}" != "no" ]]; then
+  7z.exe a -tzip "../assets/${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" -x!CodeSignSummary*.md -x!tools "../VSCode-win32-${VSCODE_ARCH}/*" -r
+fi
+
+if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
+  npm run gulp "vscode-win32-${VSCODE_ARCH}-system-setup"
+fi
+
+if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
+  npm run gulp "vscode-win32-${VSCODE_ARCH}-user-setup"
+fi
+
+if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
+  if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
+    . ../build/windows/msi/build.sh
+  fi
+
+  if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
+    . ../build/windows/msi/build-updates-disabled.sh
+  fi
+fi
+
+cd ..
+
+if [[ "${SHOULD_BUILD_EXE_SYS}" != "no" ]]; then
+  echo "Moving System EXE"
+  mv "vscode\\.build\\win32-${VSCODE_ARCH}\\system-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
+fi
+
+if [[ "${SHOULD_BUILD_EXE_USR}" != "no" ]]; then
+  echo "Moving User EXE"
+  mv "vscode\\.build\\win32-${VSCODE_ARCH}\\user-setup\\VSCodeSetup.exe" "assets\\${APP_NAME}UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe"
+fi
+
+if [[ "${VSCODE_ARCH}" == "ia32" || "${VSCODE_ARCH}" == "x64" ]]; then
+  if [[ "${SHOULD_BUILD_MSI}" != "no" ]]; then
+    echo "Moving MSI"
+    mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" assets/
+  fi
+
+  if [[ "${SHOULD_BUILD_MSI_NOUP}" != "no" ]]; then
+    echo "Moving MSI with disabled updates"
+    mv "build\\windows\\msi\\releasedir\\${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" assets/
+  fi
+fi

build_cli.sh

@@ -32,6 +32,8 @@ if [[ "${OS_NAME}" == "osx" ]]; then
   export OPENSSL_LIB_DIR="$( pwd )/openssl/out/${VSCODE_ARCH}-osx/lib"
   export OPENSSL_INCLUDE_DIR="$( pwd )/openssl/out/${VSCODE_ARCH}-osx/include"
 
+  rustup target add "${VSCODE_CLI_TARGET}"
+
   cargo build --release --target "${VSCODE_CLI_TARGET}" --bin=code
 
   cp "target/${VSCODE_CLI_TARGET}/release/code" "../../VSCode-darwin-${VSCODE_ARCH}/${NAME_SHORT}.app/Contents/Resources/app/bin/${TUNNEL_APPLICATION_NAME}"
@@ -60,7 +62,7 @@ else
 
   if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
     VSCODE_CLI_TARGET="aarch64-unknown-linux-gnu"
-
+    
     if [[ "${CI_BUILD}" != "no" ]]; then
       export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
       export CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc
@@ -79,6 +81,21 @@ else
       export CXX_armv7_unknown_linux_gnueabihf=arm-linux-gnueabihf-g++
       export PKG_CONFIG_ALLOW_CROSS=1
     fi
+  elif [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
+    VSCODE_CLI_TARGET="powerpc64le-unknown-linux-gnu"
+
+    # Use system libs instead of @vscode/openssl-prebuilt
+    mkdir -p openssl/out/ppc64le-linux/
+    ln -sf /usr/lib/powerpc64le-linux-gnu openssl/out/ppc64le-linux/lib
+    ln -sf /usr/include openssl/out/ppc64le-linux/include
+
+    if [[ "${CI_BUILD}" != "no" ]] && [[ "$(uname -m)" != "ppc64le" ]]; then
+      export CARGO_TARGET_POWERPC64LE_UNKNOWN_LINUX_GNU_LINKER=powerpc64le-linux-gnu-gcc-10
+      export CC_powerpc64le_unknown_linux_gnu=powerpc64le-linux-gnu-gcc-10
+      export CXX_powerpc64le_unknown_linux_gnu=powerpc64le-linux-gnu-g++-10
+      export PKG_CONFIG_ALLOW_CROSS=1
+    fi
+
   elif [[ "${VSCODE_ARCH}" == "x64" ]]; then
     VSCODE_CLI_TARGET="x86_64-unknown-linux-gnu"
   fi

check_tags.sh

@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 # shellcheck disable=SC2129
 
+# Env Paramaters
+# CHECK_ALL: yes | no
+# CHECK_REH: yes | no
+# CHECK_ONLY_REH: yes | no
+# FORCE_LINUX_SNAP: true
+
 set -e
 
 if [[ -z "${GH_TOKEN}" ]] && [[ -z "${GITHUB_TOKEN}" ]] && [[ -z "${GH_ENTERPRISE_TOKEN}" ]] && [[ -z "${GITHUB_ENTERPRISE_TOKEN}" ]]; then
@@ -77,557 +83,34 @@ elif [[ "${ASSETS}" != "null" ]]; then
     fi
   # macos
   elif [[ "${OS_NAME}" == "osx" ]]; then
-    if [[ -z $( contains "${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-      echo "Building on MacOS because we have no ZIP"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_ZIP="no"
-    fi
-
-    if [[ -z $( contains ".${VSCODE_ARCH}.${RELEASE_VERSION}.dmg" ) ]]; then
-      echo "Building on MacOS because we have no DMG"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_DMG="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-reh-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no REH archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_REH="no"
-    fi
-
-    if [[ -z $( contains "${APP_NAME_LC}-reh-web-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-      echo "Building on MacOS because we have no REH-web archive"
-      export SHOULD_BUILD="yes"
-    else
-      export SHOULD_BUILD_REH_WEB="no"
-    fi
-
-    if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-      echo "Already have all the MacOS builds"
-    fi
+    . ./build/osx/check_tags.sh
   elif [[ "${OS_NAME}" == "windows" ]]; then
-
-    # windows-arm64
-    if [[ "${VSCODE_ARCH}" == "arm64" ]]; then
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows arm64 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows arm64 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows arm64 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      export SHOULD_BUILD_REH="no"
-      export SHOULD_BUILD_REH_WEB="no"
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows arm64 builds"
-      fi
-
-    # windows-ia32
-    elif [[ "${VSCODE_ARCH}" == "ia32" ]]; then
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows ia32 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows ia32 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows ia32 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows ia32 because we have no msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI_NOUP="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows ia32 because we have no updates-disabled msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI_NOUP="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows ia32 because we have no REH archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows ia32 because we have no REH-web archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH_WEB="no"
-      fi
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows ia32 builds"
-      fi
-
-    # windows-x64
-    else
-      if [[ -z $( contains "${APP_NAME}Setup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows x64 because we have no system setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_SYS="no"
-      fi
-
-      if [[ -z $( contains "UserSetup-${VSCODE_ARCH}-${RELEASE_VERSION}.exe" ) ]]; then
-        echo "Building on Windows x64 because we have no user setup"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_EXE_USR="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME}-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.zip" ) ]]; then
-        echo "Building on Windows x64 because we have no zip"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_ZIP="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows x64 because we have no msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI="no"
-      fi
-
-      if [[ "${DISABLE_MSI}" == "yes" ]]; then
-          export SHOULD_BUILD_MSI_NOUP="no"
-      elif [[ -z $( contains "${APP_NAME}-${VSCODE_ARCH}-updates-disabled-${RELEASE_VERSION}.msi" ) ]]; then
-        echo "Building on Windows x64 because we have no updates-disabled msi"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_MSI_NOUP="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no REH archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH="no"
-      fi
-
-      if [[ -z $( contains "${APP_NAME_LC}-reh-web-win32-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-        echo "Building on Windows x64 because we have no REH-web archive"
-        export SHOULD_BUILD="yes"
-      else
-        export SHOULD_BUILD_REH_WEB="no"
-      fi
-
-      if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-        echo "Already have all the Windows x64 builds"
-      fi
-    fi
+    . ./build/windows/check_tags.sh
   else
     if [[ "${OS_NAME}" == "linux" ]]; then
-      if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Linux ${VSCODE_ARCH} because we have no REH archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Linux REH ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH="no"
-        fi
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Linux ${VSCODE_ARCH} because we have no REH-web archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Linux REH-web ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH_WEB="no"
-        fi
-
-      else
-
-        # linux-arm64
-        if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "arm64.deb" ) ]]; then
-            echo "Building on Linux arm64 because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "aarch64.rpm" ) ]]; then
-            echo "Building on Linux arm64 because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ -z $( contains "arm64.snap" ) ]]; then
-            echo "Building on Linux arm64 because we have no SNAP"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_SNAP="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux arm64 builds"
-          fi
-        fi
-
-        # linux-armhf
-        if [[ "${VSCODE_ARCH}" == "armhf" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "armhf.deb" ) ]]; then
-            echo "Building on Linux arm because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "armv7hl.rpm" ) ]]; then
-            echo "Building on Linux arm because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-armhf-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux arm because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux arm builds"
-          fi
-        fi
-
-        # linux-ppc64le
-        if [[ "${VSCODE_ARCH}" == "ppc64le" || "${CHECK_ALL}" == "yes" ]]; then
-          SHOULD_BUILD_APPIMAGE="no"
-          SHOULD_BUILD_DEB="no"
-          SHOULD_BUILD_RPM="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-ppc64le-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux PowerPC64LE because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux PowerPC64LE builds"
-          fi
-        fi
-
-        # linux-riscv64
-        if [[ "${VSCODE_ARCH}" == "riscv64" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-riscv64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux RISC-V 64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux riscv64 builds"
-          fi
-        fi
-
-        # linux-loong64
-        if [[ "${VSCODE_ARCH}" == "loong64" || "${CHECK_ALL}" == "yes" ]]; then
-          export SHOULD_BUILD_DEB="no"
-          export SHOULD_BUILD_RPM="no"
-          export SHOULD_BUILD_APPIMAGE="no"
-
-          if [[ -z $( contains "${APP_NAME}-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-loong64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux Loong64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux Loong64 builds"
-          fi
-        fi
-
-        # linux-s390x
-        if [[ "${VSCODE_ARCH}" == "s390x" || "${CHECK_ALL}" == "yes" ]]; then
-          SHOULD_BUILD_APPIMAGE="no"
-          SHOULD_BUILD_DEB="no"
-          SHOULD_BUILD_RPM="no"
-          SHOULD_BUILD_TAR="no"
-
-          if [[ -z $( contains "${APP_NAME_LC}-reh-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux s390x because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME_LC}-reh-web-linux-s390x-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux s390x because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux s390x builds"
-          fi
-        fi
-
-        # linux-x64
-        if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ -z $( contains "amd64.deb" ) ]]; then
-            echo "Building on Linux x64 because we have no DEB"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_DEB="no"
-          fi
-
-          if [[ -z $( contains "x86_64.rpm" ) ]]; then
-            echo "Building on Linux x64 because we have no RPM"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_RPM="no"
-          fi
-
-          if [[ -z $( contains "${APP_NAME}-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no TAR"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_TAR="no"
-          fi
-
-          if [[ "${DISABLE_APPIMAGE}" == "yes" ]]; then
-            export SHOULD_BUILD_APPIMAGE="no"
-          elif [[ -z $( contains "x86_64.AppImage" ) ]]; then
-            echo "Building on Linux x64 because we have no AppImage"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_APPIMAGE="no"
-          fi
-
-          if [[ -z $( contains "amd64.snap" ) ]]; then
-            echo "Building on Linux x64 because we have no SNAP"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_SNAP="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-linux-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Linux x64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-
-          if [[ "${SHOULD_BUILD}" != "yes" ]]; then
-            echo "Already have all the Linux x64 builds"
-          fi
-        fi
-      fi
+      . ./build/linux/check_tags.sh
     fi
 
     if [[ "${OS_NAME}" == "alpine" ]] || [[ "${OS_NAME}" == "linux" && "${CHECK_ALL}" == "yes" ]]; then
-
-      if [[ "${CHECK_ONLY_REH}" == "yes" ]]; then
-        if [[ -z $( contains "${APP_NAME_LC}-reh-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Alpine ${VSCODE_ARCH} because we have no REH archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Alpine REH ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH="no"
-        fi
-
-        if [[ -z $( contains "${APP_NAME_LC}-reh-web-alpine-${VSCODE_ARCH}-${RELEASE_VERSION}.tar.gz" ) ]]; then
-          echo "Building on Alpine ${VSCODE_ARCH} because we have no REH-web archive"
-          export SHOULD_BUILD="yes"
-        else
-          echo "Already have the Alpine REH-web ${VSCODE_ARCH} archive"
-          export SHOULD_BUILD_REH_WEB="no"
-        fi
-      else
-
-        # alpine-arm64
-        if [[ "${VSCODE_ARCH}" == "arm64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine arm64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-arm64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine arm64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-        fi
-
-        # alpine-x64
-        if [[ "${VSCODE_ARCH}" == "x64" || "${CHECK_ALL}" == "yes" ]]; then
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine x64 because we have no REH archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH="no"
-          fi
-
-          if [[ "${CHECK_REH}" != "no" && -z $( contains "${APP_NAME_LC}-reh-web-alpine-x64-${RELEASE_VERSION}.tar.gz" ) ]]; then
-            echo "Building on Alpine x64 because we have no REH-web archive"
-            export SHOULD_BUILD="yes"
-          else
-            export SHOULD_BUILD_REH_WEB="no"
-          fi
-        fi
-      fi
+      . ./build/alpine/check_tags.sh
     fi
   fi
 else
   if [[ "${IS_SPEARHEAD}" == "yes" ]]; then
     export SHOULD_BUILD_SRC="yes"
   elif [[ "${OS_NAME}" == "linux" ]]; then
-    if [[ "${VSCODE_ARCH}" == "ppc64le" ]]; then
-      SHOULD_BUILD_DEB="no"
-      SHOULD_BUILD_RPM="no"
-      SHOULD_BUILD_TAR="no"
-    elif [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
+    if [[ "${VSCODE_ARCH}" == "riscv64" ]]; then
       SHOULD_BUILD_DEB="no"
       SHOULD_BUILD_RPM="no"
+      SHOULD_BUILD_CLI="no"
     elif [[ "${VSCODE_ARCH}" == "loong64" ]]; then
       SHOULD_BUILD_DEB="no"
       SHOULD_BUILD_RPM="no"
+      SHOULD_BUILD_CLI="no"
+    elif [[ "${VSCODE_ARCH}" == "s390x" ]]; then
+      SHOULD_BUILD_DEB="no"
+      SHOULD_BUILD_RPM="no"
+      SHOULD_BUILD_CLI="no"
     fi
     if [[ "${VSCODE_ARCH}" != "x64" || "${DISABLE_APPIMAGE}" == "yes" ]]; then
       export SHOULD_BUILD_APPIMAGE="no"
@@ -658,6 +141,7 @@ echo "SHOULD_BUILD_MSI=${SHOULD_BUILD_MSI}" >> "${GITHUB_ENV}"
 echo "SHOULD_BUILD_MSI_NOUP=${SHOULD_BUILD_MSI_NOUP}" >> "${GITHUB_ENV}"
 echo "SHOULD_BUILD_REH=${SHOULD_BUILD_REH}" >> "${GITHUB_ENV}"
 echo "SHOULD_BUILD_REH_WEB=${SHOULD_BUILD_REH_WEB}" >> "${GITHUB_ENV}"
+echo "SHOULD_BUILD_CLI=${SHOULD_BUILD_CLI}" >> "${GITHUB_ENV}"
 echo "SHOULD_BUILD_RPM=${SHOULD_BUILD_RPM}" >> "${GITHUB_ENV}"
 echo "SHOULD_BUILD_SNAP=${SHOULD_BUILD_SNAP}" >> "${GITHUB_ENV}"
 echo "SHOULD_BUILD_TAR=${SHOULD_BUILD_TAR}" >> "${GITHUB_ENV}"

dev/build.sh

@@ -6,6 +6,7 @@
 ###
 
 export APP_NAME="VSCodium"
+export ASSETS_REPOSITORY="VSCodium/vscodium"
 export BINARY_NAME="codium"
 export CI_BUILD="no"
 export GH_REPO_PATH="VSCodium/vscodium"
@@ -21,6 +22,7 @@ export VSCODE_SKIP_NODE_VERSION_CHECK="yes"
 while getopts ":ilops" opt; do
   case "$opt" in
     i)
+      export ASSETS_REPOSITORY="VSCodium/vscodium-insiders"
       export BINARY_NAME="codium-insiders"
       export VSCODE_QUALITY="insider"
       ;;
@@ -110,6 +112,10 @@ if [[ "${SKIP_BUILD}" == "no" ]]; then
     git add .
     git reset -q --hard HEAD
 
+    while [[ -n "$( git log -1 | grep "VSCODIUM HELPER" )" ]]; do
+      git reset -q --hard HEAD~
+    done
+
     rm -rf .build out*
 
     cd ..

dev/merge-patches.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+
+set -e
+
+normalize_file() {
+  if [[ "${1}" == *patch ]]; then
+    FILE="${1}"
+  else
+    FILE="${1}.patch"
+  fi
+
+  if [[ "${FILE}" == patches/* ]]; then
+    FILE="../${FILE}"
+  else
+    FILE="../patches/${FILE}"
+  fi
+}
+
+cd vscode || { echo "'vscode' dir not found"; exit 1; }
+
+git add .
+git reset -q --hard HEAD
+
+while [[ -n "$( git log -1 | grep "VSCODIUM HELPER" )" ]]; do
+  git reset -q --hard HEAD~
+done
+
+git apply --reject "../patches/helper/settings.patch"
+git add .
+git commit --no-verify -q -m "VSCODIUM HELPER"
+
+while [ $# -gt 1 ]; do
+  normalize_file "${1}"
+
+  echo "FILE: ${FILE}"
+
+  if [[ -f "${FILE}" ]]; then
+    if [[ -f "${FILE}.bak" ]]; then
+      mv -f $FILE{.bak,}
+    fi
+
+    git apply --reject "${FILE}" || true
+  fi
+
+  while [[ -n "$( find . -name '*.rej' -print )" ]]; do
+    echo
+    read -rp "Press any key when the conflict have been resolved..." -n1 -s
+  done
+
+  shift
+done
+
+normalize_file "${1}"
+
+git add .
+git diff --staged -U1 > "${FILE}"
+
+if [[ "${FILE}" != "../patches/helper/settings.patch" ]]; then
+  git reset -q --hard HEAD
+else
+  git reset -q --hard HEAD~
+fi
+
+echo "The patch has been generated."

dev/patch.sh

@@ -2,7 +2,19 @@
 
 set -e
 
-echo "$#"
+normalize_file() {
+  if [[ "${1}" == *patch ]]; then
+    FILE="${1}"
+  else
+    FILE="${1}.patch"
+  fi
+
+  if [[ "${FILE}" == patches/* ]]; then
+    FILE="../${FILE}"
+  else
+    FILE="../patches/${FILE}"
+  fi
+}
 
 cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
@@ -13,38 +25,94 @@ while [[ -n "$( git log -1 | grep "VSCODIUM HELPER" )" ]]; do
   git reset -q --hard HEAD~
 done
 
-git apply --reject "../patches/helper/settings.patch"
+normalize_file "${1}"
 
-while [ $# -gt 1 ]; do
-  echo "Parameter: $1"
-  if [[ "${1}" == *patch ]]; then
-    FILE="../patches/${1}"
+if [[ "${FILE}" != "../patches/helper/settings.patch" ]]; then
+  git apply --reject "../patches/helper/settings.patch"
+
+  if [[ $# -gt 1 ]]; then
+    while [ $# -gt 1 ]; do
+      echo "Parameter: $1"
+      normalize_file "${1}"
+
+      git apply --reject "${FILE}"
+
+      shift
+    done
+
+    git add .
+    git commit --no-verify -q -m "VSCODIUM HELPER"
+
+    normalize_file "${1}"
   else
-    FILE="../patches/${1}.patch"
+    normalize_file "${1}"
+
+    BASENAME=$(basename "${FILE}")
+    DIRNAME=$(dirname "${FILE}")
+
+    if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+      GROUP_ID="${BASH_REMATCH[1]}"
+      INDEX="${BASH_REMATCH[2]}"
+      ENDNAME="${BASH_REMATCH[3]}"
+
+      for ((I = 0; I < INDEX; I++)); do
+        NOT_FOUND=1
+
+        for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+          if [[ -f "$CANDIDATE" ]]; then
+            echo "Candidate: ${CANDIDATE}"
+            normalize_file "${CANDIDATE}"
+
+            git apply --reject "${FILE}"
+
+            NOT_FOUND=0
+          fi
+        done
+
+        if (( $NOT_FOUND )); then
+          for CANDIDATE in "${DIRNAME}/../${GROUP_ID}${I}-"*.patch; do
+            if [[ -f "$CANDIDATE" ]]; then
+              echo "Candidate: ${CANDIDATE}"
+              normalize_file "${CANDIDATE}"
+
+              git apply --reject "${FILE}"
+            fi
+          done
+        fi
+      done
+    fi
+
+    git add .
+    git commit --no-verify -q -m "VSCODIUM HELPER"
+
+    normalize_file "${1}"
   fi
-
-  git apply --reject "${FILE}"
-
-  shift
-done
-
-git add .
-git commit --no-verify -q -m "VSCODIUM HELPER"
-
-if [[ "${1}" == *patch ]]; then
-  FILE="../patches/${1}"
-else
-  FILE="../patches/${1}.patch"
 fi
 
+echo "FILE: ${FILE}"
+
 if [[ -f "${FILE}" ]]; then
+  if [[ -f "${FILE}.bak" ]]; then
+    mv -f $FILE{.bak,}
+  fi
+
   git apply --reject "${FILE}" || true
 fi
 
 read -rp "Press any key when the conflict have been resolved..." -n1 -s
 
+while [[ -n "$( find . -name '*.rej' -print )" ]]; do
+  echo
+  read -rp "Press any key when the conflict have been resolved..." -n1 -s
+done
+
 git add .
 git diff --staged -U1 > "${FILE}"
-git reset -q --hard HEAD~
+
+if [[ "${FILE}" != "../patches/helper/settings.patch" ]]; then
+  git reset -q --hard HEAD
+else
+  git reset -q --hard HEAD~
+fi
 
 echo "The patch has been generated."

dev/update_api.sh

@@ -14,7 +14,6 @@ while getopts ":i" opt; do
   esac
 done
 
-
 URL=$( curl -s "https://update.code.visualstudio.com/api/update/win32-x64-archive/${VSCODE_QUALITY}/0000000000000000000000000000000000000000" | jq -c '.url' | sed -E 's/.*"([^"]+)".*/\1/' )
 # echo "url: ${URL}"
 FILE="${URL##*/}"
@@ -30,10 +29,17 @@ if [[ ! -d "${DIRECTORY}" ]]; then
   unzip "${FILE}" -d "${DIRECTORY}"
 fi
 
-APIS=$( jq -r '.extensionEnabledApiProposals' "${DIRECTORY}/resources/app/product.json" )
+BIN_PATH=$(find "${DIRECTORY}/bin" -type f ! -name "*.*")
 
+LINE="$( grep -E '^[[:space:]]*(export[[:space:]]+)?VERSIONFOLDER[[:space:]]*=' "$BIN_PATH" | tail -n1 )"
+VERSIONFOLDER="${LINE#*=}"
+VERSIONFOLDER="${VERSIONFOLDER#\"}"
+VERSIONFOLDER="${VERSIONFOLDER%\"}"
+
+APIS=$( jq -r '.extensionEnabledApiProposals' "${DIRECTORY}/${VERSIONFOLDER}/resources/app/product.json" )
 APIS=$( echo "${APIS}" | jq '. += {"jeanp413.open-remote-ssh": ["resolvers", "tunnels", "terminalDataWriteEvent", "contribRemoteHelp", "contribViewsRemote"]}' )
 APIS=$( echo "${APIS}" | jq '. += {"jeanp413.open-remote-wsl": ["resolvers", "contribRemoteHelp", "contribViewsRemote"]}' )
+echo "$( jq --argjson v "${APIS}" 'setpath(["extensionEnabledApiProposals"]; $v)' product.json )" > product.json
 
-jsonTmp=$( jq --argjson v "${APIS}" 'setpath(["extensionEnabledApiProposals"]; $v)' product.json )
-echo "${jsonTmp}" > product.json && unset jsonTmp
+APIS=$( jq -r '.extensionsEnabledWithApiProposalVersion' "${DIRECTORY}/${VERSIONFOLDER}/resources/app/product.json" )
+echo "$( jq --argjson v "${APIS}" 'setpath(["extensionsEnabledWithApiProposalVersion"]; $v)' product.json )" > product.json

dev/update_patches.sh

@@ -12,6 +12,75 @@ while getopts ":i" opt; do
   esac
 done
 
+generate_rejects() {
+  local PATCH_FILE="$1"
+
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "python3 not found; cannot create reject files for ${PATCH_FILE}"
+    return 1
+  fi
+
+  PATCH_FOR_REJECT="${PATCH_FILE}" python3 <<'PY'
+import os
+import pathlib
+import re
+import subprocess
+
+
+def chunk_needs_reject(raw_chunk: str) -> bool:
+    """Return True when a patch chunk cannot be applied nor reversed."""
+
+    chunk = raw_chunk if raw_chunk.endswith("\n") else raw_chunk + "\n"
+
+    def _run_git(extra_args):
+        return subprocess.run(
+            ["git", "apply", "--check", "--ignore-whitespace", *extra_args],
+            input=chunk,
+            text=True,
+            capture_output=True,
+        )
+
+    forward = _run_git([])
+    if forward.returncode == 0:
+        return False
+
+    reverse = _run_git(["--reverse"])
+    if reverse.returncode == 0:
+        return False
+
+    return True
+
+patch_path = os.environ["PATCH_FOR_REJECT"]
+with open(patch_path, "r", encoding="utf-8", errors="ignore") as src:
+    content = src.read()
+
+chunks = re.split(r'(?m)^diff --git ', content)
+for chunk in chunks:
+    chunk = chunk.strip()
+    if not chunk:
+        continue
+    chunk = "diff --git " + chunk
+    match = re.search(r'^diff --git a/(.*?) b/(.*?)$', chunk, re.MULTILINE)
+    if not match:
+        continue
+    a_path, b_path = match.groups()
+    candidate = b_path if b_path != "/dev/null" else a_path
+    if candidate in ("/dev/null", ""):
+        continue
+    if candidate.startswith("../") or candidate.startswith("..\\") or candidate.startswith("/"):
+        continue
+    dest = pathlib.Path(candidate + ".rej")
+    if not chunk_needs_reject(chunk):
+      continue
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    with dest.open("w", encoding="utf-8") as fh:
+      fh.write(chunk)
+      if not chunk.endswith("\n"):
+        fh.write("\n")
+    print(f"generated reject: {dest}")
+PY
+}
+
 check_file() {
   while [ $# -gt 1 ]; do
     git apply --reject "${1}"
@@ -19,22 +88,50 @@ check_file() {
     shift
   done
 
+  if [[ -f "${1}.bak" ]]; then
+    mv -f $1{.bak,}
+  fi
+
   if [[ -f "${1}" ]]; then
+    git apply --reject "../patches/helper/settings.patch"
+    git add .
+    git commit --no-verify -q -m "VSCODIUM HELPER"
+
     echo applying patch: "${1}"
+
     if ! git apply --ignore-whitespace "${1}"; then
       echo failed to apply patch "${1}"
 
-      git apply --reject "${1}"
-      git apply --reject "../patches/helper/settings.patch"
+      git apply --reject --verbose "${1}"
 
-      read -rp "Press any key when the conflict have been resolved..." -n1 -s
+      if [[ -z "$( find . -name '*.rej' -print )" ]]; then
+        echo "no .rej generated by git; creating fallback rejects for ${1}"
+
+        if ! generate_rejects "${1}"; then
+          echo "failed to generate reject files for ${1}"
+          exit 1
+        fi
+
+        if [[ -z "$( find . -name '*.rej' -print )" ]]; then
+          echo "still no .rej after attempting to create them for ${1}"
+          exit 1
+        fi
+      fi
+
+      while [[ -n "$( find . -name '*.rej' -print )" ]]; do
+        echo "patch: ${1}"
+        find . -name '*.rej' -print
+        read -rp "Press any key when the conflict have been resolved..." -n1 -s
+        echo
+      done
 
       git restore .vscode/settings.json
       git add .
       git diff --staged -U1 > "${1}"
     fi
+
     git add .
-    git reset -q --hard HEAD
+    git reset -q --hard HEAD~
   fi
 }
 
@@ -43,8 +140,34 @@ cd vscode || { echo "'vscode' dir not found"; exit 1; }
 git add .
 git reset -q --hard HEAD
 
+while [[ -n "$( git log -1 | grep "VSCODIUM HELPER" )" ]]; do
+  git reset -q --hard HEAD~
+done
+
 for FILE in ../patches/*.patch; do
-  check_file "${FILE}"
+  ADDITIONAL_FILES=()
+  BASENAME=$(basename "${FILE}")
+  DIRNAME=$(dirname "${FILE}")
+
+  if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+    GROUP_ID="${BASH_REMATCH[1]}"
+    INDEX="${BASH_REMATCH[2]}"
+    ENDNAME="${BASH_REMATCH[3]}"
+
+    for ((I = 0; I < INDEX; I++)); do
+      for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+        if [[ -f "$CANDIDATE" ]]; then
+          ADDITIONAL_FILES+=("$CANDIDATE")
+        fi
+      done
+    done
+  fi
+
+  if [[ ${#ADDITIONAL_FILES[@]} -gt 0 ]]; then
+    check_file ${ADDITIONAL_FILES[@]} "${FILE}"
+  else
+    check_file "${FILE}"
+  fi
 done
 
 if [[ "${VSCODE_QUALITY}" == "insider" ]]; then
@@ -55,19 +178,44 @@ fi
 
 for ARCH in alpine linux osx windows; do
   for FILE in "../patches/${ARCH}/"*.patch; do
-    if [[ "${FILE}" != *"/arch-"* ]]; then
+    ADDITIONAL_FILES=()
+    BASENAME=$(basename "${FILE}")
+    DIRNAME=$(dirname "${FILE}")
+
+    if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+      GROUP_ID="${BASH_REMATCH[1]}"
+      INDEX="${BASH_REMATCH[2]}"
+      ENDNAME="${BASH_REMATCH[3]}"
+
+      for ((I = 0; I < INDEX; I++)); do
+        NOT_FOUND=1
+
+        for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+          if [[ -f "$CANDIDATE" ]]; then
+            ADDITIONAL_FILES+=("$CANDIDATE")
+            NOT_FOUND=0
+          fi
+        done
+
+        if (( $NOT_FOUND )); then
+          for CANDIDATE in "${DIRNAME}/../${GROUP_ID}${I}-"*.patch; do
+            if [[ -f "$CANDIDATE" ]]; then
+              ADDITIONAL_FILES+=("$CANDIDATE")
+            fi
+          done
+        fi
+      done
+
+      if [[ ${#ADDITIONAL_FILES[@]} -gt 0 ]]; then
+        check_file ${ADDITIONAL_FILES[@]} "${FILE}"
+      else
+        check_file "${FILE}"
+      fi
+    else
       check_file "${FILE}"
     fi
   done
 
-  if [[ "${ARCH}" == "linux" ]]; then
-    check_file "../patches/linux/arch-0-support.patch"
-    check_file "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch"
-    check_file "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch"
-    check_file "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch" "../patches/linux/arch-3-loong64.patch"
-    check_file "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch" "../patches/linux/arch-3-loong64.patch" "../patches/linux/arch-4-s390x.patch"
-  fi
-
   for TARGET in client reh; do
     for FILE in "../patches/${ARCH}/${TARGET}/"*.patch; do
       check_file "${FILE}"

docs/accounts-authentication.md

@@ -1,3 +1,5 @@
+<!-- order: 0 -->
+
 # Accounts authentication
 
 ## GitHub

docs/ext-github-copilot.md

@@ -0,0 +1,22 @@
+<!-- order: 16 -->
+
+# Extension: GitHub Copilot
+
+Unlike Visual Studio Code, in VSCodium, Copilot features are disabled and not configured.
+
+## Update your settings
+
+In your settings, sets:
+```
+"chat.disableAIFeatures": false,
+```
+
+## Configure product.json
+
+You need to create a custom `product.json` at the following location (replace `VSCodium` by `VSCodium - Insiders` if you use that):
+- Windows: `%APPDATA%\VSCodium` or `%USERPROFILE%\AppData\Roaming\VSCodium`
+- macOS: `~/Library/Application Support/VSCodium`
+- Linux: `$XDG_CONFIG_HOME/VSCodium` or `~/.config/VSCodium`
+
+Then you will need to follow the guide [Running with Code OSS](https://github.com/microsoft/vscode-copilot-chat/blob/main/CONTRIBUTING.md#running-with-code-oss) with the `product.json` file created previously.
+You will need to add the properties: `trustedExtensionAuthAccess` and `defaultChatAgent`.

docs/extensions-compatibility.md

@@ -1,29 +1,44 @@
+<!-- order: 0 -->
+
 # Extensions compatibility
 
-## Partial Compatibility
+## Table of Contents
 
-- [Python](https://marketplace.visualstudio.com/items?itemName=ms-python.python)
-> [Since May 2021](https://devblogs.microsoft.com/python/python-in-visual-studio-code-may-2021-release/), Python is using a closed source language server ([Pylance](https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-pylance))
+- [Incompatibility](#incompatibility)
+- [Replacements](#replacements)
+  - [C/C++](#cc)
+  - [Python](#python)
+  - [Remote](#remote)
 
-## Incompatibility
+## <a id="incompatibility"></a>Incompatibility
 
-- [LaTeX Workshop](https://marketplace.visualstudio.com/items?itemName=James-Yu.latex-workshop)
-> It's officially unsupported: https://github.com/James-Yu/LaTeX-Workshop/wiki/FAQ#vscodium-is-not-officially-supported
-
-## Incompatibility due to licensing
-
-The following extensions are not compatible with VSCodium due to their licensing:
+Most Microsoft extensions are limited to run on only MS products by their license and by running additional checks in their proprietary code.
 
+Extensions incompatible with VSCodium **include**:
+- [C/C++](https://marketplace.visualstudio.com/items?itemName=ms-vscode.cpptools)
+- [LaTeX Workshop](https://marketplace.visualstudio.com/items?itemName=James-Yu.latex-workshop) (explicitly unsupported, as [indicated in the FAQ](https://github.com/James-Yu/LaTeX-Workshop/wiki/FAQ#vscodium-is-not-officially-supported))
 - [Live Share](https://marketplace.visualstudio.com/items?itemName=MS-vsliveshare.vsliveshare)
+- [Python](https://marketplace.visualstudio.com/items?itemName=ms-python.python)
 - [Remote - Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
 - [Remote - SSH](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh)
 - [Remote - SSH: Editing Configuration Files](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh-edit)
 - [Remote - WSL](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-wsl)
 
-## Replacements
+## <a id="replacements"></a>Replacements
 
 The following extensions are functional replacements for incompatible extensions:
 
-- [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh)
+### <a id="cc"></a>C/C++
+
+- [clangd](https://open-vsx.org/extension/llvm-vs-code-extensions/vscode-clangd) for full featured editing (including IntelliSense)
+- [Native Debug](https://open-vsx.org/extension/webfreak/debug) for Debugging with GDB + LLDB  
+  Note that there are many working debugging extensions and specialized ones including for microcontrollers.
+
+### <a id="python"></a>Python
+
+- [BasedPyright](https://open-vsx.org/extension/detachhead/basedpyright)
+
+### <a id="remote"></a>Remote Development
+
+- [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh) (SSH server must be configured with the setting `AllowTcpForwarding yes`.)
 - [Open Remote - WSL](https://open-vsx.org/extension/jeanp413/open-remote-wsl)
-- [BasedPyright](https://open-vsx.org/extension/detachhead/basedpyright) (open-source alternative to Pylance)

docs/extensions.md

@@ -0,0 +1,136 @@
+<!-- order: 15 -->
+
+# Extensions + Marketplace
+
+## Table of Contents
+
+- [Marketplace](#marketplace)
+- [How to use the OpenVSX Marketplace](#howto-openvsx-marketplace)
+- [How to use a different extension gallery](#howto-switch-marketplace)
+- [How to self host your own extension gallery](#howto-selfhost-marketplace)
+- [Visual Studio Marketplace](#visual-studio-marketplace)
+- [Proprietary Debugging Tools](#proprietary-debugging-tools)
+- [Proprietary Extensions](#proprietary-extensions)
+- [Using the "VSIX Manager" Extension](#vsix-manager)
+- [Extensions compatibility](https://github.com/VSCodium/vscodium/blob/master/docs/extensions-compatibility.md)
+
+## <a id="marketplace"></a>Marketplace
+
+Being a vscode based editor, VSCodium gets additional features by installing Visual Studio Code extensions.
+Unfortunately, as Microsoft [prohibits usages of the Microsoft marketplace by any other products](https://github.com/microsoft/vscode/issues/31168) or redistribution of `.vsix` files from it, in order to use Visual Studio Code extensions in non-Microsoft products those need to be installed differently.
+
+By default, the `product.json` file is set up to use [open-vsx.org](https://open-vsx.org/) as extension gallery, which has an [adapter](https://github.com/eclipse/openvsx/wiki/Using-Open-VSX-in-VS-Code) to the Marketplace API used by Visual Studio Code. Since that is a rather new project, you will likely miss some extensions you know from the Visual Studio Marketplace. You have the following options to obtain such missing extensions:
+
+* Ask the extension maintainers to publish to [open-vsx.org](https://open-vsx.org/) in addition to the Visual Studio Marketplace. The publishing process is documented in the [Open VSX Wiki](https://github.com/eclipse/openvsx/wiki/Publishing-Extensions).
+* Create a pull request to [this repository](https://github.com/open-vsx/publish-extensions) to have the [@open-vsx](https://github.com/open-vsx) service account publish the extensions for you.
+* Download and [install the vsix files](https://code.visualstudio.com/docs/editor/extension-gallery#_install-from-a-vsix), for example from the release page in their source repository.
+
+## <a id="howto-openvsx-marketplace"></a>How to use the Open VSX Registry
+
+As noted above, the [Open VSX Registry](https://open-vsx.org/) is the pre-set extension gallery in VSCodium. Using the extension view in VSCodium will therefore by default use it.
+See [this article](https://web.archive.org/web/20200423131829/https://www.gitpod.io/blog/open-vsx/) for more information on the motivation behind Open VSX.
+
+## <a id="howto-switch-marketplace"></a>How to use a different extension gallery
+
+You can switch from the pre-set Open VSX Registry by configuring the endpoints using the following solutions.
+
+You can either use the following environment variables:
+- `VSCODE_GALLERY_SERVICE_URL` ***(required)***
+- `VSCODE_GALLERY_ITEM_URL` ***(required)***
+- `VSCODE_GALLERY_CACHE_URL`
+- `VSCODE_GALLERY_CONTROL_URL`
+- `VSCODE_GALLERY_EXTENSION_URL_TEMPLATE` ***(required)***
+- `VSCODE_GALLERY_RESOURCE_URL_TEMPLATE`
+
+Or by creating a custom `product.json` at the following location (replace `VSCodium` by `VSCodium - Insiders` if you use that):
+- Windows: `%APPDATA%\VSCodium` or `%USERPROFILE%\AppData\Roaming\VSCodium`
+- macOS: `~/Library/Application Support/VSCodium`
+- Linux: `$XDG_CONFIG_HOME/VSCodium` or `~/.config/VSCodium`
+
+with the content like:
+
+```jsonc
+{
+  "extensionsGallery": {
+    "serviceUrl": "", // required
+    "itemUrl": "", // required
+    "cacheUrl": "",
+    "controlUrl": "",
+    "extensionUrlTemplate": "", // required
+    "resourceUrlTemplate": "",
+  }
+}
+```
+
+## <a id="howto-selfhost-marketplace"></a>How to self-host your own extension gallery
+
+Individual developers and enterprise companies in regulated or security-conscious industries can self-host their own extension gallery.
+
+There are likely other options, but the following were reported to work:
+
+* [Open VSX](https://github.com/eclipse/openvsx) eclipse open-source project
+  While the public instance which is run by the Eclipse Foundation is the pre-set endpoint in VSCodium, you can host your own instance.
+
+    > Open VSX is a [vendor-neutral](https://projects.eclipse.org/projects/ecd.openvsx) open-source alternative to the [Visual Studio Marketplace](https://marketplace.visualstudio.com/vscode). It provides a server application that manages [Visual Studio Code extensions](https://code.visualstudio.com/api) in a database, a web application similar to the Visual Studio Marketplace, and a command-line tool for publishing extensions similar to [vsce](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#vsce).
+
+* [code-marketplace](https://coder.com/blog/running-a-private-vs-code-extension-marketplace) open-source project
+
+    > `code-marketplace` is a self-contained go binary that does not have a frontend or any mechanisms for extension authors to add or update extensions in the marketplace. It simply reads extensions from file storage and provides an API for VSCode compatible editors to consume.
+
+## <a id="visual-studio-marketplace"></a>Visual Studio Marketplace
+
+As with any online service, ensure you've understood [its terms of use](https://aka.ms/vsmarketplace-ToU) which include:
+> Marketplace Offerings are intended for use only with Visual Studio Products and Services and you may only install and use Marketplace Offerings with Visual Studio Products and Services.
+
+So, we can't provide any help if you intend to infringe their terms of use.
+
+Also note that this extension gallery hosts multiple extensions that are non-free and have license-agreements that explicitly forbid using them in non-Microsoft products, along with using telemetry.
+
+## <a id="proprietary-debugging-tools"></a>Proprietary Debugging Tools
+
+The debugger provided with Microsoft's [C# extension](https://github.com/OmniSharp/omnisharp-vscode) as well as the (Windows) debugger provided with their [C++ extension](https://github.com/Microsoft/vscode-cpptools) are very restrictively licensed to only work with the official Visual Studio Code build. See [this comment in the C# extension repo](https://github.com/OmniSharp/omnisharp-vscode/issues/2491#issuecomment-418811364) and [this comment in the C++ extension repo](https://github.com/Microsoft/vscode-cpptools/issues/21#issuecomment-248349017).
+
+A workaround exists to get debugging working in C# projects, by using Samsung's opensource [netcoredbg](https://github.com/Samsung/netcoredbg) package. See [this comment](https://github.com/VSCodium/vscodium/issues/82#issue-409806641) for instructions on how to set that up.
+
+## <a id="proprietary-extensions"></a>Proprietary Extensions
+
+Like the debuggers mentioned above, some extensions you may find in the marketplace (like the [Remote Development Extensions](https://code.visualstudio.com/docs/remote/remote-overview)) only function with the official Visual Studio Code build. You can work around this by adding the extension's internal ID (found on the extension's page) to the `extensionAllowedProposedApi` property of the product.json in your VSCodium installation. For example:
+
+```jsonc
+  "extensionAllowedProposedApi": [
+    // ...
+    "ms-vscode-remote.vscode-remote-extensionpack",
+    "ms-vscode-remote.remote-wsl",
+    // ...
+  ],
+```
+
+In some cases, the above change won't help because the extension is hard-coded to only work with the official Visual Studio Code product.
+
+## <a id="vsix-manager"></a>Using the "VSIX Manager" Extension
+
+The [**VSIX Manager**](https://github.com/zokugun/vscode-vsix-manager) extension provides a powerful and user-friendly interface for managing `.vsix` files directly within VSCodium. Its author is the main maintainer of VSCodium ;)
+
+It is particularly beneficial for:
+- **Support for Multiple Marketplaces**: Seamlessly install and manage extensions from several marketplaces at the same time, allowing access to a broader range of extensions.
+- **Local Files**: Manage a collection of `.vsix` files stored locally.
+- **GitHub/Forgejo Release**: Install the extension directly from its GitHub/Forgejo release pages.
+- **Fallback Options**
+
+### <a id="use-cases"></a>Use Cases
+
+- Developers working offline can easily manage `.vsix` files.
+- Teams can distribute specific versions of extensions across systems.
+- Enterprises with restricted environments can maintain control over installed extensions.
+- Users can connect to multiple marketplaces and access a wider range of extensions or switch seamlessly between them.
+
+### <a id="marketplace-support"></a>Marketplace Support
+
+The **VSIX Manager** extension supports managing extensions from several marketplaces simultaneously. This feature enables:
+- **Access to Diverse Extensions**: Install extensions from different sources like Open VSX or private repositories.
+- **Fallback Options**: Ensure extension availability even if one marketplace is temporarily inaccessible.
+- **Enterprise Flexibility**: Use private or self-hosted marketplaces alongside public ones to meet security and compliance requirements.
+- **Custom Configurations**: Prioritize specific marketplaces for particular needs while keeping access to others.
+
+## [Extensions compatibility](https://github.com/VSCodium/vscodium/blob/master/docs/extensions-compatibility.md)
+

docs/getting-started.md

@@ -0,0 +1,50 @@
+<!-- order: 5 -->
+
+# Getting Started with VSCodium
+
+This guide will help you get started with VSCodium.
+
+## Table of Contents
+
+- [Installation](#installation)
+- [First Steps](#first-steps)
+- [Basic Usage](#basic-usage)
+- [Keyboard Shortcuts](#keyboard-shortcuts)
+- [Next Steps](#next-steps)
+
+## <a id="installation"></a>Installation
+
+VSCodium can be installed on Windows, macOS, and Linux. Visit the [download page](https://vscodium.com/#install) for installation instructions.
+
+## <a id="first-steps"></a>First Steps
+
+After installing VSCodium, here are some first steps to get started:
+
+1. **Open a folder**: Use File > Open Folder to open your project
+2. **Install extensions**: Click on the Extensions icon in the sidebar to browse and install extensions
+3. **Configure settings**: Use File > Preferences > Settings to customize your editor
+
+## <a id="basic-usage"></a>Basic Usage
+
+VSCodium works just like Visual Studio Code, with a few differences:
+
+- It uses Open VSX for extensions by default instead of the Visual Studio Marketplace
+- It doesn't include Microsoft telemetry or branding
+- Some proprietary features may not be available
+
+## <a id="keyboard-shortcuts"></a>Keyboard Shortcuts
+
+Here are some essential keyboard shortcuts to get you started:
+
+- `Ctrl+P` (Windows/Linux) or `Cmd+P` (macOS): Quick Open, Go to File
+- `Ctrl+Shift+P` (Windows/Linux) or `Cmd+Shift+P` (macOS): Show Command Palette
+- `Ctrl+,` (Windows/Linux) or `Cmd+,` (macOS): User Settings
+- `Ctrl+K Ctrl+S` (Windows/Linux) or `Cmd+K Cmd+S` (macOS): Keyboard Shortcuts
+
+## <a id="next-steps"></a>Next Steps
+
+Once you're comfortable with the basics, you might want to:
+
+- Explore the [documentation](https://github.com/VSCodium/vscodium/blob/master/docs/index.md) for more details
+- Join the [community](https://github.com/VSCodium/vscodium/discussions) to ask questions and share tips
+- Contribute to the [project](https://github.com/VSCodium/vscodium/blob/master/CONTRIBUTING.md) if you're interested

docs/howto-build.md

@@ -1,3 +1,5 @@
+<!-- order: 35 -->
+
 # How to build VSCodium
 
 ## Table of Contents
@@ -6,7 +8,8 @@
   - [Linux](#dependencies-linux)
   - [MacOS](#dependencies-macos)
   - [Windows](#dependencies-windows)
-- [Build Scripts](#build-scripts)
+- [Build for Development](#build-dev)
+- [Build for CI/Downstream](#build-ci)
 - [Build Snap](#build-snap)
 - [Patch Update Process](#patch-update-process)
   - [Semi-Automated](#patch-update-process-semiauto)
@@ -14,10 +17,11 @@
 
 ## <a id="dependencies"></a>Dependencies
 
-- node 20.14
+- node (check [.nvmrc](../.nvmrc) for version)
 - jq
 - git
 - python3 3.11
+- rustup
 
 ### <a id="dependencies-linux"></a>Linux
 
@@ -42,19 +46,85 @@ see [the common dependencies](#dependencies)
 
 ### <a id="dependencies-windows"></a>Windows
 
-- powershell
-- sed
-- 7z
-- [WiX Toolset](http://wixtoolset.org/releases/)
-- 'Tools for Native Modules' from the official Node.js installer
+The build scripts are written in Bash, so on Windows you must run them inside **Git Bash** (bundled with [Git for Windows](https://gitforwindows.org/)) or **WSL2**.
 
-## <a id="build-scripts"></a>Build Scripts
+#### Required tools
+
+- **Git for Windows** — provides Git Bash, `sed`, and POSIX utilities used by the build scripts:
+
+  ```cmd
+  winget install --id Git.Git -e
+  ```
+
+- **Node.js** — exact version is specified in [`.nvmrc`](../.nvmrc). Use [nvm-windows](https://github.com/coreybutler/nvm-windows) to manage versions:
+
+  ```cmd
+  nvm install <version-from-.nvmrc>
+  nvm use <version-from-.nvmrc>
+  ```
+
+  Alternatively, download directly from [nodejs.org](https://nodejs.org/). During installation, enable **"Automatically install the necessary tools"** to get the C++ build tools (required for native Node addons).
+
+- **jq** — JSON processor used throughout the build scripts:
+
+  ```cmd
+  winget install --id jqlang.jq -e
+  ```
+
+- **7-Zip** — used to package `.zip` archives:
+
+  ```cmd
+  winget install --id 7zip.7zip -e
+  ```
+
+- **Python 3.11** — required by the VS Code build system:
+
+  ```cmd
+  winget install --id Python.Python.3.11 -e
+  ```
+
+  Ensure `python` / `python3` is on your `PATH` after installation.
+
+- **Rustup** — required to compile some native VS Code modules:
+
+  ```cmd
+  winget install --id Rustlang.Rustup -e
+  ```
+
+  Restart your shell afterwards so `cargo` and `rustc` are on your `PATH`.
+
+#### Optional tools
+
+- **WiX Toolset v3** _(only needed for `.msi` installer packaging, i.e., the `-p` flag)_:
+
+  Download from [wixtoolset.org](https://wixtoolset.org/releases/) and ensure `candle.exe` / `light.exe` are on your `PATH`.
+
+#### PATH verification
+
+After installing all tools, verify each is discoverable from Git Bash:
+
+```bash
+node --version    # should match .nvmrc
+npm --version
+jq --version
+python3 --version # should be 3.11.x
+cargo --version
+7z i 2>&1 | head -1
+git --version
+```
+
+If any command is not found, add its install directory to your `PATH` via **System Properties → Environment Variables → Path**.
+
+## <a id="build-dev"></a>Build for Development
 
 A build helper script can be found at `dev/build.sh`.
 
 - Linux: `./dev/build.sh`
 - MacOS: `./dev/build.sh`
-- Windows: `powershell -ExecutionPolicy ByPass -File .\dev\build.ps1` or `"C:\Program Files\Git\bin\bash.exe" ./dev/build.sh`
+- Windows (Git Bash — **recommended**): `"C:\Program Files\Git\bin\bash.exe" ./dev/build.sh`
+- Windows (PowerShell): `powershell -ExecutionPolicy ByPass -File .\dev\build.ps1`
+
+> **Note for Windows users**: Git Bash is the recommended shell because the build scripts rely on POSIX utilities (`sed`, `grep`, `find`, etc.) bundled with Git for Windows. If you use WSL2, follow the Linux dependencies section instead.
 
 ### Insider
 
@@ -72,6 +142,32 @@ The script `dev/build.sh` provides several flags:
 - `-p`: generate the packages/assets/installers
 - `-s`: do not retrieve the source code of Visual Studio Code, it won't delete the existing build
 
+## <a id="build-ci"></a>Build for CI/Downstream
+
+Here is the base script to build VSCodium:
+
+```bash
+# Export necessary environment variables
+export SHOULD_BUILD="yes"
+export SHOULD_BUILD_REH="no"
+export CI_BUILD="no"
+export OS_NAME="linux"
+export VSCODE_ARCH="${vscode_arch}"
+export VSCODE_QUALITY="stable"
+export RELEASE_VERSION="${version}"
+
+. get_repo.sh
+. build.sh
+```
+
+To go further, you should look at how we build it:
+
+- Linux: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-linux.yml
+- macOS: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-macos.yml
+- Windows: https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-windows.yml
+
+The `./dev/build.sh` script is for development purpose and must be avoided for a packaging purpose.
+
 ## <a id="build-snap"></a>Build Snap
 
 ```
@@ -103,13 +199,12 @@ review-tools.snap-review --allow-classic codium*.snap
 ## <a id="patch-update-process-manual"></a>Manual
 
 - run `./dev/build.sh`, if a patch is failing then,
-- open `vscode` directory in **VSCodium**
-- revert all changes
-- run `git apply --reject ../patches/<name>.patch`
+- run `./dev/patch.sh <name>.patch` where `<name>.patch` is the failed patch
+- open `vscode` directory in a new **VSCodium**'s window
 - fix all the `*.rej` files
 - run `npm run watch`
 - run `./script/code.sh` until everything is ok
-- run `git diff > ../patches/<name>.patch`
+- go back to the command line running `./dev/patch.sh`, press `enter` to validate the changes and it will update the patch
 
 ### <a id="icons"></a>icons/build_icons.sh
 

docs/index.md

@@ -1,227 +1,44 @@
-# More Info
+# Documentation
 
 ## Table of Contents
 
-- [Getting all the Telemetry Out](#disable-telemetry)
-  - [Replacements to Microsoft Online Services](#replacement-online-services)
-- [Extensions + Marketplace](#extensions-marketplace)
-  - [How to use the OpenVSX Marketplace](#howto-openvsx-marketplace)
-  - [How to use a different extension gallery](#howto-switch-marketplace)
-  - [How to self host your own VS Code Marketplace](#howto-selfhost-marketplace)
-  - [Visual Studio Marketplace](#visual-studio-marketplace)
-  - [Proprietary Debugging Tools](#proprietary-debugging-tools)
-  - [Proprietary Extensions](#proprietary-extensions)
-- [Extensions compatibility](https://github.com/VSCodium/vscodium/blob/master/docs/extensions-compatibility.md)
-- [Migrating from Visual Studio Code to VSCodium](#migrating)
-- [Sign in with GitHub](#signin-github)
-- [Accounts authentication](https://github.com/VSCodium/vscodium/blob/master/docs/accounts-authentication.md)
-- [How do I run VSCodium in portable mode?](#portable)
-- [How do I fix the default file manager?](#file-manager)
-- [How do I press and hold a key and have it repeat in VSCodium?](#press-and-hold)
-- [How do I open VSCodium from the terminal?](#terminal-support)
-  - [From Linux .tar.gz](#from-linux-targz)
+- [Getting Started with VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/getting-started.md)
+  - [Installation](https://github.com/VSCodium/vscodium/blob/master/docs/getting-started.md#installation)
+  - [First Steps](https://github.com/VSCodium/vscodium/blob/master/docs/getting-started.md#first-steps)
+  - [Basic Usage](https://github.com/VSCodium/vscodium/blob/master/docs/getting-started.md#basic-usage)
+  - [Keyboard Shortcuts](https://github.com/VSCodium/vscodium/blob/master/docs/getting-started.md#keyboard-shortcuts)
+  - [Next Steps](https://github.com/VSCodium/vscodium/blob/master/docs/getting-started.md#next-steps)
+- [Getting all the Telemetry Out](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md)
+  - [Telemetry in VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md#telemetry)
+  - [Replacements to Microsoft Online Services](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md#replacements)
+  - [Checking for Telemetry](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md#checking)
+  - [Additional Privacy Settings](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md#additional-settings)
+  - [VSCodium Announcements](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md#announcements)
+  - [Malicious & Deprecated Extensions](https://github.com/VSCodium/vscodium/blob/master/docs/telemetry.md#malicious-extensions)
+- [Extensions and Marketplace](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md)
+  - [Marketplace](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#marketplace)
+  - [How to use the OpenVSX Marketplace](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#howto-openvsx-marketplace)
+  - [How to use a different extension gallery](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#howto-switch-marketplace)
+  - [How to self host your own extension gallery](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#howto-selfhost-marketplace)
+  - [Visual Studio Marketplace](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#visual-studio-marketplace)
+  - [Proprietary Debugging Tools](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#proprietary-debugging-tools)
+  - [Proprietary Extensions](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#proprietary-extensions)
+  - [Using the "VSIX Manager" Extension](https://github.com/VSCodium/vscodium/blob/master/docs/extensions.md#vsix-manager)
+  - [Extensions compatibility](https://github.com/VSCodium/vscodium/blob/master/docs/extensions-compatibility.md)
+  - [Ext: GitHub Copilot](https://github.com/VSCodium/vscodium/blob/master/docs/ext-github-copilot.md)
+- [Migration](https://github.com/VSCodium/vscodium/blob/master/docs/migration.md)
+  - [Manual Migration from Visual Studio Code to VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/migration.md#manual-migration)
+  - [Semi-Automatic Migration with "Sync Settings" Extension](https://github.com/VSCodium/vscodium/blob/master/docs/migration.md#semi-automatic-migration)
+- [Usage](https://github.com/VSCodium/vscodium/blob/master/docs/usage.md)
+  - [Sign in with GitHub](https://github.com/VSCodium/vscodium/blob/master/docs/usage.md#signin-github)
+  - [Accounts authentication](https://github.com/VSCodium/vscodium/blob/master/docs/accounts-authentication.md)
+  - [How do I run VSCodium in portable mode?](https://github.com/VSCodium/vscodium/blob/master/docs/usage.md#portable)
+  - [How do I fix the default file manager?](https://github.com/VSCodium/vscodium/blob/master/docs/usage.md#file-manager)
+  - [How do I press and hold a key and have it repeat in VSCodium?](https://github.com/VSCodium/vscodium/blob/master/docs/usage.md#press-and-hold)
+  - [How do I open VSCodium from the terminal?](https://github.com/VSCodium/vscodium/blob/master/docs/usage.md#terminal-support)
 - [Troubleshooting](https://github.com/VSCodium/vscodium/blob/master/docs/troubleshooting.md)
-- [Contributing](https://github.com/VSCodium/vscodium/blob/master/CONTRIBUTING.md)
-- [How to build VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/howto-build.md)
-
-## <a id="disable-telemetry"></a>Getting all the Telemetry Out
-
-Even though we do not pass the telemetry build flags (and go out of our way to cripple the baked-in telemetry), Microsoft will still track usage by default.
-
-We do however set the `telemetry.enableTelemetry` setting's default value to `false`. You can see those by viewing your VSCodium `settings.json` and searching for `telemetry`.
-
-The instructions [here](https://code.visualstudio.com/docs/supporting/faq#_how-to-disable-telemetry-reporting) help with explaining and toggling telemetry.
-
-It is also highly recommended that you review all the settings that "use online services" by following [these instructions](https://code.visualstudio.com/docs/getstarted/telemetry#_managing-online-services). The `@tag:usesOnlineServices` filter on the settings page will show that by default:
-
-- Extensions auto check for updates and auto install updates
-- Searches within the app are sent to an online service for "natural language processing"
-- Updates to the app are fetched in the background
-
-These can all be disabled.
-
-__Please note that some extensions send telemetry data to Microsoft as well. We have no control over this and can only recommend removing the extension.__ _(For example, the C# extension `ms-vscode.csharp` sends tracking data to Microsoft.)_
-
-### <a id="replacement-online-services"></a>Replacements to Microsoft Online Services
-
-When searching the `@tag:usesOnlineServices` filter, note that while the "Update: Mode" setting description still says "The updates are fetched from a Microsoft online service", VSCodium's build script [sets the `updateUrl` field](https://github.com/VSCodium/vscodium/blob/master/prepare_vscode.sh#L36) in `product.json` to that of VSCodium's own small [update server](https://github.com/VSCodium/update-api), so enabling that setting won't actually result in any calls to Microsoft servers.
-
-Likewise, while the descriptions for "Extensions: Auto Check Updates" and "Extensions: Auto Update" include the same phrase, VSCodium [replaces](https://github.com/VSCodium/vscodium/blob/master/prepare_vscode.sh#L42) the Visual Studio Marketplace with Open VSX, so these settings won't call Microsoft, either.
-
-## <a id="extensions-marketplace"></a>Extensions + Marketplace
-
-Being a vscode based editor, VSCodium gets additional features by installing VS Code extensions.
-Unfortunately, as Microsoft [prohibits usages of the Microsoft marketplace by any other products](https://github.com/microsoft/vscode/issues/31168) or redistribution of `.vsix` files from it, in order to use VS Code extensions in non-Microsoft products those need to be installed differently.
-
-By default, the `product.json` file is set up to use [open-vsx.org](https://open-vsx.org/) as extension gallery, which has an [adapter](https://github.com/eclipse/openvsx/wiki/Using-Open-VSX-in-VS-Code) to the Marketplace API used by VS Code. Since that is a rather new project, you will likely miss some extensions you know from the VS Code Marketplace. You have the following options to obtain such missing extensions:
-
-* Ask the extension maintainers to publish to [open-vsx.org](https://open-vsx.org/) in addition to the VS Code Marketplace. The publishing process is documented in the [Open VSX Wiki](https://github.com/eclipse/openvsx/wiki/Publishing-Extensions).
-* Create a pull request to [this repository](https://github.com/open-vsx/publish-extensions) to have the [@open-vsx](https://github.com/open-vsx) service account publish the extensions for you.
-* Download and [install the vsix files](https://code.visualstudio.com/docs/editor/extension-gallery#_install-from-a-vsix), for example from the release page in their source repository.
-
-### <a id="howto-openvsx-marketplace"></a>How to use the Open VSX Registry
-
-As noted above, the [Open VSX Registry](https://open-vsx.org/) is the pre-set extension gallery in VSCodium. Using the extension view in VSCodium will therefore by default use it.
-See [this article](https://www.gitpod.io/blog/open-vsx/) for more information on the motivation behind Open VSX.
-
-### <a id="howto-switch-marketplace"></a>How to use a different extension gallery
-
-You can switch from the pre-set Open VSX Registry by configuring the endpoints using the following solutions.
-
-You can either use the following environment variables:
-- `VSCODE_GALLERY_SERVICE_URL` ***(required)***
-- `VSCODE_GALLERY_ITEM_URL` ***(required)***
-- `VSCODE_GALLERY_CACHE_URL`
-- `VSCODE_GALLERY_CONTROL_URL`
-- `VSCODE_GALLERY_EXTENSION_URL_TEMPLATE` ***(required)***
-- `VSCODE_GALLERY_RESOURCE_URL_TEMPLATE`
-
-Or by creating a custom `product.json` at the following location (replace `VSCodium` by `VSCodium - Insiders` if you use that):
-- Windows: `%APPDATA%\VSCodium` or `%USERPROFILE%\AppData\Roaming\VSCodium`
-- macOS: `~/Library/Application Support/VSCodium`
-- Linux: `$XDG_CONFIG_HOME/VSCodium` or `~/.config/VSCodium`
-
-with the content like:
-
-```jsonc
-{
-  "extensionsGallery": {
-    "serviceUrl": "", // required
-    "itemUrl": "", // required
-    "cacheUrl": "",
-    "controlUrl": "",
-    "extensionUrlTemplate": "", // required
-    "resourceUrlTemplate": "",
-  }
-}
-```
-
-### <a id="howto-selfhost-marketplace"></a>How to self-host your own extension gallery
-
-Individual developers and enterprise companies in regulated or security-conscious industries can self-host their own extension gallery.
-
-There are likely other options, but the following were reported to work:
-
-* [Open VSX](https://github.com/eclipse/openvsx) eclipse open-source project
-  While the public instance which is run by the Eclipse Foundation is the pre-set endpoint in VSCodium, you can host your own instance.
-
-    > Open VSX is a [vendor-neutral](https://projects.eclipse.org/projects/ecd.openvsx) open-source alternative to the [Visual Studio Marketplace](https://marketplace.visualstudio.com/vscode). It provides a server application that manages [VS Code extensions](https://code.visualstudio.com/api) in a database, a web application similar to the VS Code Marketplace, and a command-line tool for publishing extensions similar to [vsce](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#vsce).
-
-* [code-marketplace](https://coder.com/blog/running-a-private-vs-code-extension-marketplace) open-source project
-
-    > `code-marketplace` is a self-contained go binary that does not have a frontend or any mechanisms for extension authors to add or update extensions in the marketplace. It simply reads extensions from file storage and provides an API for VSCode compatible editors to consume.
-
-### <a id="visual-studio-marketplace"></a>Visual Studio Marketplace
-
-As with any online service, ensure you've understood [its terms of use](https://aka.ms/vsmarketplace-ToU) which include:
-> Marketplace Offerings are intended for use only with Visual Studio Products and Services and you may only install and use Marketplace Offerings with Visual Studio Products and Services.
-
-So, we can't provide any help if you intend to infringe their terms of use.
-
-Also note that this extension gallery hosts multiple extensions that are non-free and have license-agreements that explicitly forbid using them in non-Microsoft products, along with using telemetry.
-
-### <a id="proprietary-debugging-tools"></a>Proprietary Debugging Tools
-
-The debugger provided with Microsoft's [C# extension](https://github.com/OmniSharp/omnisharp-vscode) as well as the (Windows) debugger provided with their [C++ extension](https://github.com/Microsoft/vscode-cpptools) are very restrictively licensed to only work with the official Visual Studio Code build. See [this comment in the C# extension repo](https://github.com/OmniSharp/omnisharp-vscode/issues/2491#issuecomment-418811364) and [this comment in the C++ extension repo](https://github.com/Microsoft/vscode-cpptools/issues/21#issuecomment-248349017).
-
-A workaround exists to get debugging working in C# projects, by using Samsung's opensource [netcoredbg](https://github.com/Samsung/netcoredbg) package. See [this comment](https://github.com/VSCodium/vscodium/issues/82#issue-409806641) for instructions on how to set that up.
-
-### <a id="proprietary-extensions"></a>Proprietary Extensions
-
-Like the debuggers mentioned above, some extensions you may find in the marketplace (like the [Remote Development Extensions](https://code.visualstudio.com/docs/remote/remote-overview)) only function with the official Visual Studio Code build. You can work around this by adding the extension's internal ID (found on the extension's page) to the `extensionAllowedProposedApi` property of the product.json in your VSCodium installation. For example:
-
-```jsonc
-  "extensionAllowedProposedApi": [
-    // ...
-    "ms-vscode-remote.vscode-remote-extensionpack",
-    "ms-vscode-remote.remote-wsl",
-    // ...
-  ],
-```
-
-In some cases, the above change won't help because the extension is hard-coded to only work with the official Visual Studio Code product.
-
-## <a id="migrating"></a>Migrating from Visual Studio Code to VSCodium
-
-VSCodium (and a freshly cloned copy of vscode built from source) stores its extension files in `~/.vscode-oss`. So if you currently have Visual Studio Code installed, your extensions won't automatically populate. You can reinstall your extensions from the Marketplace in VSCodium, or copy the `extensions` from `~/.vscode/extensions` to `~/.vscode-oss/extensions`.
-
-Visual Studio Code stores its `keybindings.json` and `settings.json` file in these locations:
-
-- __Windows__: `%APPDATA%\Code\User`
-- __macOS__: `$HOME/Library/Application Support/Code/User`
-- __Linux__: `$HOME/.config/Code/User`
-
-You can copy these files to the VSCodium user settings folder:
-
-- __Windows__: `%APPDATA%\VSCodium\User`
-- __macOS__: `$HOME/Library/Application Support/VSCodium/User`
-- __Linux__: `$HOME/.config/VSCodium/User`
-
-To copy your settings manually:
-
-- In Visual Studio Code, go to Settings (Command+, if on a Mac)
-- Click the three dots `...` and choose 'Open settings.json'
-- Copy the contents of settings.json into the same place in VSCodium
-
-## <a id="signin-github"></a>Sign in with GitHub
-
-In VSCodium, `Sign in with GitHub` is using a Personal Access Token.<br />
-Follow the documentation https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token to create your token.<br />
-Select the scopes dependending on the extension which needs access to GitHub. (GitLens requires the `repo` scope.)
-
-### Linux
-
-If you are getting the error `Writing login information to the keychain failed with error 'The name org.freedesktop.secrets was not provided by any .service files'.`, you need to install the package `gnome-keyring`.
-
-## <a id="portable"></a>How do I run VSCodium in portable mode?
-You can follow the [Portable Mode instructions](https://code.visualstudio.com/docs/editor/portable) from the Visual Studio Code website.
-- **Windows** / **Linux** : the instructions can be followed as written.
-- **macOS** : portable mode is enabled by the existence of a specially named folder. For Visual Studio Code that folder name is `code-portable-data`. For VSCodium, that folder name is `codium-portable-data`. So to enable portable mode for VSCodium on Mac OS, follow the instructions outlined in the [link above](https://code.visualstudio.com/docs/editor/portable), but create a folder named `codium-portable-data` instead of `code-portable-data`.
-
-## <a id="file-manager"></a>How do I fix the default file manager (Linux)?
-
-In some cases, VSCodium becomes the file manager used to open directories (instead of apps like Dolphin or Nautilus).<br />
-It's due to that no application was defined as the default file manager and so the system is using the latest capable application.
-
-To set the default app, create the file `~/.config/mimeapps.list` with the content like:
-```
-[Default Applications]
-inode/directory=org.gnome.Nautilus.desktop;
-```
-
-You can find your regular file manager with the command:
-```
-> grep directory /usr/share/applications/mimeinfo.cache
-inode/directory=codium.desktop;org.gnome.Nautilus.desktop;
-```
-
-## <a id="press-and-hold"></a>How do I press and hold a key and have it repeat in VSCodium (Mac)?
-
-This is a common question for Visual Studio Code and the procedure is slightly different in VSCodium because the `defaults` path is different.
-
-```bash
-$ defaults write com.vscodium ApplePressAndHoldEnabled -bool false
-```
-
-## <a id="terminal-support"></a>How do I open VSCodium from the terminal?
-
-For macOS and Windows:
-- Go to the command palette (View | Command Palette...)
-- Choose `Shell command: Install 'codium' command in PATH`.
-
-![](https://user-images.githubusercontent.com/2707340/60140295-18338a00-9766-11e9-8fda-b525b6f15c13.png)
-
-This allows you to open files or directories in VSCodium directly from your terminal:
-
-```bash
-~/in-my-project $ codium . # open this directory
-~/in-my-project $ codium file.txt # open this file
-```
-
-Feel free to alias this command to something easier to type in your shell profile (e.g. `alias code=codium`).
-
-On Linux, when installed with a package manager, `codium` has been installed in your `PATH`.
-
-### <a id="from-linux-targz"></a>From Linux .tar.gz
-
-When the archive `VSCodium-linux-<arch>-<version>.tar.gz` is extracted, the main entry point for VSCodium is `./bin/codium`.
+  - [Linux](https://github.com/VSCodium/vscodium/blob/master/docs/troubleshooting.md#linux)
+- [Other Resources](https://github.com/VSCodium/vscodium/blob/master/docs/others.md)
+  - [What are reh and reh-web archives?](https://github.com/VSCodium/vscodium/blob/master/docs/others.md#reh)
+- [Contributing Guidelines](https://github.com/VSCodium/vscodium/blob/master/CONTRIBUTING.md)
+- [Building VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/howto-build.md)

docs/migration.md

@@ -0,0 +1,54 @@
+<!-- order: 20 -->
+
+# Migration
+
+## Table of Contents
+
+- [Manual Migration from Visual Studio Code to VSCodium](#manual-migration)
+- [Semi-Automatic Migration with "Sync Settings" Extension](#semi-automatic-migration)
+
+## <a id="manual-migration"></a>Manual Migration from Visual Studio Code to VSCodium
+
+VSCodium (and a freshly cloned copy of vscode built from source) stores its extension files in `~/.vscode-oss`. So if you currently have Visual Studio Code installed, your extensions won't automatically populate. You can copy the `extensions` from `~/.vscode/extensions` to `~/.vscode-oss/extensions`.
+
+Visual Studio Code stores its `keybindings.json` and `settings.json` file in these locations:
+
+- __Windows__: `%APPDATA%\Code\User`
+- __macOS__: `$HOME/Library/Application Support/Code/User`
+- __Linux__: `$HOME/.config/Code/User`
+
+You can copy these files to the VSCodium user settings folder:
+
+- __Windows__: `%APPDATA%\VSCodium\User`
+- __macOS__: `$HOME/Library/Application Support/VSCodium/User`
+- __Linux__: `$HOME/.config/VSCodium/User`
+
+To copy your settings manually:
+
+- In Visual Studio Code, go to Settings (`Meta+,`)
+- Click the three dots `...` and choose 'Open settings.json'
+- Copy the contents of settings.json into the same place in VSCodium
+
+## <a id="semi-automatic-migration"></a>Semi-Automatic Migration with "Sync Settings" Extension
+
+The [**Sync Settings**](https://github.com/zokugun/vscode-sync-settings) extension can simplify the migration process by enabling synchronization of settings, keybindings, extensions, and more between Visual Studio Code and VSCodium. Its author is the main maintainer of VSCodium ;)
+
+The extension is available in the Visual Studio Marketplace, OpenVSX or directly in its GitHub repository.
+
+### Steps:
+
+1. Install the **Sync Settings** extension in both Visual Studio Code and VSCodium.
+2. Configure the extension on both Visual Studio Code and VSCodium:
+  - Open Command Palette (`Meta+Shift+P`).
+  - Search for `Sync Settings: Open the repository settings` and execute the command.
+  - Configure the repository
+3. Export your current settings from Visual Studio Code:
+  - Open Command Palette (`Meta+Shift+P`).
+  - Search for `Sync Settings: Upload (user -> repository)` and execute the command.
+4. Import the settings into VSCodium:
+  - I recommend the setting `"syncSettings.openOutputOnActivity": true,`.
+  - Open Command Palette (`Meta+Shift+P`).
+  - Search for `Sync Settings: Download (repository -> user)` and execute the command.
+  - Wait for all the extensions to be downloaded and installed (follow logs in the `Output` panel) before restarting VSCodium.
+
+This method ensures that all supported configurations are seamlessly transferred.

docs/others.md

@@ -0,0 +1,12 @@
+<!-- order: 30 -->
+
+# Other Resources
+
+## Table of Contents
+
+- [What are reh and reh-web archives?](#reh)
+
+## <a id="reh"></a>What are reh and reh-web archives?
+
+- Remote Host (`reh`) is the server component for remote ssh/wsl which runs it on a "remote" computer and makes that remote computer accessible via VSCodium.
+- Web Host (`reh-web`) is the server component of the command `codium serve-web` which runs it locally and makes VSCodium accessible via a browser.

docs/patches.md

@@ -0,0 +1,43 @@
+# Patches
+
+Documentation for VSCodium patches applied on top of VS Code.
+
+---
+
+## fix-policies
+
+**Replace `@vscode/policy-watcher` with `@vscodium/policy-watcher`**
+
+VS Code uses `@vscode/policy-watcher` to enforce Group Policy Objects (GPOs) on
+Windows. That package reads from:
+
+```
+HKLM\SOFTWARE\Policies\Microsoft\<productName>
+```
+
+VSCodium forks this into `@vscodium/policy-watcher`, which takes a separate
+`vendorName` argument. The `createWatcher()` call becomes:
+
+```ts
+createWatcher('VSCodium', this.productName, ...)
+```
+
+Because VSCodium sets `product.nameLong = 'VSCodium'` (via `prepare_vscode.sh`),
+`this.productName` resolves to `'VSCodium'` at runtime. Therefore, the final
+Windows registry key that VSCodium reads policies from is:
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>
+```
+
+(or `HKCU\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>` for per-user policies)
+
+This differs from VS Code's path (`Microsoft\VSCode`) and is the root cause of
+[issue #2714](https://github.com/VSCodium/vscodium/issues/2714) where users mirror
+VS Code's registry structure and find their GPOs ignored. Enterprise admins must
+use the VSCodium-specific registry path.
+
+### References
+
+- [VSCodium issue #2714](https://github.com/VSCodium/vscodium/issues/2714)
+- [VSCodium/policy-watcher — RegistryPolicy.hh](https://github.com/VSCodium/policy-watcher/blob/main/src/windows/RegistryPolicy.hh)

docs/telemetry.md

@@ -0,0 +1,87 @@
+<!-- order: 10 -->
+
+# Getting all telemetry out
+
+This page explains how VSCodium handles telemetry and how it enhances your privacy.
+
+## Table of contents
+
+- [Telemetry in VSCodium](#telemetry)
+- [Replacements to Microsoft Online Services](#replacements)
+- [Checking for telemetry](#checking)
+- [VSCodium announcements](#announcements)
+- [Malicious & deprecated extensions](#malicious-extensions)
+
+## <a id="telemetry"></a>Telemetry in VSCodium
+
+Even though we do not pass the telemetry build flags and go out of our way to cripple the baked-in telemetry, Microsoft still can track usage by default depending on your settings.
+
+We disable all the following telemetry-related settings by default to enhance your privacy:
+
+```
+telemetry.telemetryLevel
+telemetry.enableCrashReporter
+telemetry.enableTelemetry
+telemetry.editStats.enabled
+workbench.enableExperiments
+workbench.settings.enableNaturalLanguageSearch
+workbench.commandPalette.experimental.enableNaturalLanguageSearch
+```
+
+It is also recommended that you review all the settings that "use online services" by following [these instructions](https://code.visualstudio.com/docs/getstarted/telemetry#_managing-online-services). You can use the search filter `@tag:usesOnlineServices` to show such settings and review what to change.
+
+**Please note that some extensions send telemetry data to Microsoft as well. We have no control over this and can only recommend removing the extension.**  
+For example, the C# extension `ms-vscode.csharp` sends tracking data to Microsoft. Be sure to check each extension's settings page to disable their telemetry if applicable.
+
+### Update services
+
+By default, the app periodically fetches connections to check for the latest version available to download and install.  
+Extensions are also checked for updates automatically from time to time.
+
+If you want to prevent such behaviors, modify the following preferences:
+
+For the app itself:
+
+- `update.mode` -> `manual` (or `none`)
+- `update.enableWindowsBackgroundUpdates` -> `false` (only applicable for Microsoft Windows)
+
+For extensions:
+
+- `extensions.autoUpdate` -> `false`
+- `extensions.autoCheckUpdates` -> `false`
+
+_Note: on Linux, the app update service is disabled completely at build-time even if the `update.mode` preference is configured. This is because users will more likely use their package managers to update the app rather than updating via the app itself._
+
+### Feedback telemetry
+
+By default, we keep the preference `telemetry.feedback.enabled` enabled. It's used to allow the button `Report Issue...` to be used on the app depending on the context. It does not send any data by having it enabled (other options already cover it). If you want, you can disable this behavior by toggling the preference value.
+
+## <a id="replacements"></a>Replacements to Microsoft Online Services
+
+When searching the `@tag:usesOnlineServices` filter, note that while the "Update: Mode" setting description still says "The updates are fetched from a Microsoft online service", VSCodium's build script [sets the `updateUrl` field](https://github.com/VSCodium/vscodium/blob/8cc366bb76d6c0ddb64374f9530b42094646a660/prepare_vscode.sh#L132-L133) in `product.json` directly to the GitHub page, so enabling that setting won't actually result in any calls to the Microsoft online service.
+
+Likewise, while the descriptions for "Extensions: Auto Check Updates" and "Extensions: Auto Update" include the same phrase, VSCodium [replaces](https://github.com/VSCodium/vscodium/blob/8cc366bb76d6c0ddb64374f9530b42094646a660/prepare_vscode.sh#L119) the Visual Studio Marketplace with Open VSX, so these settings won't call Microsoft either.
+
+## <a id="checking"></a>Checking for telemetry
+
+If you want to verify that no telemetry is being sent, you can use network monitoring tools like:
+
+- Wireshark
+- Little Snitch (macOS)
+- GlassWire (Windows)
+
+Look for connections to Microsoft domains and telemetry endpoints.
+
+## <a id="announcements"></a>VSCodium announcements
+
+The welcome page in VSCodium displays announcements that are fetched via the internet from the project's GitHub repository.
+
+If you prefer to disable this feature, you can disable the preference `workbench.welcomePage.extraAnnouncements`.
+
+## <a id="malicious-extensions"></a>Malicious & deprecated extensions
+
+The definitions for malicious and deprecated extensions are dynamically loaded from the following URL:
+https://raw.githubusercontent.com/EclipseFdn/publish-extensions/refs/heads/master/extension-control/extensions.json
+
+If you prefer to avoid any external connections, you can disable the preference `extensions.excludeUnsafes`.
+However, this is not recommended as it may reduce the safety of your environment.

docs/troubleshooting.md

@@ -1,3 +1,5 @@
+<!-- order: 25 -->
+
 # Troubleshooting
 
 ## Table of Contents
@@ -8,14 +10,15 @@
   - [Global menu workaround for KDE](#linux-kde-global-menu)
   - [Flatpak most common issues](#linux-flatpak-most-common-issues)
   - [Remote SSH doesn't work](#linux-remote-ssh)
-- [macOS](#macos)
-  - [App can't be opened because Apple cannot check it for malicious software](#macos-unidentified-developer)
-  - ["VSCodium.app" is damaged and can’t be opened. You should move it to the Bin](#macos-quarantine)
-
+  - [The window doesn't show up](#linux-no-window)
+- [Windows](#windows)
+  - [Group Policy Objects (GPOs) are ignored](#windows-gpo)
+  - ["Open with VSCodium" missing from context menu](#windows-context-menu)
+  - [Windows Defender flags the installer as malware](#windows-defender)
 
 ## <a id="linux"></a>Linux
 
-#### <a id="linux-fonts-rectangle"></a>*Fonts showing up as rectangles*
+### <a id="linux-fonts-rectangle"></a>_Fonts showing up as rectangles_
 
 The following command should help:
 
@@ -25,27 +28,27 @@ rm -rf ~/snap/codium/common/.cache
 fc-cache -r
 ```
 
-#### <a id="linux-rendering-glitches"></a>*Text and/or the entire interface not appearing*
+### <a id="linux-rendering-glitches"></a>_Text and/or the entire interface not appearing_
 
-You have likely encountered [a bug in Chromium and Electron](microsoft/vscode#190437) when compiling Mesa shaders, which has affected all Visual Studio Code and VSCodium versions for Linux distributions since 1.82.  The current workaround (see microsoft/vscode#190437) is to delete the GPU cache as follows:
+You have likely encountered [a bug in Chromium and Electron](microsoft/vscode#190437) when compiling Mesa shaders, which has affected all Visual Studio Code and VSCodium versions for Linux distributions since 1.82. The current workaround (see microsoft/vscode#190437) is to delete the GPU cache as follows:
 
 ```bash
 rm -rf ~/.config/VSCodium/GPUCache
 ```
 
-#### <a id="linux-kde-global-menu"></a>*Global menu workaround for KDE*
+### <a id="linux-kde-global-menu"></a>_Global menu workaround for KDE_
 
 Install these packages on Fedora:
 
-* libdbusmenu-devel
-* dbus-glib-devel
-* libdbusmenu
+- libdbusmenu-devel
+- dbus-glib-devel
+- libdbusmenu
 
 On Ubuntu this package is called `libdbusmenu-glib4`.
 
 Credits: [Gerson](https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/91)
 
-#### <a id="linux-flatpak-most-common-issues"></a>*Flatpak most common issues*
+### <a id="linux-flatpak-most-common-issues"></a>_Flatpak most common issues_
 
 - blurry screen with HiDPI on wayland run:
   ```bash
@@ -65,26 +68,87 @@ Credits: [Gerson](https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/
 
 - If you have any other problems with the flatpak package try to look on the [FAQ](https://github.com/flathub/com.vscodium.codium?tab=readme-ov-file#faq) maybe the solution is already there or open an [issue](https://github.com/flathub/com.vscodium.codium/issues).
 
-##### <a id="linux-remote-ssh"></a>*Remote SSH doesn't work*
+### <a id="linux-remote-ssh"></a>_Remote SSH doesn't work_
 
 Use the VSCodium's compatible extension [Open Remote - SSH](https://open-vsx.org/extension/jeanp413/open-remote-ssh).
 
 On the server, in the `sshd` config, `AllowTcpForwarding` need to be set to `yes`.
 
-It might requires additional dependeincies due to the OS/distro (alpine).
+It might requires additional dependencies due to the OS/distro (alpine).
 
-## <a id="macos"></a>macOS
+### <a id="linux-no-window"></a>_The window doesn't show up_
 
-Since the App is signed with a self-signed certificate, on the first launch, you might see the following messages:
+If you are under Wayland:
 
-#### <a id="macos-unidentified-developer"></a>*App can't be opened because Apple cannot check it for malicious software*
+- try the command `codium --verbose`
+- if you see an error like `:ERROR:ui/gl/egl_util.cc:92] EGL Driver message (Error) eglCreateContext: Requested version is not supported`
+- try `codium --ozone-platform=x11`
 
-You can right-click the App and choose `Open`.
+## <a id="windows"></a>Windows
 
-#### <a id="macos-quarantine"></a>*"VSCodium.app" is damaged and can’t be opened. You should move it to the Bin.*
+### <a id="windows-gpo"></a>_Group Policy Objects (GPOs) are ignored_
 
-The following command will remove the quarantine attribute.
+VSCodium uses its own policy-watcher library (`@vscodium/policy-watcher`) which reads GPO values from a **different registry path** than VS Code.
+
+**VSCodium reads policies from:**
 
 ```
-xattr -r -d com.apple.quarantine /Applications/VSCodium.app
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium
 ```
+
+**VS Code reads policies from:**
+
+```
+HKLM\SOFTWARE\Policies\Microsoft\VSCode
+```
+
+If you are deploying VSCodium in an enterprise environment via Group Policy:
+
+1. Copy the `.admx` template file to `C:\Windows\PolicyDefinitions\`
+2. Copy the `.adml` language file to `C:\Windows\PolicyDefinitions\en-US\`
+3. Open `gpedit.msc` and configure policies under the VSCodium group
+4. Verify the resulting registry key exists at `HKLM\SOFTWARE\Policies\VSCodium\VSCodium` (not `Microsoft\VSCodium`)
+
+If you set policies manually via Registry Editor, make sure you create the key at the correct path:
+
+```
+HKLM\SOFTWARE\Policies\VSCodium\VSCodium\<PolicyName>  (REG_SZ or REG_DWORD)
+```
+
+For example, to set `Update: Mode` to `none`:
+
+```
+Registry key: HKLM\SOFTWARE\Policies\VSCodium\VSCodium
+Value name:   update.mode
+Value type:   REG_SZ
+Value data:   none
+```
+
+Per-user policies are also supported under `HKCU\SOFTWARE\Policies\VSCodium\VSCodium` (machine policies take precedence).
+
+### <a id="windows-context-menu"></a>_"Open with VSCodium" missing from context menu_
+
+If the **"Open with VSCodium"** option does not appear after installation (even with the checkbox checked during setup):
+
+1. **Run the installer again** and ensure _"Add 'Open with VSCodium' action to Windows Explorer file context menu"_ is checked.
+2. **Windows 11 note**: Windows 11 hides most context menu entries behind **Shift + Right-click** ("Show more options"). VSCodium's entry may be present but hidden in the new condensed menu. Try Shift + Right-click to see the classic context menu.
+3. If the entry still does not appear, you can add it manually via Registry Editor:
+
+   ```
+   Key:   HKEY_CLASSES_ROOT\*\shell\Open with VSCodium
+   Value: (Default) = "Open with VSCodium"
+
+   Key:   HKEY_CLASSES_ROOT\*\shell\Open with VSCodium\command
+   Value: (Default) = "C:\Program Files\VSCodium\VSCodium.exe" "%1"
+   ```
+
+   Adjust the install path to match your actual installation directory.
+
+### <a id="windows-defender"></a>_Windows Defender flags the installer as malware_
+
+Some users report Windows Defender detecting the VSCodium installer as `Cinjo` or another threat. This is a **false positive** caused by the unsigned nature of certain build artifacts.
+
+- Download VSCodium **only from the official [GitHub Releases page](https://github.com/VSCodium/vscodium/releases)**.
+- Verify the SHA256/SHA512 checksum of the downloaded file against the `.sha256` or `.sha512` file published alongside each release.
+- If Defender blocks the installer, add an exclusion for the downloaded file, run the install, then remove the exclusion.
+- You can also report the false positive directly to Microsoft via the [Windows Defender Security Intelligence submission portal](https://www.microsoft.com/en-us/wdsi/filesubmission).

docs/usage.md

@@ -0,0 +1,76 @@
+<!-- order: 25 -->
+
+# Usage
+
+## Table of Contents
+
+- [Sign in with GitHub](#signin-github)
+- [Accounts authentication](https://github.com/VSCodium/vscodium/blob/master/docs/accounts-authentication.md)
+- [How do I run VSCodium in portable mode?](#portable)
+- [How do I fix the default file manager?](#file-manager)
+- [How do I press and hold a key and have it repeat in VSCodium?](#press-and-hold)
+- [How do I open VSCodium from the terminal?](#terminal-support)
+  - [From Linux .tar.gz](#from-linux-targz)
+
+## <a id="signin-github"></a>Sign in with GitHub
+
+In VSCodium, `Sign in with GitHub` is using a Personal Access Token.<br />
+Follow the documentation https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token to create your token.<br />
+Select the scopes dependending on the extension which needs access to GitHub. (GitLens requires the `repo` scope.)
+
+### Linux
+
+If you are getting the error `Writing login information to the keychain failed with error 'The name org.freedesktop.secrets was not provided by any .service files'.`, you need to install the package `gnome-keyring`.
+
+## <a id="portable"></a>How do I run VSCodium in portable mode?
+You can follow the [Portable Mode instructions](https://code.visualstudio.com/docs/editor/portable) from the Visual Studio Code website.
+- **Windows** / **Linux** : the instructions can be followed as written.
+- **macOS** : portable mode is enabled by the existence of a specially named folder. For Visual Studio Code that folder name is `code-portable-data`. For VSCodium, that folder name is `codium-portable-data`. So to enable portable mode for VSCodium on Mac OS, follow the instructions outlined in the [link above](https://code.visualstudio.com/docs/editor/portable), but create a folder named `codium-portable-data` instead of `code-portable-data`.
+
+## <a id="file-manager"></a>How do I fix the default file manager (Linux)?
+
+In some cases, VSCodium becomes the file manager used to open directories (instead of apps like Dolphin or Nautilus).<br />
+It's due to that no application was defined as the default file manager and so the system is using the latest capable application.
+
+To set the default app, create the file `~/.config/mimeapps.list` with the content like:
+```
+[Default Applications]
+inode/directory=org.gnome.Nautilus.desktop;
+```
+
+You can find your regular file manager with the command:
+```
+> grep directory /usr/share/applications/mimeinfo.cache
+inode/directory=codium.desktop;org.gnome.Nautilus.desktop;
+```
+
+## <a id="press-and-hold"></a>How do I press and hold a key and have it repeat in VSCodium (Mac)?
+
+This is a common question for Visual Studio Code and the procedure is slightly different in VSCodium because the `defaults` path is different.
+
+```bash
+$ defaults write com.vscodium ApplePressAndHoldEnabled -bool false
+```
+
+## <a id="terminal-support"></a>How do I open VSCodium from the terminal?
+
+For macOS and Windows:
+- Go to the command palette (View | Command Palette...)
+- Choose `Shell command: Install 'codium' command in PATH`.
+
+![](https://user-images.githubusercontent.com/2707340/60140295-18338a00-9766-11e9-8fda-b525b6f15c13.png)
+
+This allows you to open files or directories in VSCodium directly from your terminal:
+
+```bash
+~/in-my-project $ codium . # open this directory
+~/in-my-project $ codium file.txt # open this file
+```
+
+Feel free to alias this command to something easier to type in your shell profile (e.g. `alias code=codium`).
+
+On Linux, when installed with a package manager, `codium` has been installed in your `PATH`.
+
+### <a id="from-linux-targz"></a>From Linux .tar.gz
+
+When the archive `VSCodium-linux-<arch>-<version>.tar.gz` is extracted, the main entry point for VSCodium is `./bin/codium`.

font-size/.artifactrc.yml

@@ -0,0 +1,8 @@
+$schema: https://raw.githubusercontent.com/zokugun/artifact/v0.6.0/schemas/v1/install.json
+artifacts:
+  "@daiyam/artifact-lang-js":
+    version: 0.11.3
+    requires:
+      - "22"
+  "@daiyam/artifact-lang-ts":
+    version: 0.8.0

font-size/.editorconfig

@@ -0,0 +1,22 @@
+root = true
+
+[*]
+indent_style = tab
+tab_width = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[{*.yml,*.yaml}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+indent_style = space
+indent_size = 4
+
+[*.patch]
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = false

font-size/.fixpackrc

@@ -0,0 +1,35 @@
+{
+	"finalNewLine": true,
+	"required": [
+		"dependencies"
+	],
+	"sortToTop": [
+		"name",
+		"displayName",
+		"description",
+		"version",
+		"since",
+		"private",
+		"author",
+		"publisher",
+		"license",
+		"homepage",
+		"repository",
+		"bugs",
+		"engines",
+		"type",
+		"bin",
+		"exports",
+		"main",
+		"module",
+		"types",
+		"typesVersions",
+		"scripts",
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies",
+		"peerDependencies",
+		"overrides",
+		"keywords"
+	]
+}

font-size/.gitignore

@@ -0,0 +1,2 @@
+/node_modules/
+/lib/

font-size/.nvmrc

@@ -0,0 +1 @@
+v22.22.2

font-size/.tazerc.json

@@ -0,0 +1,6 @@
+{
+	"force": true,
+	"includeLocked": true,
+	"maturityPeriod": 7,
+	"write": true
+}

font-size/.vscode/settings.json

@@ -0,0 +1,9 @@
+{
+	"search.exclude": {
+		"package-lock.json": true,
+		"lib/**": true,
+	},
+	"taskExplorer.exclude": [
+		".husky",
+	],
+}

font-size/.xo-config.json

@@ -0,0 +1,170 @@
+{
+	"ignores": [
+		"*.config.js",
+		"*.config.ts"
+	],
+	"rules": {
+		"@typescript-eslint/ban-types": "off",
+		"@typescript-eslint/brace-style": [
+			"error",
+			"stroustrup"
+		],
+		"@typescript-eslint/class-literal-property-style": [
+			"error",
+			"fields"
+		],
+		"@typescript-eslint/keyword-spacing": [
+			"error",
+			{
+				"overrides": {
+					"if": {
+						"after": false
+					},
+					"for": {
+						"after": false
+					},
+					"switch": {
+						"after": false
+					},
+					"while": {
+						"after": false
+					}
+				}
+			}
+		],
+		"@typescript-eslint/member-ordering": [
+			"error",
+			{
+				"default": [
+					"field",
+					"constructor",
+					"get",
+					"set",
+					"method"
+				]
+			}
+		],
+		"@typescript-eslint/naming-convention": [
+			"error",
+			{
+				"selector": "variable",
+				"modifiers": [
+					"const",
+					"global"
+				],
+				"format": [
+					"camelCase",
+					"UPPER_CASE"
+				],
+				"filter": {
+					"regex": "^(__filename|__dirname)$",
+					"match": false
+				}
+			},
+			{
+				"selector": "variable",
+				"format": [
+					"camelCase"
+				],
+				"filter": {
+					"regex": "^(__filename|__dirname)$",
+					"match": false
+				}
+			}
+		],
+		"@typescript-eslint/no-confusing-void-expression": "off",
+		"@typescript-eslint/no-dynamic-delete": "off",
+		"@typescript-eslint/no-empty-function": [
+			"error",
+			{
+				"allow": [
+					"arrowFunctions"
+				]
+			}
+		],
+		"@typescript-eslint/no-inferrable-types": "off",
+		"@typescript-eslint/no-namespace": "off",
+		"@typescript-eslint/object-curly-spacing": [
+			"error",
+			"always"
+		],
+		"@typescript-eslint/parameter-properties": "off",
+		"@typescript-eslint/prefer-promise-reject-errors": "off",
+		"@typescript-eslint/return-await": "off",
+		"arrow-parens": [
+			"error",
+			"always"
+		],
+		"capitalized-comments": "off",
+		"complexity": "off",
+		"default-case": "off",
+		"import/extensions": [
+			"error",
+			"never"
+		],
+		"import/order": [
+			"error",
+			{
+				"groups": [
+					"builtin",
+					"external",
+					"internal",
+					"parent",
+					"sibling",
+					"index",
+					"object"
+				],
+				"alphabetize": {
+					"order": "asc",
+					"caseInsensitive": true
+				}
+			}
+		],
+		"max-depth": [
+			"error",
+			8
+		],
+		"max-params": [
+			"error",
+			12
+		],
+		"no-await-in-loop": "off",
+		"no-else-return": "off",
+		"no-lonely-if": "off",
+		"no-negated-condition": "off",
+		"object-curly-newline": "off",
+		"object-shorthand": "off",
+		"one-var": [
+			"error",
+			"never"
+		],
+		"unicorn/empty-brace-spaces": "off",
+		"unicorn/no-array-callback-reference": "off",
+		"unicorn/no-length-as-slice-end": "off",
+		"unicorn/no-object-as-default-parameter": "off",
+		"unicorn/prefer-json-parse-buffer": "off",
+		"unicorn/prefer-module": "off",
+		"unicorn/prefer-node-protocol": "off",
+		"unicorn/prefer-switch": "off",
+		"unicorn/prefer-ternary": "off",
+		"unicorn/prevent-abbreviations": [
+			"error",
+			{
+				"replacements": {
+					"arg": false,
+					"args": false,
+					"dir": false,
+					"err": false,
+					"fn": false,
+					"func": false,
+					"i": false,
+					"j": false,
+					"mod": false,
+					"num": false,
+					"pkg": false,
+					"str": false
+				}
+			}
+		]
+	}
+}

font-size/generate-css.ts

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+
+import path from 'node:path';
+import process from 'node:process';
+import fse from '@zokugun/fs-extra-plus/async';
+import { err, OK, type Result, stringifyError, xtry } from '@zokugun/xtry';
+import postcss, { Root, type Rule } from 'postcss';
+
+type Area = {
+	name: string;
+	defaultSize: number;
+	files: string[];
+	prefixes: string[];
+};
+
+const PX_REGEX = /(-?\d+(\.\d+)?)px\b/g;
+const COEFF_PRECISION = 6;
+const HEADER = '/*** Generated for Custom Font Size ***/';
+const ZEROS = ['margin', 'padding'];
+
+const AREAS: Record<string, Area> = {
+	activitybar: {
+		name: 'activitybar',
+		defaultSize: 16,
+		files: ['src/vs/workbench/browser/parts/activitybar/media/activityaction.css'],
+		prefixes: ['.monaco-workbench .activitybar'],
+	},
+	bottompane: {
+		name: 'bottompane',
+		defaultSize: 13,
+		files: ['src/vs/workbench/browser/parts/panel/media/panelpart.css', 'src/vs/base/browser/ui/actionbar/actionbar.css', 'src/vs/workbench/browser/parts/media/paneCompositePart.css'],
+		prefixes: ['.monaco-workbench .part.panel'],
+	},
+	statusbar: {
+		name: 'statusbar',
+		defaultSize: 12,
+		files: ['src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css'],
+		prefixes: ['.monaco-workbench .part.statusbar'],
+	},
+	sidebar: {
+		name: 'sidebar',
+		defaultSize: 13,
+		files: [
+			'src/vs/base/browser/ui/actionbar/actionbar.css',
+			'src/vs/base/browser/ui/button/button.css',
+			'src/vs/base/browser/ui/inputbox/inputBox.css',
+			'src/vs/workbench/contrib/debug/browser/media/debugToolBar.css',
+			'src/vs/workbench/contrib/debug/browser/media/debugViewlet.css',
+			'src/vs/workbench/contrib/extensions/browser/media/extension.css',
+			'src/vs/workbench/contrib/extensions/browser/media/extensionActions.css',
+			'src/vs/workbench/contrib/search/browser/media/searchview.css',
+			'src/vs/workbench/contrib/scm/browser/media/scm.css',
+		],
+		prefixes: ['.monaco-workbench .part.sidebar', '.monaco-workbench .part.auxiliarybar'],
+	},
+	tabs: {
+		name: 'tabs',
+		defaultSize: 13,
+		files: [
+			'src/vs/workbench/browser/parts/editor/media/editortabscontrol.css',
+			'src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css',
+			'src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css'
+		],
+		prefixes: ['.monaco-workbench .part.editor > .content .editor-group-container > .title.tabs'],
+	},
+};
+
+function formatCoefficient(n: number): string { // {{{
+	const fixed = n.toFixed(COEFF_PRECISION);
+	return fixed.replace(/\.?0+$/, '');
+} // }}}
+
+function replacePx(area: Area) { // {{{
+	return (match: string, numStr: string): string => {
+		const pxValue = Number.parseFloat(numStr);
+
+		if(pxValue === 1) {
+			return match;
+		}
+
+		const coeff = formatCoefficient(pxValue / area.defaultSize);
+
+		return `calc(var(--vscode-workbench-${area.name}-font-size) * ${coeff})`;
+	};
+} // }}}
+
+function transformPxValue(value: string, area: Area): string { // {{{
+	return value.replaceAll(PX_REGEX, replacePx(area));
+} // }}}
+
+async function processFile(filePath: string, areas: Area[]): Promise<Result<void, string>> { // {{{
+	const readResult = await fse.readFile(filePath, 'utf8');
+	if(readResult.fails) {
+		return err(stringifyError(readResult.error));
+	}
+
+	const content = extractOriginal(readResult.value);
+
+	const postcssResult = xtry(() => postcss.parse(content, { from: filePath }));
+	if(postcssResult.fails) {
+		return err(`Failed to parse ${filePath}: ${stringifyError(postcssResult.error)}`);
+	}
+
+	const generatedRoot = postcss.root();
+
+	for(const area of areas) {
+		processFileArea(postcssResult.value, generatedRoot, area)
+	}
+
+	if(generatedRoot.nodes && generatedRoot.nodes.length > 0) {
+		const writeResult = await fse.writeFile(filePath, content + `\n\n\n${HEADER}\n\n` + generatedRoot.toString(), 'utf8');
+		if(writeResult.fails) {
+			return err(stringifyError(readResult.error));
+		}
+
+		console.log(`Generated: ${filePath}`);
+	}
+	else {
+		console.log(`No px sizes found in: ${filePath}`);
+	}
+
+	return OK;
+} // }}}
+
+function processFileArea(postcssResult: Root, generatedRoot: Root, area: Area): void { // {{{
+	postcssResult.walkRules((rule: Rule) => {
+		const declarationsToAdd: Array<{ prop: string; value: string }> = [];
+
+		rule.walkDecls((declaration) => {
+			if(PX_REGEX.test(declaration.value)) {
+				const newValue = transformPxValue(declaration.value, area);
+
+				declarationsToAdd.push({ prop: declaration.prop, value: newValue });
+			}
+			else if(declaration.value === 'auto' && (declaration.prop === 'height' || declaration.prop === 'width')) {
+				declarationsToAdd.push({ prop: declaration.prop, value: 'auto' });
+			}
+			else if(declaration.value === '0' && ZEROS.includes(declaration.prop)) {
+				declarationsToAdd.push({ prop: declaration.prop, value: '0' });
+			}
+		});
+
+		if(declarationsToAdd.length > 0) {
+			const selectors = (rule.selectors && rule.selectors.length > 0)	? rule.selectors : [rule.selector];
+			const prefixeds: string[] = [];
+
+			for(const prefix of area.prefixes) {
+				const parts = prefix.split(' ');
+				const prefixed = selectors.map((s) => prefixSelector(s, parts)).join(', ');
+
+				prefixeds.push(prefixed);
+			}
+
+			const newRule = postcss.rule({ selector: `${prefixeds.join(', ')}` });
+
+			let length = 0;
+
+			for(const declaration of declarationsToAdd) {
+				if(!declaration.prop.startsWith('border')) {
+					newRule.append({ ...declaration });
+					length += 1;
+				}
+			}
+
+			if(length > 0) {
+				generatedRoot.append(newRule);
+			}
+		}
+	});
+} // }}}
+
+function extractOriginal(content: string): string { // {{{
+	const index = content.indexOf(HEADER);
+
+	if(index === -1) {
+		return content;
+	}
+
+	return content.slice(0, Math.max(0, index - 3));
+} // }}}
+
+function extractStyle(selector: string): string { // {{{
+	const match = /^(\.[\w-]+)/.exec(selector);
+
+	return match?.[1] ?? '';
+} // }}}
+
+function mergeSelector(selectors: string[], prefixes: string[], index: number): void { // {{{
+	if(index >= prefixes.length) {
+		return;
+	}
+
+	const prefix = prefixes[index];
+	const selector = selectors[index];
+	const style = extractStyle(prefix);
+
+	if(selector === style) {
+		if(prefix.length > style.length) {
+			selectors[index] = prefix;
+		}
+
+		mergeSelector(selectors, prefixes, index + 1);
+	}
+	else if(selector.startsWith(style)) {
+		mergeSelector(selectors, prefixes, index + 1);
+	}
+	else if(index === 0) {
+		selectors.unshift(...prefixes)
+	}
+	else {
+		selectors.splice(index + 1, 0, ...prefixes.slice(index));
+	}
+} // }}}
+
+function prefixSelector(selector: string, prefixParts: string[]): string { // {{{
+	const parts = selector.split(' ');
+
+	if(parts[0] === '.mac' || parts[0] === '.linux' || parts[0] === '.windows') {
+		parts[0] = `${prefixParts[0]}${parts[0]}`;
+
+		parts.splice(1, 0, ...prefixParts.slice(1));
+	}
+	else {
+		mergeSelector(parts, prefixParts, 0);
+	}
+
+	return parts.join(' ');
+} // }}}
+
+async function main(): Promise<void> { // {{{
+	const name = process.argv[2];
+	const area = AREAS[name];
+
+	if(area) {
+		for(const file of area.files) {
+			const result = await processFile(path.join('..', 'vscode', file), [area]);
+			if(result.fails) {
+				console.error(`Error processing ${file}:`, result.error);
+			}
+		}
+	}
+	else if(name === 'all') {
+		const files: Record<string, Area[]> = {};
+
+		for(const area of Object.values(AREAS)) {
+			for(const file of area.files) {
+				if(files[file]) {
+					files[file].push(area)
+				}
+				else {
+					files[file] = [area]
+				}
+			}
+		}
+
+		for(const [file, areas] of Object.entries(files)) {
+			const result = await processFile(path.join('..', 'vscode', file), areas);
+			if(result.fails) {
+				console.error(`Error processing ${file}:`, result.error);
+			}
+		}
+	}
+	else {
+		console.log(`No area found for ${name}`);
+		console.log(`\nAvailable areas:\n- ${Object.keys(AREAS).join('\n- ')}`);
+		return;
+	}
+} // }}}
+
+await main();

font-size/package.json

@@ -0,0 +1,37 @@
+{
+	"name": "font-size",
+	"description": "",
+	"version": "1.0.0",
+	"author": {
+		"name": "Baptiste Augrain",
+		"email": "daiyam@zokugun.org"
+	},
+	"license": "MIT",
+	"type": "module",
+	"main": "generate-css.ts",
+	"scripts": {
+		"audit:fix": "npm audit fix --min-release-age=0",
+		"ci:lint": "zizmor .",
+		"ci:lint:fix": "zizmor . --fix=all",
+		"lint": "xo",
+		"lint:all": "fixpack && npm audit && npm run ci:lint && npm run lint",
+		"lint:fix": "xo --fix",
+		"prepare": "fixpack || true",
+		"update:artifacts": "artifact update",
+		"update:deps": "taze"
+	},
+	"dependencies": {
+		"@zokugun/fs-extra-plus": "0.3.8",
+		"@zokugun/xtry": "0.10.1",
+		"fast-glob": "3.3.3",
+		"postcss": "8.5.10"
+	},
+	"devDependencies": {
+		"@types/node": "22.19.17",
+		"fixpack": "4.0.0",
+		"taze": "19.11.0",
+		"typescript": "5.9.3",
+		"xo": "0.60.0"
+	},
+	"keywords": []
+}

font-size/tsconfig.base.json

@@ -0,0 +1,78 @@
+{
+	"compilerOptions": {
+		/* Language and Environment */
+		"target": "ES2022",								/* Specify ECMAScript target version. */
+		"lib": [										/* Specify library files to be included in the compilation. */
+			"ES2022",
+		],
+
+		/* Modules */
+		"module": "node16",								/* Specify what module code is generated. */
+
+		/* Basic Options */
+		// "allowJs": false,							/* Allow javascript files to be compiled. */
+		// "checkJs": false,							/* Report errors in '.js' files. */
+		// "jsx": undefined,							/* Specify JSX code generation: 'preserve', 'react-native', 'react', 'react-jsx' or 'react-jsxdev'. */
+		// "declaration": false,						/* Generates corresponding '.d.ts' file. */
+		// "declarationDir": ""							/* Specify the output directory for generated declaration files. */
+		// "declarationMap": false,						/* Generates a sourcemap for each corresponding '.d.ts' file. */
+		// "outFile": "",								/* Specify a file that bundles all outputs into one JavaScript file. */
+		// "outDir": "",								/* Specify an output folder for all emitted files. */
+		// "rootDir": "",								/* Specify the root directory of input files. */
+		// "incremental": false,						/* Save '.tsbuildinfo' files to allow for incremental compilation of projects. */
+		// "composite": false,							/* Enable constraints that allow a TypeScript project to be used with project references. */
+		// "tsBuildInfoFile": ".tsbuildinfo",			/* Specify the folder for '.tsbuildinfo' incremental compilation files. */
+		// "removeComments": false,						/* Disable emitting comments. */
+		// "noEmit": true,								/* Disable emitting file from a compilation. */
+		// "importHelpers": false,						/* Allow importing helper functions from tslib once per project, instead of including them per-file. */
+		// "downlevelIteration": false,					/* Provide full support for iterables in 'for-of', spread, and destructuring when targeting 'ES5' or 'ES3'. */
+		// "isolatedModules": false,					/* Ensure that each file can be safely transpiled without relying on other imports. */
+
+		/* Strict Type-Checking Options */
+		"strict": true,									/* Enable all strict type-checking options. */
+		"strictNullChecks": true,						/* When type checking, take into account null and undefined. */
+		// "strictFunctionTypes": false,				/* Enable strict checking of function types. */
+		// "strictBindCallApply": false,				/* Enable strict 'bind', 'call', and 'apply' methods on functions. */
+		// "strictPropertyInitialization": false,		/* Enable strict checking of property initialization in classes. */
+		// "noImplicitThis": false,						/* Enable error reporting when 'this' is given the type 'any'. */
+		"alwaysStrict": true,							/* Parse in strict mode and emit "use strict" for each source file. */
+
+		/* Additional Checks */
+		"noUnusedLocals": true,							/* Report errors on unused locals. */
+		// "noUnusedParameters": false,					/* Report errors on unused parameters. */
+		"noImplicitAny": false,							/* Report error for expressions and declarations with an implied any type.. */
+		"noImplicitReturns": false,						/* Report error when not all code paths in function return a value. */
+		// "noFallthroughCasesInSwitch": false,			/* Report errors for fallthrough cases in switch statement. */
+		// "noUncheckedIndexedAccess": false,			/* Include 'undefined' in index signature results */
+		// "noImplicitOverride": false,					/* Ensure overriding members in derived classes are marked with an 'override' modifier. */
+		// "noPropertyAccessFromIndexSignature": false,	/* Require undeclared properties from index signatures to use element accesses. */
+
+		/* Module Resolution Options */
+		// "moduleResolution": "node",					/* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
+		// "baseUrl": "",								/* Specify the base directory to resolve non-relative module names. */
+		// "paths": {},									/* Specify a set of entries that re-map imports to additional lookup locations. */
+		// "rootDirs": [],								/* Allow multiple folders to be treated as one when resolving modules. */
+		// "typeRoots": [],								/* List of folders to include type definitions from. */
+		// "types": [],									/* Specify type package names to be included without being referenced in a source file. */
+		"esModuleInterop": true,						/* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+		"allowSyntheticDefaultImports": true,			/* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
+		// "preserveSymlinks": false,					/* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
+		// "allowUmdGlobalAccess": false,				/* Allow accessing UMD globals from modules. */
+		// "resolveJsonModule": false,					/* Enable importing .json files */
+
+		/* Source Map Options */
+		// "sourceMap": false,							/* Create source map files for emitted JavaScript files. */
+		// "sourceRoot": "",							/* Specify the root path for debuggers to find the reference source code. */
+		// "mapRoot": "",								/* Specify the location where debugger should locate map files instead of generated locations. */
+		// "inlineSourceMap": false,					/* Include sourcemap files inside the emitted JavaScript. */
+		// "inlineSources": false,						/* Include source code in the sourcemaps inside the emitted JavaScript. */
+
+		/* Experimental Options */
+		// "experimentalDecorators": false,				/* Enables experimental support for ES7 decorators. */
+		// "emitDecoratorMetadata": false,				/* Emit design-type metadata for decorated declarations in source files. */
+
+		/* Advanced Options */
+		"skipLibCheck": true,							/* Skip type checking all .d.ts files. */
+		"forceConsistentCasingInFileNames": true,		/* Ensure that casing is correct in imports. */
+	},
+}

font-size/tsconfig.json

@@ -0,0 +1,15 @@
+{
+	"extends": "./tsconfig.base.json",
+	"compilerOptions": {
+		/* Basic Options */
+		"outDir": ".",
+		"rootDir": ".",
+		"declaration": true,
+
+		/* Module Resolution Options */
+		"resolveJsonModule": true,						/* Enable importing .json files */
+	},
+	"files": [
+		"package.json",
+	],
+}

icons/build_icons.sh

@@ -6,20 +6,22 @@ set -e
 # DEBUG
 # set -o xtrace
 
-QUALITY="stable"
-COLOR="blue1"
-
 while getopts ":i" opt; do
   case "$opt" in
     i)
-      export QUALITY="insider"
-      export COLOR="orange1"
+      QUALITY="insider"
+      [[ -z "${COLOR}" ]] && COLOR="orange1"
       ;;
     *)
       ;;
   esac
 done
 
+[[ -z "${COLOR}" ]] && COLOR="blue1"
+[[ -z "${QUALITY}" ]] && QUALITY="stable"
+[[ -z "${SRC_PREFIX}" ]] && SRC_PREFIX=""
+[[ -z "${VSCODE_PREFIX}" ]] && VSCODE_PREFIX=""
+
 check_programs() { # {{{
   for arg in "$@"; do
     if ! command -v "${arg}" &> /dev/null; then
@@ -31,27 +33,47 @@ check_programs() { # {{{
 
 check_programs "icns2png" "composite" "convert" "png2icns" "icotool" "rsvg-convert" "sed"
 
-. ./utils.sh
+. "./${VSCODE_PREFIX}utils.sh"
 
-SRC_PREFIX=""
-VSCODE_PREFIX=""
+if ! declare -F load_linux_png &>/dev/null; then
+  load_linux_png() {
+    wget "https://raw.githubusercontent.com/VSCodium/icons/main/icons/linux/circle1/${COLOR}/paulo22s.png" -O "$1"
+  }
+fi
+
+if ! declare -F load_windows_ico &>/dev/null; then
+  load_windows_ico() {
+    wget "https://raw.githubusercontent.com/VSCodium/icons/main/icons/win32/nobg/${COLOR}/paulo22s.ico" -O "$1"
+  }
+fi
 
 build_darwin_main() { # {{{
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/darwin/code.icns" ]]; then
-    rsvg-convert -w 655 -h 655 "icons/${QUALITY}/codium_cnl.svg" -o "code_logo.png"
-    composite "code_logo.png" -gravity center "icons/template_macos.png" "code_1024.png"
+    mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/darwin"
+
+    if [[ "$1" == "no-template" ]]; then
+      rsvg-convert -w 1024 -h 1024 "icons/${QUALITY}/codium_cnl.svg" -o "code_1024.png"
+    else
+      rsvg-convert -w 655 -h 655 "icons/${QUALITY}/codium_cnl.svg" -o "code_logo.png"
+      composite "code_logo.png" -gravity center "${VSCODE_PREFIX}icons/template_macos.png" "code_1024.png"
+    fi
+
     convert "code_1024.png" -resize 512x512 code_512.png
     convert "code_1024.png" -resize 256x256 code_256.png
     convert "code_1024.png" -resize 128x128 code_128.png
 
-    png2icns "${SRC_PREFIX}src/${QUALITY}/resources/darwin/code.icns" code_512.png code_256.png code_128.png
+    png2icns "${SRC_PREFIX}src/${QUALITY}/resources/darwin/code.icns" code_1024.png code_512.png code_256.png code_128.png
 
-    rm code_1024.png code_512.png code_256.png code_128.png code_logo.png
+    rm -f code_1024.png code_512.png code_256.png code_128.png code_logo.png
   fi
 } # }}}
 
 build_darwin_types() { # {{{
-  rsvg-convert -w 128 -h 128 "icons/${QUALITY}/codium_cnl_w80_b8.svg" -o "code_logo.png"
+  if [[ "$1" == "no-border" ]]; then
+    rsvg-convert -w 128 -h 128 "icons/${QUALITY}/codium_cnl.svg" -o "code_logo.png"
+  else
+    rsvg-convert -w 128 -h 128 "icons/${QUALITY}/codium_cnl_w80_b8.svg" -o "code_logo.png"
+  fi
 
   for file in "${VSCODE_PREFIX}"vscode/resources/darwin/*; do
     if [[ -f "${file}" ]]; then
@@ -60,7 +82,7 @@ build_darwin_types() { # {{{
       if [[ "${name}" != 'code' ]] && [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/darwin/${name}.icns" ]]; then
         icns2png -x -s 512x512 "${file}" -o .
 
-        composite -blend 100% -geometry +323+365 "icons/corner_512.png" "${name}_512x512x32.png" "${name}.png"
+        composite -blend 100% -geometry +323+365 "${VSCODE_PREFIX}icons/corner_512.png" "${name}_512x512x32.png" "${name}.png"
         composite -geometry +359+374 "code_logo.png" "${name}.png" "${name}.png"
 
         convert "${name}.png" -resize 256x256 "${name}_256.png"
@@ -77,26 +99,32 @@ build_darwin_types() { # {{{
 
 build_linux_main() { # {{{
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/linux/code.png" ]]; then
-    wget "https://raw.githubusercontent.com/VSCodium/icons/main/icons/linux/circle1/${COLOR}/paulo22s.png" -O "${SRC_PREFIX}src/${QUALITY}/resources/linux/code.png"
+    mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/linux"
+
+    load_linux_png "${SRC_PREFIX}src/${QUALITY}/resources/linux/code.png"
   fi
 
-  mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/linux/rpm"
-
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/linux/rpm/code.xpm" ]]; then
+    mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/linux/rpm"
+
     convert "${SRC_PREFIX}src/${QUALITY}/resources/linux/code.png" "${SRC_PREFIX}src/${QUALITY}/resources/linux/rpm/code.xpm"
   fi
 } # }}}
 
 build_media() { # {{{
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/src/vs/workbench/browser/media/code-icon.svg" ]]; then
+    mkdir -p "${SRC_PREFIX}src/${QUALITY}/src/vs/workbench/browser/media"
+
     cp "icons/${QUALITY}/codium_clt.svg" "${SRC_PREFIX}src/${QUALITY}/src/vs/workbench/browser/media/code-icon.svg"
     gsed -i 's|width="100" height="100"|width="1024" height="1024"|' "${SRC_PREFIX}src/${QUALITY}/src/vs/workbench/browser/media/code-icon.svg"
   fi
 } # }}}
 
 build_server() { # {{{
+  mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/server"
+
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/server/favicon.ico" ]]; then
-    wget "https://raw.githubusercontent.com/VSCodium/icons/main/icons/win32/nobg/${COLOR}/paulo22s.ico" -O "${SRC_PREFIX}src/${QUALITY}/resources/server/favicon.ico"
+    load_windows_ico "${SRC_PREFIX}src/${QUALITY}/resources/server/favicon.ico"
   fi
 
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/server/code-192.png" ]]; then
@@ -110,7 +138,9 @@ build_server() { # {{{
 
 build_windows_main() { # {{{
   if [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/win32/code.ico" ]]; then
-    wget "https://raw.githubusercontent.com/VSCodium/icons/main/icons/win32/nobg/${COLOR}/paulo22s.ico" -O "${SRC_PREFIX}src/${QUALITY}/resources/win32/code.ico"
+    mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/win32"
+
+    load_windows_ico "${SRC_PREFIX}src/${QUALITY}/resources/win32/code.ico"
   fi
 } # }}}
 
@@ -132,12 +162,16 @@ build_windows_type() { # {{{
 
     rsvg-convert -w "${LOGO_SIZE}" -h "${LOGO_SIZE}" "icons/${QUALITY}/codium_cnl.svg" -o "code_logo.png"
 
-    composite -gravity "${GRAVITY}" "code_logo.png" "${FILE_PATH}" "${FILE_PATH}"
+    if [[ "${GRAVITY}" == "center" ]]; then
+      composite -gravity "${GRAVITY}" "code_logo.png" "${FILE_PATH}" "${FILE_PATH}"
+    else
+      composite -gravity NorthWest -geometry "${GRAVITY}" "code_logo.png" "${FILE_PATH}" "${FILE_PATH}"
+    fi
   fi
 } # }}}
 
 build_windows_types() { # {{{
-  mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/win32"
+  mkdir -p "${SRC_PREFIX}src/${QUALITY}/resources/win32" "${SRC_PREFIX}build/windows/msi/resources/${QUALITY}"
 
   rsvg-convert -b "#F5F6F7" -w 64 -h 64 "icons/${QUALITY}/codium_cnl.svg" -o "code_logo.png"
 
@@ -148,11 +182,11 @@ build_windows_types() { # {{{
       if [[ "${name}" != 'code' ]] && [[ ! -f "${SRC_PREFIX}src/${QUALITY}/resources/win32/${name}.ico" ]]; then
         icotool -x -w 256 "${file}"
 
-        composite -geometry +150+185 "code_logo.png" "${name}_9_256x256x32.png" "${name}.png"
+        composite -geometry +150+185 "code_logo.png" "${name}_1_256x256x32.png" "${name}.png"
 
         convert "${name}.png" -define icon:auto-resize=256,128,96,64,48,32,24,20,16 "${SRC_PREFIX}src/${QUALITY}/resources/win32/${name}.ico"
 
-        rm "${name}_9_256x256x32.png" "${name}.png"
+        rm "${name}_1_256x256x32.png" "${name}.png"
       fi
     fi
   done

install_gh.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-set -ex
-
-GH_ARCH="amd64"
-
-TAG=$( curl --retry 12 --retry-delay 30 "https://api.github.com/repos/cli/cli/releases/latest" | jq --raw-output '.tag_name' )
-VERSION=${TAG#v}
-
-curl --retry 12 --retry-delay 120 -sSL "https://github.com/cli/cli/releases/download/${TAG}/gh_${VERSION}_linux_${GH_ARCH}.tar.gz" -o "gh_${VERSION}_linux_${GH_ARCH}.tar.gz"
-
-tar xf "gh_${VERSION}_linux_${GH_ARCH}.tar.gz"
-
-cp "gh_${VERSION}_linux_${GH_ARCH}/bin/gh" /usr/local/bin/
-
-gh --version

justfile

@@ -0,0 +1,10 @@
+set shell := ["bash", "-uc"]
+
+ci-lint:
+	zizmor .
+
+ci-lint-fix:
+  zizmor . --fix=all
+
+ci-update:
+	PINACT_MIN_AGE=7 pinact run --update

patches/00-binary-fix-name.patch

@@ -1,22 +1,22 @@
-diff --git a/build/gulpfile.vscode.js b/build/gulpfile.vscode.js
-index 7046ee0..faca888 100644
---- a/build/gulpfile.vscode.js
-+++ b/build/gulpfile.vscode.js
-@@ -376,3 +376,3 @@ function packageTask(platform, arch, sourceFolderName, destinationFolderName, op
- 				.pipe(replace('@@APPNAME@@', product.applicationName))
+diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
+index a103f11..cc95785 100644
+--- a/build/gulpfile.vscode.ts
++++ b/build/gulpfile.vscode.ts
+@@ -466,3 +466,3 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
+ 				.pipe(replace('@@NAME@@', product.nameShort))
 -				.pipe(rename('bin/code'));
 +				.pipe(rename('bin/' + product.applicationName));
  			const policyDest = gulp.src('.build/policies/darwin/**', { base: '.build/policies/darwin' })
 diff --git a/src/vs/platform/native/electron-main/nativeHostMainService.ts b/src/vs/platform/native/electron-main/nativeHostMainService.ts
-index 6324e98..3d2fba3 100644
+index 93d0008..a04d296 100644
 --- a/src/vs/platform/native/electron-main/nativeHostMainService.ts
 +++ b/src/vs/platform/native/electron-main/nativeHostMainService.ts
-@@ -445,3 +445,3 @@ export class NativeHostMainService extends Disposable implements INativeHostMain
+@@ -539,3 +539,3 @@ export class NativeHostMainService extends Disposable implements INativeHostMain
  	private async getShellCommandLink(): Promise<{ readonly source: string; readonly target: string }> {
 -		const target = resolve(this.environmentMainService.appRoot, 'bin', 'code');
 +		const target = resolve(this.environmentMainService.appRoot, 'bin', this.productService.applicationName);
  		const source = `/usr/local/bin/${this.productService.applicationName}`;
-@@ -680,3 +680,3 @@ export class NativeHostMainService extends Disposable implements INativeHostMain
+@@ -808,3 +808,3 @@ export class NativeHostMainService extends Disposable implements INativeHostMain
  		if (this.environmentMainService.isBuilt) {
 -			return join(this.environmentMainService.appRoot, 'bin', 'code');
 +			return join(this.environmentMainService.appRoot, 'bin', `${this.productService.applicationName}`);

patches/00-build-disable-esbuild.patch

@@ -0,0 +1,8 @@
+diff --git a/build/buildConfig.ts b/build/buildConfig.ts
+index a4299d26..a815dd51 100644
+--- a/build/buildConfig.ts
++++ b/build/buildConfig.ts
+@@ -11,2 +11,2 @@
+  */
+-export const useEsbuildTranspile = true;
++export const useEsbuildTranspile = false;

patches/00-build-disable-mangle.patch

@@ -0,0 +1,32 @@
+diff --git a/build/lib/compilation.ts b/build/lib/compilation.ts
+index 948c6b4..66ecdd3 100644
+--- a/build/lib/compilation.ts
++++ b/build/lib/compilation.ts
+@@ -131,27 +131,3 @@ export function compileTask(src: string, out: string, build: boolean, options: {
+ 
+-		// mangle: TypeScript to TypeScript
+-		let mangleStream = es.through();
+-		if (build && !options.disableMangle) {
+-			let ts2tsMangler: Mangler | undefined = new Mangler(compile.projectPath, (...data) => fancyLog(ansiColors.blue('[mangler]'), ...data), { mangleExports: true, manglePrivateFields: true });
+-			const newContentsByFileName = ts2tsMangler.computeNewFileContents(new Set(['saveState']));
+-			mangleStream = es.through(async function write(data: File & { sourceMap?: RawSourceMap }) {
+-				type TypeScriptExt = typeof ts & { normalizePath(path: string): string };
+-				const tsNormalPath = (ts as TypeScriptExt).normalizePath(data.path);
+-				const newContents = (await newContentsByFileName).get(tsNormalPath);
+-				if (newContents !== undefined) {
+-					data.contents = Buffer.from(newContents.out);
+-					data.sourceMap = newContents.sourceMap && JSON.parse(newContents.sourceMap);
+-				}
+-				this.push(data);
+-			}, async function end() {
+-				// free resources
+-				(await newContentsByFileName).clear();
+-
+-				this.push(null);
+-				ts2tsMangler = undefined;
+-			});
+-		}
+-
+ 		return srcPipe
+-			.pipe(mangleStream)
+ 			.pipe(generator.stream)

patches/00-build-download-extensions-from-gh.patch

@@ -1,15 +1,5 @@
-diff --git a/build/lib/builtInExtensions.js b/build/lib/builtInExtensions.js
-index 249777c..129af8a 100644
---- a/build/lib/builtInExtensions.js
-+++ b/build/lib/builtInExtensions.js
-@@ -87,5 +87,2 @@ function getExtensionDownloadStream(extension) {
-     }
--    else if (productjson.extensionsGallery?.serviceUrl) {
--        input = ext.fromMarketplace(productjson.extensionsGallery.serviceUrl, extension);
--    }
-     else {
 diff --git a/build/lib/builtInExtensions.ts b/build/lib/builtInExtensions.ts
-index e9a1180..b8348e3 100644
+index d52567b..fe5b988 100644
 --- a/build/lib/builtInExtensions.ts
 +++ b/build/lib/builtInExtensions.ts
 @@ -75,4 +75,2 @@ function getExtensionDownloadStream(extension: IExtensionDefinition) {

patches/00-build-fix-npm-preinstall.patch

@@ -0,0 +1,14 @@
+diff --git a/build/npm/preinstall.ts b/build/npm/preinstall.ts
+index 3476fca..e23329f 100644
+--- a/build/npm/preinstall.ts
++++ b/build/npm/preinstall.ts
+@@ -129,3 +129,3 @@ function installHeaders() {
+ 	// Refs https://chromium-review.googlesource.com/c/v8/v8/+/6879784
+-	if (process.platform === 'linux') {
++	if (process.platform === 'linux' && local) {
+ 		const homedir = os.homedir();
+@@ -133,3 +133,3 @@ function installHeaders() {
+ 		const nodeGypCache = path.join(cachePath, 'node-gyp');
+-		const localHeaderPath = path.join(nodeGypCache, local!.target, 'include', 'node');
++		const localHeaderPath = path.join(nodeGypCache, local.target, 'include', 'node');
+ 		if (fs.existsSync(localHeaderPath)) {

patches/00-build-update-electron.patch.no

@@ -0,0 +1,203 @@
+diff --git a/.npmrc b/.npmrc
+index a275846..e31402c 100644
+--- a/.npmrc
++++ b/.npmrc
+@@ -1,3 +1,3 @@
+ disturl="https://electronjs.org/headers"
+-target="39.8.0"
++target="39.8.4"
+ ms_build_id="13470701"
+diff --git a/build/checksums/electron.txt b/build/checksums/electron.txt
+index 5d8343f..1fd0e54 100644
+--- a/build/checksums/electron.txt
++++ b/build/checksums/electron.txt
+@@ -1,75 +1,75 @@
+-d70954386008ad2c65d9849bb89955ab3c7dd08763256ae0d91d8604e8894d64 *chromedriver-v39.8.0-darwin-arm64.zip
+-2f6b654337133c13440aafdaf9e8b15f5ebb244e7d49f20977f03438e9bb8adb *chromedriver-v39.8.0-darwin-x64.zip
+-ef8681bb6b6af42cdf0e14c9ce188f035e01620781308c06cd3c6b922aaea2e6 *chromedriver-v39.8.0-linux-arm64.zip
+-c03fea6ac2b743d771407dc5f58809f44d2a885b1830b847957823cac2e7b222 *chromedriver-v39.8.0-linux-armv7l.zip
+-4bb7c6d9b3a7bfdd89edd0db98e63599ebf6dacdb888d5985bbb73f6153acc0c *chromedriver-v39.8.0-linux-x64.zip
+-aad1f6f970b5636d637c1c242766fbaa5bebe2707a605a38aadc7b40724b3d11 *chromedriver-v39.8.0-mas-arm64.zip
+-e89ebebe3a135d3ce40168152a0aabfd055b9fa6b118262a6df18405fd2ea433 *chromedriver-v39.8.0-mas-x64.zip
+-232e1a0460f6a59056499cccfff3265bf92eae22f20f02f2419e5e49552aaed7 *chromedriver-v39.8.0-win32-arm64.zip
+-ab92f46cc55da7c719175b50203c734781828389b8b3a1a535204bf0dc7d1296 *chromedriver-v39.8.0-win32-ia32.zip
+-a40eb521063e4ea6791ed4005815fa8ac259c1febc850246a83a47ce120121ce *chromedriver-v39.8.0-win32-x64.zip
+-d6a33b4c3c0de845ea23d1e2614c6c6d3bbe35b771bb63ae521c4db11373b021 *electron-api.json
+-5425323fdb23167870075e944ec6cf3ae383fbe45ad141d08b1d9689030ccd05 *electron-v39.8.0-darwin-arm64-dsym-snapshot.zip
+-aa32ab00ee58d8827cd53ca561b8c26b7cb7e2ad8cb0801acdda117ee728388e *electron-v39.8.0-darwin-arm64-dsym.zip
+-f94e589804a3394a4735543b888927be873f8f402899d0debe32a9dc570d6285 *electron-v39.8.0-darwin-arm64-symbols.zip
+-681d82c2ec6677ff0bf12f5bb1808b5a51dcbf10894bd0298641015119a3e04d *electron-v39.8.0-darwin-arm64.zip
+-a95e83b5cde762a37e64229e5669b0c19b95aac148689d96ca344535109eb983 *electron-v39.8.0-darwin-x64-dsym-snapshot.zip
+-8c989d8ca835ecdd93d49d9627f5548272c0ed03e263392b21ed287960b29e41 *electron-v39.8.0-darwin-x64-dsym.zip
+-b4b6fda9c5b9063a104318645aa29ef4738dd099da2b722e3e9b6dde5e098418 *electron-v39.8.0-darwin-x64-symbols.zip
+-ec53f2ba79498410323bb96a19ce98741bf28666cc9d83e07d11dadcc5506f38 *electron-v39.8.0-darwin-x64.zip
+-9141e64f9d4ea7f0e6a43ae364c8232a0dac79ecec44de2d4a0e5d688fbb742c *electron-v39.8.0-linux-arm64-debug.zip
+-5fac949d5331abaff0643dbcda7cc187e548cd4bf9d198c1ffc361383bfaa79f *electron-v39.8.0-linux-arm64-symbols.zip
+-c9db883fa671237fbc16256cf89aba55b9fcfbd9825fec32a6d57724a6446fe1 *electron-v39.8.0-linux-arm64.zip
+-b26ac10e84f6b7d338c13a38547aa66b5e9afbe2f1355b183ebc2ff8f428cfa9 *electron-v39.8.0-linux-armv7l-debug.zip
+-16c47c008a8783f6c8d6387fe01ea15425161befbf4211e4667bbdd6bb806ef0 *electron-v39.8.0-linux-armv7l-symbols.zip
+-b1b37fd450a5081a876c2b00b6ca007d454747a7d1d8f04feb16119d6ace94c6 *electron-v39.8.0-linux-armv7l.zip
+-1e8039cdf60b27785771c9e3f3c4c39fad37602bb0e6b75a30f83c57fdbef069 *electron-v39.8.0-linux-x64-debug.zip
+-ff9ca169c6e79649dd4c5a49a82a8d4b1761b62fbe14c15c61bf534381a9f653 *electron-v39.8.0-linux-x64-symbols.zip
+-854076cc4c63d6d6c320df1ca3f4bd7084ef9f9bb47c7b75d80feb2c2ed920b4 *electron-v39.8.0-linux-x64.zip
+-91bc313cbd009435552d8d5efff5d6ed0ff15465743c2629dac1cfe99ac34e4d *electron-v39.8.0-mas-arm64-dsym-snapshot.zip
+-974f10f80ec6c65f8d9f2ac1ccd8c4395bb34e24e2b09dc0ff80bd351099692e *electron-v39.8.0-mas-arm64-dsym.zip
+-b3878bc9198cff324b7c829ce2fbea7a4ee505f2f99b0bb3c11ac5e60651be59 *electron-v39.8.0-mas-arm64-symbols.zip
+-48dac99c757a850b0db7b38c1b95e08270f690a7ea1b58872e45308c2f7c8c93 *electron-v39.8.0-mas-arm64.zip
+-1a6e4df1092f89ed46833938d6dd1b3036640037bd09f0630a369ae386a7c872 *electron-v39.8.0-mas-x64-dsym-snapshot.zip
+-81425eb867527341af64c00726bd462957fec4d5f073922df891d830addbc5bc *electron-v39.8.0-mas-x64-dsym.zip
+-748ce154e894a27b117b46354cc288dc9442fade844c637b59fe1c1f3f7c625d *electron-v39.8.0-mas-x64-symbols.zip
+-91f8f7d4eb1a42ac4fa0eaa93034c8e6155ccb50718f9f55541ce2be4a4ed6d0 *electron-v39.8.0-mas-x64.zip
+-b775b7584afb84e52b0a770e1e63a2f17384b66eeebe845e0c5c82beacaf7e93 *electron-v39.8.0-win32-arm64-pdb.zip
+-ac62373d11ed682b4fcdae27de2bd72ebf7d46d3b569f5fcf242de01786d0948 *electron-v39.8.0-win32-arm64-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-arm64-toolchain-profile.zip
+-08b79fa5deabbcace447f1e15eb99b3b117b42a84b71ad5b0f52d2da68a34192 *electron-v39.8.0-win32-arm64.zip
+-f4fb798d76a0c2f80717ef1607571537dbbb07f1cc5f177048bcfd17046c2255 *electron-v39.8.0-win32-ia32-pdb.zip
+-37c1d2988793604294724b648589fca6459472021189abab1550d5e1eecff1a7 *electron-v39.8.0-win32-ia32-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-ia32-toolchain-profile.zip
+-59b70a12abedb550795614bc74c5803787e824da3529a631fdb5c2b5aad00196 *electron-v39.8.0-win32-ia32.zip
+-0357c6fb0d7198c45cba0e8c939473ea1d971e1efe801bc84e2c559141b368e7 *electron-v39.8.0-win32-x64-pdb.zip
+-8e6f4e8516d15aecde5244beac315067c13513c7074383086523eef2638a5e8d *electron-v39.8.0-win32-x64-symbols.zip
+-b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.0-win32-x64-toolchain-profile.zip
+-9edc111b22aee1a0efb5103d6d3b48645af57b48214eeb48f75f9edfc3e271d6 *electron-v39.8.0-win32-x64.zip
+-b6eca0e05fcff2464382278dff52367f6f21eb1a580dd8a0a954fc16397ab085 *electron.d.ts
+-27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.0-darwin-arm64.zip
+-321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.0-darwin-x64.zip
+-52ae6eccbdb4a9403a6c3eb46b356a28940ec25958b6b9181fb2f38e612e40ed *ffmpeg-v39.8.0-linux-arm64.zip
+-622cb781fb1e3b9617e7e60c36384427f7b0d9b5ad888e9bc356a83b050e13f1 *ffmpeg-v39.8.0-linux-armv7l.zip
+-ba441851788008362f013bf2983b22b0042af8df31bf90123328f928cc067492 *ffmpeg-v39.8.0-linux-x64.zip
+-27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.0-mas-arm64.zip
+-321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.0-mas-x64.zip
+-3ba7c7507181e0d4836f70f3d8800b4e9ba379e1086e9e89fda7ff9b3b9ad2cb *ffmpeg-v39.8.0-win32-arm64.zip
+-f37e7d51b8403e2ed8ca192bc6ae759cf63d80010e747b15eeb7120b575578b2 *ffmpeg-v39.8.0-win32-ia32.zip
+-b252e232438010f9683e8fd10c3bf0631df78e42a6ae11d6cb7aa7e6ac11185f *ffmpeg-v39.8.0-win32-x64.zip
+-365735192f58a7f7660100227ec348ba3df604415ff5264b54d93cb6cf5f6f6f *hunspell_dictionaries.zip
+-6384ee31daa39de4dd4bd3aa225cdb14cdddb7f463a2c1663b38a79e122a13e2 *libcxx-objects-v39.8.0-linux-arm64.zip
+-9748b3272e52a8274fe651def2d6ae2dad7a3771b520dd105f46f4020ba9d63b *libcxx-objects-v39.8.0-linux-armv7l.zip
+-74d47a155ecc6c2054418c7c3e0540f32b983ebdc65e8b4ea5d3e257d29b3f4f *libcxx-objects-v39.8.0-linux-x64.zip
+-c0755fbb84011664bd36459fc6e06a603078dccd3b7b260f6ed6ad1d409f79f7 *libcxx_headers.zip
+-3ea41e9bd56e8f52ab8562c1406ba9416abe3993640935e981cbbd77c0f2654b *libcxxabi_headers.zip
+-befcd6067f35d911a6a87b927e79dc531cb7bea39e85f86a65e9ab82ef0cece1 *mksnapshot-v39.8.0-darwin-arm64.zip
+-f0e692655298ffed60630c3e6490ced69e9d8726e85bcaecfa34485f3a991469 *mksnapshot-v39.8.0-darwin-x64.zip
+-d5d0901cd1eafdf921d2a0d1565829cf60f454a71ce74fa60db98780fd8a1a96 *mksnapshot-v39.8.0-linux-arm64-x64.zip
+-1bc0a3294d258a59846aa5c5359cd8b0f43831ebd7c3e1dde9a6cfaa39d845bf *mksnapshot-v39.8.0-linux-armv7l-x64.zip
+-4e414dbe75f460cb34508608db984aa6f4d274f333fa327a3d631da4a516da8f *mksnapshot-v39.8.0-linux-x64.zip
+-c51c86e3a11ad75fb4f7559798f6d64ec7def19583c96ce08de7ee5796568841 *mksnapshot-v39.8.0-mas-arm64.zip
+-6544d1e93adea1e9a694f9b9f539d96f84df647d9c9319b29d4fc88751ff9075 *mksnapshot-v39.8.0-mas-x64.zip
+-372b4685c53f19ccc72c33d78c1283d9389c72f42cd48224439fe4f89199caa0 *mksnapshot-v39.8.0-win32-arm64-x64.zip
+-199e9244f4522a4a02aece09a6a33887b24d7ec837640d39c930170e4b3caa57 *mksnapshot-v39.8.0-win32-ia32.zip
+-970e979e7a8b70f300f7854cb571756d9049bc42b44a6153a9ce3a18e1a83243 *mksnapshot-v39.8.0-win32-x64.zip
++1e91e08b27242bfa38e3321eac27a76b4527b5240d9b7fa55b34b27272c7d20d *chromedriver-v39.8.4-darwin-arm64.zip
++e6036542dea19cf60b0d1ae6b7be1cdfb741363f7af8243720566363a9d04a23 *chromedriver-v39.8.4-darwin-x64.zip
++464e5f0c7ae0dcf4817436d6289bcee5cd655e7da96debf8e4723a10f2545362 *chromedriver-v39.8.4-linux-arm64.zip
++2be3059d746a33bf3e4c0cf89131401294ef270e152a0e567ffb279a77cd3bba *chromedriver-v39.8.4-linux-armv7l.zip
++dfce0407bf9304f1df3f053e305d8c7660ab7ac2b6f4b81bedab343d16bcc48d *chromedriver-v39.8.4-linux-x64.zip
++28c4f1b14580fc2a0b35cb9a9b29e8742e117311df8843c1ba31439249b368c3 *chromedriver-v39.8.4-mas-arm64.zip
++381581e0ba9ca49682d39b7cdf05d5f3c2c477c2db7878738103051bffb02c5d *chromedriver-v39.8.4-mas-x64.zip
++22c4c9e1fdbb80b02bfca06de84407ff4fae79072f192b4e4c9260ccd2d55ded *chromedriver-v39.8.4-win32-arm64.zip
++d2771daa0fdd9375b6b82b8fbdc61781fba3ab3aa104a57d0e4a5262b8aa7baa *chromedriver-v39.8.4-win32-ia32.zip
++984738998aa9f5947f11446386d5c26dc5836de5869be4a11a8db6c1a21a9801 *chromedriver-v39.8.4-win32-x64.zip
++21469b4c0fba6ff2470f3ca046c4fedaa0e7169de6849d3a515df1229583e72b *electron-api.json
++4ef051701b2d01f19f8d3d29d41d27e3a9c6881c9defefc3883b35157234ffb0 *electron-v39.8.4-darwin-arm64-dsym-snapshot.zip
++115a40e2f14a492cc5ea9948e61e8c00ad758c568a74c94551acde0a0c6ff892 *electron-v39.8.4-darwin-arm64-dsym.zip
++d744d733681a36a242abb8b997c58571b49edb12db616bbd966111b1ff9f2114 *electron-v39.8.4-darwin-arm64-symbols.zip
++47636d2c4e07dc587fad991d2e682a8a8aa42281732e33323418e16e4d31245d *electron-v39.8.4-darwin-arm64.zip
++8196638bd34cc5815bd91de60f2d5eaa1119c8d473519c208e640cf68a1d9410 *electron-v39.8.4-darwin-x64-dsym-snapshot.zip
++f6cc6d79870acb14efda0bfb33f1e78b96fcab3bdbecc6d91c505dddb519f09f *electron-v39.8.4-darwin-x64-dsym.zip
++14204efe7f170b82e9c369d060f8b05d5a32aceb9800330861dbc05482ada505 *electron-v39.8.4-darwin-x64-symbols.zip
++48bc4c03e3dab5678ddc447378ec639803d687d75939575675a273f054b98237 *electron-v39.8.4-darwin-x64.zip
++8c5e0eb3e15b90b2397dc641255c8bac797a0e4a2f999ea77e4461d667add977 *electron-v39.8.4-linux-arm64-debug.zip
++25df0c1a03bdad3a19f5a9d6385efadc249b48a512cbb7967bccffe1a123a007 *electron-v39.8.4-linux-arm64-symbols.zip
++67d9c084e664ee2a5f76dce2efb13f79aff60e014deb06174af82b6cfd43b101 *electron-v39.8.4-linux-arm64.zip
++514dbca9bf81f82f6574ae906057b78f13c4bd781eba9033ed58d6609ce944a8 *electron-v39.8.4-linux-armv7l-debug.zip
++3baa152b9ae413da46ced437291b7bd65dca390168a62f9ba01b7f8c9bc76ed4 *electron-v39.8.4-linux-armv7l-symbols.zip
++a2d835231443afc8022a99a3ab94b7b4a90ebfbda77c2fbefafca430753174fe *electron-v39.8.4-linux-armv7l.zip
++8ea7223c43a03779fafc6272742ebca104f584b3952abcf17b186af3624803d7 *electron-v39.8.4-linux-x64-debug.zip
++4d834e7574dda95f1bd10a7758ed93fbc12d2aa4aa6cc6fad091a37ea422d196 *electron-v39.8.4-linux-x64-symbols.zip
++66f1ea702595deda724f6c6246acfddc84a317c7f0262bd7fd350af50dbbe4e9 *electron-v39.8.4-linux-x64.zip
++ce85bfbd66c6731004e7d035a2bf65b2c0cb95a9716ee7e156061c791bd723a7 *electron-v39.8.4-mas-arm64-dsym-snapshot.zip
++b745d57275df62904d779fe757446adfe515252edc00fe8e8667fe63e9975dda *electron-v39.8.4-mas-arm64-dsym.zip
++14706a26e78fcdc34be2f12229920cc178b6b773eeede0aee87875336e4a6a0c *electron-v39.8.4-mas-arm64-symbols.zip
++9a30bfe87c8d62f39798a5a69a63085429f6f1ba1975e7d552dc35c6c7c41a59 *electron-v39.8.4-mas-arm64.zip
++8ee820ece1f08d637ddbea9dae1b9fbe014be88fa20feb1e261a6921c2977e6c *electron-v39.8.4-mas-x64-dsym-snapshot.zip
++044c25405f83c6012c238990b534f47430e308c2c787e1f6d7fe0fb41728b818 *electron-v39.8.4-mas-x64-dsym.zip
++05c1f4fc148222481dc3e88388cbd5451bffdd436293cc0613a9ab1904e76cfa *electron-v39.8.4-mas-x64-symbols.zip
++51c310921e5740a91a75d89819f89757210707a913691fe07d60e84100102d42 *electron-v39.8.4-mas-x64.zip
++3aacf6f224b5438350c1ea5524cb0c962f6d60f8e00f297fc872dce9633aed7d *electron-v39.8.4-win32-arm64-pdb.zip
++180f870fbe3aff8d4ca837ff41b5e1dd04d63b0ae0cc2fcf8d7e20e518f4fcb6 *electron-v39.8.4-win32-arm64-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-arm64-toolchain-profile.zip
++4316324e59d8bceee77366a4ed7a8d3f087ccdf2232b9cac61d600c28fcf0876 *electron-v39.8.4-win32-arm64.zip
++110fa00b9defb546e6110022be00c2f8ef2306b7104e2a1f749dc2b74d467e57 *electron-v39.8.4-win32-ia32-pdb.zip
++ae8c656e2d43493a6c245235ca17f1ddd8ae9632f73348a8f76d76240c5f33f6 *electron-v39.8.4-win32-ia32-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-ia32-toolchain-profile.zip
++f260df3274199f29e32e89efb7bcd846db30d6ccdcc46cc3be9c19be9bc16566 *electron-v39.8.4-win32-ia32.zip
++2e37fd5956a3b73d99e569ea71cc463ba550440835f7672d0651c309d2489c52 *electron-v39.8.4-win32-x64-pdb.zip
++b1601c04324691324b2943aeda1309dbd8dac20cc5f4df32f4aa12d5a68c4b0c *electron-v39.8.4-win32-x64-symbols.zip
++b701e63ca5d443d9bd1b653ea0e2b7479f0d834a3d1bd9f10a3b745d29607154 *electron-v39.8.4-win32-x64-toolchain-profile.zip
++8acc4bb73f05a32eba18bd08e7bc4636e41b2fd00cb538cb90becffbca997789 *electron-v39.8.4-win32-x64.zip
++3675395eef7139544965c3408f1426e4af36055627c5ec0c2fe5abf4cecf6977 *electron.d.ts
++27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.4-darwin-arm64.zip
++321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.4-darwin-x64.zip
++52ae6eccbdb4a9403a6c3eb46b356a28940ec25958b6b9181fb2f38e612e40ed *ffmpeg-v39.8.4-linux-arm64.zip
++622cb781fb1e3b9617e7e60c36384427f7b0d9b5ad888e9bc356a83b050e13f1 *ffmpeg-v39.8.4-linux-armv7l.zip
++ba441851788008362f013bf2983b22b0042af8df31bf90123328f928cc067492 *ffmpeg-v39.8.4-linux-x64.zip
++27cf8e375bc22ceea6b3d42132f2927ea544edac2b8b2c5dc3c10b5df8dfb027 *ffmpeg-v39.8.4-mas-arm64.zip
++321d9c07f74c6cf77027ec07d888fb7b634d6589207e3c9e016c43e277ca9944 *ffmpeg-v39.8.4-mas-x64.zip
++71d478432519dda32a53c47eb5fcb97d23265273ff7939da54cccf7a19f6f87e *ffmpeg-v39.8.4-win32-arm64.zip
++3c52c43a62ebf1ebbe0c02611ad4399eb0131257849b707156417ffcbaa144c8 *ffmpeg-v39.8.4-win32-ia32.zip
++5613f1bd387d6c91f4c3901b22643c5400c696e2dacbb7d9893d0e63edc51ae9 *ffmpeg-v39.8.4-win32-x64.zip
++d720519f7417fe58d60d54085a0c32e8e7b65883cad909ee55d1b9b78f86362d *hunspell_dictionaries.zip
++a4c6e3aef474b21e7f002858ddef194da1b64e8b20ecabdaea9533d1d2712738 *libcxx-objects-v39.8.4-linux-arm64.zip
++bd9f1876dddbc413fc3328707f4f7f9daa2df7cb81d4d9e13f520168ec9eb76a *libcxx-objects-v39.8.4-linux-armv7l.zip
++8403bc29cd82a40f422c63fdbaa61b85d28ff58e5e90e378a97c0715133b87c4 *libcxx-objects-v39.8.4-linux-x64.zip
++9bbb19892567a3a9abd0f6288f9f203fa3051387c3e4625fc52eb49adcbe96e5 *libcxx_headers.zip
++9b988e2bb379c6d3094872f600944ad3284510cf225f86368c4f43270b89673c *libcxxabi_headers.zip
++f106faec00f811971cce77bb39a2ef08ddeb3e6b3b6f96991a4ab889c06636a3 *mksnapshot-v39.8.4-darwin-arm64.zip
++23ca2a8fbe7d870c745c6808dced54889883d259fd6a601174b81891dfd1a052 *mksnapshot-v39.8.4-darwin-x64.zip
++23b78843edf3ad2ad2a38eb88578105a75335c397bd4f7cc1fdf54f890fb9d9b *mksnapshot-v39.8.4-linux-arm64-x64.zip
++582d768b97f13d5991fb96dbbba54f7c5da4248634952d77eac342ecd5db29a5 *mksnapshot-v39.8.4-linux-armv7l-x64.zip
++677e242eca2487d1427e035cc9e54750a3bb2528f761af483e5a6d67f81f69dc *mksnapshot-v39.8.4-linux-x64.zip
++fadb9ec8cbf598ef49d5dac34c764a2d2487d41111e3201dd13ad6f09d48c591 *mksnapshot-v39.8.4-mas-arm64.zip
++2a912c91dffeae2e8a97b7e49fe67f7dfb7d13f8e441bb5c2c40d2583ae504ca *mksnapshot-v39.8.4-mas-x64.zip
++fc5478a848c95a1412efdc550d16e4e83c7c2db5f98c658da2430c4275e5f6cb *mksnapshot-v39.8.4-win32-arm64-x64.zip
++b279c6292e1937a9c6aa7421415434e8f40ed7ba818851f57227cdedbdd19e7b *mksnapshot-v39.8.4-win32-ia32.zip
++c5b457d293d35f98d9d548613fce3c6ee111242760d381ed39d6c721b3d09918 *mksnapshot-v39.8.4-win32-x64.zip
+\ No newline at end of file
+diff --git a/cgmanifest.json b/cgmanifest.json
+index 1b1e171..09d805b 100644
+--- a/cgmanifest.json
++++ b/cgmanifest.json
+@@ -531,4 +531,4 @@
+ 					"repositoryUrl": "https://github.com/electron/electron",
+-					"commitHash": "69c8cbf259da0f84e9c1db04958516a68f7170aa",
+-					"tag": "39.8.0"
++					"commitHash": "7007907df08d02da98f513dcbdb430ab51be59c7",
++					"tag": "39.8.4"
+ 				}
+diff --git a/package-lock.json b/package-lock.json
+index 3795213..9d261de 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -104,3 +104,3 @@
+         "deemon": "^1.13.6",
+-        "electron": "39.8.0",
++        "electron": "39.8.4",
+         "eslint": "^9.36.0",
+@@ -8389,5 +8389,5 @@
+     "node_modules/electron": {
+-      "version": "39.8.0",
+-      "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.0.tgz",
+-      "integrity": "sha512-K+f3YelSyh9Q4LgUXuIhLB4kq73LJrqnIbe8ih9vpWi+iSdPebj0w7FRYwILCMDoyBQMFC9LicYHuIPmZzdKlg==",
++      "version": "39.8.4",
++      "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.4.tgz",
++      "integrity": "sha512-eXYKxr4y+s31xs78keVJYg+XY20tGQMQzyIhZvc5L0XRDH2Gp08mbeFlbR1OjAeM5h5l/T2JYT2MFK2kYe2fMg==",
+       "dev": true,
+diff --git a/package.json b/package.json
+index 295d4b3..6e707ed 100644
+--- a/package.json
++++ b/package.json
+@@ -174,3 +174,3 @@
+     "deemon": "^1.13.6",
+-    "electron": "39.8.0",
++    "electron": "39.8.4",
+     "eslint": "^9.36.0",

patches/00-build-update-sourcemap-url.patch

@@ -0,0 +1,74 @@
+diff --git a/build/gulpfile.extensions.ts b/build/gulpfile.extensions.ts
+index e013781..3caf586 100644
+--- a/build/gulpfile.extensions.ts
++++ b/build/gulpfile.extensions.ts
+@@ -26,2 +26,3 @@ import * as util from './lib/util.ts';
+ import watcher from './lib/watch/index.ts';
++import product from '../product.json' with { type: 'json' };
+ 
+@@ -100,3 +101,3 @@ const compilations = [
+ 
+-const getBaseUrl = (out: string) => `https://main.vscode-cdn.net/sourcemaps/${commit}/${out}`;
++const getBaseUrl = (out: string) => `https://github.com/VSCodium/sourcemaps/releases/download/${product.quality}-${commit}/extensions-${out.replaceAll('/', '-')}`;
+ 
+diff --git a/build/gulpfile.reh.ts b/build/gulpfile.reh.ts
+index 0ad08ab..78f17b8 100644
+--- a/build/gulpfile.reh.ts
++++ b/build/gulpfile.reh.ts
+@@ -494,3 +494,3 @@ function tweakProductForServerWeb(product: typeof import('../product.json')) {
+ 		util.rimraf(`out-vscode-${type}-min`),
+-		optimize.minifyTask(`out-vscode-${type}`, `https://main.vscode-cdn.net/sourcemaps/${commit}/core`)
++		optimize.minifyTask(`out-vscode-${type}`, `https://github.com/VSCodium/sourcemaps/releases/download/${product.quality}-${commit}/core`)
+ 	));
+diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
+index 187726c..4854af5 100644
+--- a/build/gulpfile.vscode.ts
++++ b/build/gulpfile.vscode.ts
+@@ -238,3 +238,3 @@ function runTsGoTypeCheck(): Promise<void> {
+ 
+-const sourceMappingURLBase = `https://main.vscode-cdn.net/sourcemaps/${commit}`;
++const sourceMappingURLBase = `https://github.com/VSCodium/sourcemaps/releases/download/${product.quality}-${commit}`;
+ const isCI = !!process.env['CI'] || !!process.env['BUILD_ARTIFACTSTAGINGDIRECTORY'] || !!process.env['GITHUB_WORKSPACE'];
+diff --git a/build/gulpfile.vscode.web.ts b/build/gulpfile.vscode.web.ts
+index 3e6b29a..f031b99 100644
+--- a/build/gulpfile.vscode.web.ts
++++ b/build/gulpfile.vscode.web.ts
+@@ -164,3 +164,3 @@ const minifyVSCodeWebTask = task.define('minify-vscode-web-OLD', task.series(
+ 	util.rimraf('out-vscode-web-min'),
+-	optimize.minifyTask('out-vscode-web', `https://main.vscode-cdn.net/sourcemaps/${commit}/core`)
++	optimize.minifyTask('out-vscode-web', `https://github.com/VSCodium/sourcemaps/releases/download/${product.quality}-${commit}/core`)
+ ));
+@@ -169,3 +169,3 @@ gulp.task(minifyVSCodeWebTask);
+ // esbuild-based tasks (new)
+-const sourceMappingURLBase = `https://main.vscode-cdn.net/sourcemaps/${commit}`;
++const sourceMappingURLBase = `https://github.com/VSCodium/sourcemaps/releases/download/${product.quality}-${commit}`;
+ const esbuildBundleVSCodeWebTask = task.define('esbuild-vscode-web', () => runEsbuildBundle('out-vscode-web', false, true));
+diff --git a/build/lib/extensions.ts b/build/lib/extensions.ts
+index aacf25c..a62f2a7 100644
+--- a/build/lib/extensions.ts
++++ b/build/lib/extensions.ts
+@@ -32,4 +32,2 @@ const require = createRequire(import.meta.url);
+ const root = path.dirname(path.dirname(import.meta.dirname));
+-// const commit = getVersion(root);
+-// const sourceMappingURLBase = `https://main.vscode-cdn.net/sourcemaps/${commit}`;
+ 
+diff --git a/build/lib/optimize.ts b/build/lib/optimize.ts
+index f5e812e..f9a4adc 100644
+--- a/build/lib/optimize.ts
++++ b/build/lib/optimize.ts
+@@ -229,3 +229,3 @@ export function bundleTask(opts: IBundleTaskOpts): () => NodeJS.ReadWriteStream
+ export function minifyTask(src: string, sourceMapBaseUrl?: string): (cb: any) => void {
+-	const sourceMappingURL = sourceMapBaseUrl ? ((f: any) => `${sourceMapBaseUrl}/${f.relative}.map`) : undefined;
++	const sourceMappingURL = sourceMapBaseUrl ? ((f: any) => `${sourceMapBaseUrl}-${f.relative.replaceAll('/', '-')}.map`) : undefined;
+ 	const target = getBuildTarget();
+diff --git a/build/lib/util.ts b/build/lib/util.ts
+index 4203e6e..a01fb78 100644
+--- a/build/lib/util.ts
++++ b/build/lib/util.ts
+@@ -287,4 +287,4 @@ export function rewriteSourceMappingURL(sourceMappingURLBase: string): NodeJS.Re
+ 			const contents = (f.contents as Buffer).toString('utf8');
+-			const str = `//# sourceMappingURL=${sourceMappingURLBase}/${path.dirname(f.relative).replace(/\\/g, '/')}/$1`;
+-			f.contents = Buffer.from(contents.replace(/\n\/\/# sourceMappingURL=(.*)$/gm, str));
++			const fp = path.dirname(f.relative).replace(/\\/g, '/').replaceAll('/', '-');
++			f.contents = Buffer.from(contents.replace(/\n\/\/# sourceMappingURL=(.*)$/gm, (_m, p) => `//# sourceMappingURL=${sourceMappingURLBase}/${fp}-${p.replaceAll('/', '-')}`));
+ 			return f;

patches/00-copilot-disable-terminal-suggest.patch

@@ -29,16 +29,16 @@ index 0000000..1daa1fe
 +
 +export default codiumCompletionSpec;
 diff --git a/extensions/terminal-suggest/src/terminalSuggestMain.ts b/extensions/terminal-suggest/src/terminalSuggestMain.ts
-index 863cd21..a33e440 100644
+index 95654ff..202474b 100644
 --- a/extensions/terminal-suggest/src/terminalSuggestMain.ts
 +++ b/extensions/terminal-suggest/src/terminalSuggestMain.ts
-@@ -30,2 +30,4 @@ import codeTunnelCompletionSpec from './completions/code-tunnel';
- import codeTunnelInsidersCompletionSpec from './completions/code-tunnel-insiders';
+@@ -13,2 +13,4 @@ import codeCompletionSpec from './completions/code';
+ import codeInsidersCompletionSpec from './completions/code-insiders';
 +import codiumCompletionSpec from './completions/codium';
 +import codiumInsidersCompletionSpec from './completions/codium-insiders';
- 
-@@ -50,2 +52,4 @@ export const availableSpecs: Fig.Spec[] = [
+ import codeTunnelCompletionSpec from './completions/code-tunnel';
+@@ -76,2 +78,4 @@ export const availableSpecs: Fig.Spec[] = [
  	npxCompletionSpec,
 +	codiumInsidersCompletionSpec,
 +	codiumCompletionSpec,
- 	setLocationSpec,
+ 	pnpmCompletionSpec,

patches/00-copilot-fix-action-condition.patch

@@ -0,0 +1,140 @@
+diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
+index f7d4917d..b62a8a43 100644
+--- a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
++++ b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
+@@ -1144,3 +1144,3 @@ export function registerChatActions() {
+ 				precondition: ContextKeyExpr.and(
+-					ChatContextKeys.Setup.installed,
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.disabled.negate(),
+diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
+index 04243ca9..5241910f 100644
+--- a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
++++ b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
+@@ -316,3 +316,4 @@ class AttachSelectionToChatAction extends Action2 {
+ 						ResourceContextKey.Scheme.isEqualTo(Schemas.vscodeUserData)
+-					)
++					),
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 				)
+diff --git a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
+index 7e9c73f6..03da6f20 100644
+--- a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
++++ b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
+@@ -1420,3 +1420,3 @@ configurationRegistry.registerConfiguration({
+ 			description: nls.localize('chat.disableAIFeatures', "Disable and hide built-in AI features provided by GitHub Copilot, including chat and inline suggestions."),
+-			default: false,
++			default: true,
+ 			scope: ConfigurationScope.WINDOW
+diff --git a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
+index 8ac8f531..f56d3e96 100644
+--- a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
++++ b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
+@@ -72,2 +72,3 @@ const chatViewDescriptor: IViewDescriptor = {
+ 		ContextKeyExpr.and(
++			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 			ChatContextKeys.Setup.hidden.negate(),
+diff --git a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
+index 3fa75da3..b1832fcb 100644
+--- a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
++++ b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
+@@ -232,8 +232,9 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					f1: true,
+-					precondition: ContextKeyExpr.or(
+-						ChatContextKeys.Setup.hidden,
+-						ChatContextKeys.Setup.disabledInWorkspace,
+-						ChatContextKeys.Setup.untrusted,
+-						ChatContextKeys.Setup.completed.negate(),
+-						ChatContextKeys.Entitlement.canSignUp
++					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
++						ChatContextKeys.Setup.hidden.negate(),
++						ChatContextKeys.Setup.disabledInWorkspace.negate(),
++						ChatContextKeys.Setup.untrusted.negate(),
++						ChatContextKeys.Setup.completed,
++						ChatContextKeys.Entitlement.canSignUp.negate()
+ 					)
+@@ -353,2 +354,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 						when: ContextKeyExpr.and(
++							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 							ChatContextKeys.Setup.hidden.negate(),
+@@ -385,2 +387,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 						when: ContextKeyExpr.and(
++							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 							IsWebContext.negate(),
+@@ -415,2 +418,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 						ChatContextKeys.Setup.hidden.negate(),
+@@ -472,2 +476,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 						ChatContextKeys.Setup.hidden.negate(),
+@@ -564,2 +569,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 		const internalGenerateCodeContext = ContextKeyExpr.and(
++			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 			ChatContextKeys.Setup.hidden.negate(),
+@@ -801,3 +807,7 @@ export class ChatTeardownContribution extends Disposable implements IWorkbenchCo
+ 					category: CHAT_CATEGORY,
+-					precondition: ContextKeyExpr.and(ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate()),
++					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
++						ChatContextKeys.Setup.hidden.negate(),
++						ChatContextKeys.Setup.disabledInWorkspace.negate()
++					),
+ 					menu: {
+diff --git a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
+index 2c244736..2f5023d8 100644
+--- a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
++++ b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
+@@ -43,3 +43,4 @@ const inlineChatContextKey = ContextKeyExpr.and(
+ 	EditorContextKeys.writable,
+-	EditorContextKeys.editorSimpleInput.negate()
++	EditorContextKeys.editorSimpleInput.negate(),
++	ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ );
+diff --git a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
+index dc231e44..633de730 100644
+--- a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
++++ b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
+@@ -545,3 +545,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{}]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate()),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -554,3 +554,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{}]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`)), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -563,3 +563,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{}]),
+-				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
++				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`)), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 			},
+@@ -569,3 +569,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{ showWelcome: true }]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -578,3 +578,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{ showWelcome: true }]),
+-				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
++				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 			}
+diff --git a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
+index 6bdf7f36..3bfc7d19 100644
+--- a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
++++ b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
+@@ -703,2 +703,3 @@ registerAction2(class extends Action2 {
+ 				when: ContextKeyExpr.and(
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.hidden.negate(),
+diff --git a/src/vs/workbench/contrib/scm/browser/scmInput.ts b/src/vs/workbench/contrib/scm/browser/scmInput.ts
+index 6adf03c6..38a6d42c 100644
+--- a/src/vs/workbench/contrib/scm/browser/scmInput.ts
++++ b/src/vs/workbench/contrib/scm/browser/scmInput.ts
+@@ -848,2 +848,3 @@ registerAction2(class extends Action2 {
+ 				when: ContextKeyExpr.and(
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.hidden.negate(),

patches/00-ext-github-authentication-use-pat.patch

@@ -1,18 +1,21 @@
 diff --git a/extensions/github-authentication/src/common/env.ts b/extensions/github-authentication/src/common/env.ts
-index ebc4749..18fd732 100644
+index 56cad4be..18fd7327 100644
 --- a/extensions/github-authentication/src/common/env.ts
 +++ b/extensions/github-authentication/src/common/env.ts
-@@ -7,21 +7,4 @@ import { AuthProviderType } from '../github';
+@@ -7,24 +7,4 @@ import { AuthProviderType } from '../github';
  
 -const VALID_DESKTOP_CALLBACK_SCHEMES = [
 -	'vscode',
 -	'vscode-insiders',
+-	'vscode-exploration',
+-	'vscode-agents',
+-	'vscode-agents-insiders',
+-	'vscode-agents-exploration',
 -	// On Windows, some browsers don't seem to redirect back to OSS properly.
 -	// As a result, you get stuck in the auth flow. We exclude this from the
 -	// list until we can figure out a way to fix this behavior in browsers.
 -	// 'code-oss',
 -	'vscode-wsl',
--	'vscode-exploration'
 -];
 -
 -export function isSupportedClient(uri: Uri): boolean {
@@ -26,7 +29,7 @@ index ebc4749..18fd732 100644
 +export function isSupportedClient(_uri: Uri): boolean {
 +	return false;
  }
-@@ -35,4 +18,4 @@ export function isSupportedTarget(type: AuthProviderType, gheUri?: Uri): boolean
+@@ -38,4 +18,4 @@ export function isSupportedTarget(type: AuthProviderType, gheUri?: Uri): boolean
  
 -export function isHostedGitHubEnterprise(uri: Uri): boolean {
 -	return /\.ghe\.com$/.test(uri.authority);

patches/00-ext-github-remove-vscodedev.patch

@@ -0,0 +1,187 @@
+diff --git a/extensions/github/package.json b/extensions/github/package.json
+index bce90fe..73debf7 100644
+--- a/extensions/github/package.json
++++ b/extensions/github/package.json
+@@ -45,19 +45,2 @@
+       },
+-      {
+-        "command": "github.copyVscodeDevLink",
+-        "title": "%command.copyVscodeDevLink%"
+-      },
+-      {
+-        "command": "github.copyVscodeDevLinkFile",
+-        "title": "%command.copyVscodeDevLink%"
+-      },
+-      {
+-        "command": "github.copyVscodeDevLinkWithoutRange",
+-        "title": "%command.copyVscodeDevLink%"
+-      },
+-      {
+-        "command": "github.openOnVscodeDev",
+-        "title": "%command.openOnVscodeDev%",
+-        "icon": "$(globe)"
+-      },
+       {
+@@ -83,11 +66,2 @@
+     ],
+-    "continueEditSession": [
+-      {
+-        "command": "github.openOnVscodeDev",
+-        "when": "github.hasGitHubRepo",
+-        "qualifiedName": "Continue Working in vscode.dev",
+-        "category": "Remote Repositories",
+-        "remoteGroup": "virtualfs_44_vscode-vfs_2_web@2"
+-      }
+-    ],
+     "menus": {
+@@ -110,18 +84,2 @@
+         },
+-        {
+-          "command": "github.copyVscodeDevLink",
+-          "when": "false"
+-        },
+-        {
+-          "command": "github.copyVscodeDevLinkFile",
+-          "when": "false"
+-        },
+-        {
+-          "command": "github.copyVscodeDevLinkWithoutRange",
+-          "when": "false"
+-        },
+-        {
+-          "command": "github.openOnVscodeDev",
+-          "when": "false"
+-        },
+         {
+@@ -131,42 +89,2 @@
+       ],
+-      "file/share": [
+-        {
+-          "command": "github.copyVscodeDevLinkFile",
+-          "when": "github.hasGitHubRepo && remoteName != 'codespaces'",
+-          "group": "0_vscode@0"
+-        }
+-      ],
+-      "editor/context/share": [
+-        {
+-          "command": "github.copyVscodeDevLink",
+-          "when": "github.hasGitHubRepo && resourceScheme != untitled && !isInEmbeddedEditor && remoteName != 'codespaces'",
+-          "group": "0_vscode@0"
+-        }
+-      ],
+-      "explorer/context/share": [
+-        {
+-          "command": "github.copyVscodeDevLinkWithoutRange",
+-          "when": "github.hasGitHubRepo && resourceScheme != untitled && !isInEmbeddedEditor && remoteName != 'codespaces'",
+-          "group": "0_vscode@0"
+-        }
+-      ],
+-      "editor/lineNumber/context": [
+-        {
+-          "command": "github.copyVscodeDevLink",
+-          "when": "github.hasGitHubRepo && resourceScheme != untitled && activeEditor == workbench.editors.files.textFileEditor && config.editor.lineNumbers == on && remoteName != 'codespaces'",
+-          "group": "1_cutcopypaste@2"
+-        },
+-        {
+-          "command": "github.copyVscodeDevLink",
+-          "when": "github.hasGitHubRepo && resourceScheme != untitled && activeEditor == workbench.editor.notebook && remoteName != 'codespaces'",
+-          "group": "1_cutcopypaste@2"
+-        }
+-      ],
+-      "editor/title/context/share": [
+-        {
+-          "command": "github.copyVscodeDevLinkWithoutRange",
+-          "when": "github.hasGitHubRepo && resourceScheme != untitled && remoteName != 'codespaces'",
+-          "group": "0_vscode@0"
+-        }
+-      ],
+       "scm/historyItem/context": [
+diff --git a/extensions/github/src/commands.ts b/extensions/github/src/commands.ts
+index 33acf5a..107e94a 100644
+--- a/extensions/github/src/commands.ts
++++ b/extensions/github/src/commands.ts
+@@ -9,30 +9,5 @@ import { publishRepository } from './publish.js';
+ import { DisposableStore, getRepositoryFromUrl } from './util.js';
+-import { LinkContext, getCommitLink, getLink, getVscodeDevHost } from './links.js';
++import { getCommitLink } from './links.js';
+ import { getOctokit } from './auth.js';
+ 
+-async function copyVscodeDevLink(gitAPI: GitAPI, useSelection: boolean, context: LinkContext, includeRange = true) {
+-	try {
+-		const permalink = await getLink(gitAPI, useSelection, true, getVscodeDevHost(), 'headlink', context, includeRange);
+-		if (permalink) {
+-			return vscode.env.clipboard.writeText(permalink);
+-		}
+-	} catch (err) {
+-		if (!(err instanceof vscode.CancellationError)) {
+-			vscode.window.showErrorMessage(err.message);
+-		}
+-	}
+-}
+-
+-async function openVscodeDevLink(gitAPI: GitAPI): Promise<vscode.Uri | undefined> {
+-	try {
+-		const headlink = await getLink(gitAPI, true, false, getVscodeDevHost(), 'headlink');
+-		return headlink ? vscode.Uri.parse(headlink) : undefined;
+-	} catch (err) {
+-		if (!(err instanceof vscode.CancellationError)) {
+-			vscode.window.showErrorMessage(err.message);
+-		}
+-		return undefined;
+-	}
+-}
+-
+ interface ResolvedSessionRepo {
+@@ -210,14 +185,2 @@ export function registerCommands(gitAPI: GitAPI): vscode.Disposable {
+ 
+-	disposables.add(vscode.commands.registerCommand('github.copyVscodeDevLink', async (context: LinkContext) => {
+-		return copyVscodeDevLink(gitAPI, true, context);
+-	}));
+-
+-	disposables.add(vscode.commands.registerCommand('github.copyVscodeDevLinkFile', async (context: LinkContext) => {
+-		return copyVscodeDevLink(gitAPI, false, context);
+-	}));
+-
+-	disposables.add(vscode.commands.registerCommand('github.copyVscodeDevLinkWithoutRange', async (context: LinkContext) => {
+-		return copyVscodeDevLink(gitAPI, true, context, false);
+-	}));
+-
+ 	disposables.add(vscode.commands.registerCommand('github.openOnGitHub', async (url: string, historyItemId: string) => {
+@@ -253,6 +216,2 @@ export function registerCommands(gitAPI: GitAPI): vscode.Disposable {
+ 
+-	disposables.add(vscode.commands.registerCommand('github.openOnVscodeDev', async () => {
+-		return openVscodeDevLink(gitAPI);
+-	}));
+-
+ 	disposables.add(vscode.commands.registerCommand('github.createPullRequest', async (sessionResource: vscode.Uri | undefined, sessionMetadata: { worktreePath?: string } | undefined) => {
+diff --git a/extensions/github/src/extension.ts b/extensions/github/src/extension.ts
+index 17906c5..86a0ca8 100644
+--- a/extensions/github/src/extension.ts
++++ b/extensions/github/src/extension.ts
+@@ -17,3 +17,2 @@ import { GitHubBranchProtectionProviderManager } from './branchProtection.js';
+ import { GitHubCanonicalUriProvider } from './canonicalUriProvider.js';
+-import { VscodeDevShareProvider } from './shareProviders.js';
+ import { GitHubSourceControlHistoryItemDetailsProvider } from './historyItemDetailsProvider.js';
+@@ -109,3 +108,2 @@ function initializeGitExtension(context: ExtensionContext, octokitService: Octok
+ 						disposables.add(new GitHubCanonicalUriProvider(gitAPI));
+-						disposables.add(new VscodeDevShareProvider(gitAPI));
+ 						setGitHubContext(gitAPI, disposables);
+diff --git a/extensions/github/src/remoteSourceProvider.ts b/extensions/github/src/remoteSourceProvider.ts
+index bed2bb1..2880f97 100644
+--- a/extensions/github/src/remoteSourceProvider.ts
++++ b/extensions/github/src/remoteSourceProvider.ts
+@@ -10,3 +10,3 @@ import { Octokit } from '@octokit/rest';
+ import { getRepositoryFromQuery, getRepositoryFromUrl } from './util.js';
+-import { getBranchLink, getVscodeDevHost } from './links.js';
++import { getBranchLink } from './links.js';
+ 
+@@ -137,9 +137,2 @@ export class GithubRemoteSourceProvider implements RemoteSourceProvider {
+ 			}
+-		}, {
+-			label: l10n.t('Checkout on vscode.dev'),
+-			icon: 'globe',
+-			run(branch: string) {
+-				const link = getBranchLink(url, branch, getVscodeDevHost());
+-				env.openExternal(Uri.parse(link));
+-			}
+ 		}];

patches/00-extension-disable-signature-verification.patch

@@ -1,14 +1,18 @@
 diff --git a/src/vs/platform/extensionManagement/node/extensionManagementService.ts b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
-index 680e0dd..0b04279 100644
+index 0a50a2e..5ee6782 100644
 --- a/src/vs/platform/extensionManagement/node/extensionManagementService.ts
 +++ b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
-@@ -86,2 +86,3 @@ export class ExtensionManagementService extends AbstractExtensionManagementServi
+@@ -36,3 +36,2 @@ import {
+ 	IAllowedExtensionsService,
+-	VerifyExtensionSignatureConfigKey,
+ 	shouldRequireRepositorySignatureFor,
+@@ -89,2 +88,3 @@ export class ExtensionManagementService extends AbstractExtensionManagementServi
  		@IFileService private readonly fileService: IFileService,
 +		// @ts-expect-error no-unused-variable
  		@IConfigurationService private readonly configurationService: IConfigurationService,
-@@ -347,4 +348,3 @@ export class ExtensionManagementService extends AbstractExtensionManagementServi
+@@ -333,4 +333,3 @@ export class ExtensionManagementService extends AbstractExtensionManagementServi
  		if (verifySignature) {
--			const value = this.configurationService.getValue('extensions.verifySignature');
+-			const value = this.configurationService.getValue(VerifyExtensionSignatureConfigKey);
 -			verifySignature = isBoolean(value) ? value : true;
 +			verifySignature = false;
  		}

patches/00-remote-add-missing-dependencies.patch

@@ -1,12 +1,8 @@
 diff --git a/remote/package-lock.json b/remote/package-lock.json
-index f0ed1cc..a973af3 100644
+index 30a7391..94f839a 100644
 --- a/remote/package-lock.json
 +++ b/remote/package-lock.json
-@@ -40,2 +40,3 @@
-         "tas-client-umd": "0.2.0",
-+        "tslib": "^2.6.3",
-         "vscode-oniguruma": "1.7.0",
-@@ -1109,2 +1110,8 @@
+@@ -1155,2 +1155,8 @@
      },
 +    "node_modules/tslib": {
 +      "version": "2.7.0",
@@ -16,10 +12,10 @@ index f0ed1cc..a973af3 100644
 +    },
      "node_modules/tunnel-agent": {
 diff --git a/remote/package.json b/remote/package.json
-index 33afee9..525ed07 100644
+index 119d62c..9ef9624 100644
 --- a/remote/package.json
 +++ b/remote/package.json
-@@ -35,2 +35,3 @@
-     "tas-client-umd": "0.2.0",
+@@ -37,2 +37,3 @@
+     "tas-client": "0.3.1",
 +    "tslib": "^2.6.3",
      "vscode-oniguruma": "1.7.0",