feat: add cooldown setting to update (#2799)

.github/dependabot.yml

@@ -1,12 +1,9 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: github-actions
+    directory: /
     target-branch: insider
     schedule:
-      interval: "weekly"
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci-build-linux.yml

@@ -0,0 +1,371 @@
+name: CI - Build - Linux
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  DISABLE_UPDATE: yes
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: linux
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: ubuntu-22.04
+    env:
+      VSCODE_ARCH: x64
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+          image: vscodium/vscodium-linux-build-agent:focal-x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+          image: vscodium/vscodium-linux-build-agent:focal-arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+          image: vscodium/vscodium-linux-build-agent:focal-armhf
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+          image: vscodium/vscodium-linux-build-agent:focal-riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+          image: vscodium/vscodium-linux-build-agent:crimson-loong64
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+          image: vscodium/vscodium-linux-build-agent:focal-ppc64le
+    container:
+      image: ${{ matrix.image }}
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_APP_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Install dependencies
+        run: ./build/linux/deps.sh
+        if: env.DISABLED != 'yes'
+
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes'
+
+      - name: Build
+        id: build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_bin.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Prepare assets
+        env:
+          SHOULD_BUILD_APPIMAGE: ${{ vars[format('DISABLE_{0}_APPIMAGE', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] == 'yes' && 'no' || 'yes' }}
+          SHOULD_BUILD_REH: 'no'
+          SHOULD_BUILD_REH_WEB: 'no'
+          VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}
+          VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
+          VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
+        run: ./prepare_assets.sh
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_linux:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+        - slug: ARM32
+          vscode_arch: armhf
+          npm_arch: arm
+        - slug: PPC64
+          vscode_arch: ppc64le
+          npm_arch: ppc64
+        - slug: RISCV64
+          vscode_arch: riscv64
+          npm_arch: riscv64
+        - slug: LOONG64
+          vscode_arch: loong64
+          npm_arch: loong64
+        - slug: S390X
+          vscode_arch: s390x
+          npm_arch: s390x
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_LINUX_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+        if: env.DISABLED != 'yes'
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+        if: env.DISABLED != 'yes'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.DISABLED != 'yes'
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+        if: env.DISABLED != 'yes'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+        if: env.DISABLED != 'yes'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/linux/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-linux-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'
+
+  reh_alpine:
+    needs:
+      - compile
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - slug: X64
+          vscode_arch: x64
+          npm_arch: x64
+        - slug: ARM64
+          vscode_arch: arm64
+          npm_arch: arm64
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      DISABLED: ${{ vars[format('DISABLE_{0}_ALPINE_REH_{1}', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'), matrix.slug)] }}
+      MS_COMMIT: ${{ needs.compile.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.compile.outputs.MS_TAG }}
+      OS_NAME: alpine
+      RELEASE_VERSION: ${{ needs.compile.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup GCC
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
+        with:
+          version: 10
+          platform: x64
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Install GH
+        run: ./build/linux/install_gh.sh
+
+      - name: Install libkrb5-dev
+        run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.npm_arch }}
+        run: ./build/alpine/package_reh.sh
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: reh-alpine-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.DISABLED != 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-macos.yml

@@ -0,0 +1,90 @@
+name: CI - Build - macOS
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ${{ matrix.runner }}
+    env:
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-intel
+            vscode_arch: x64
+          - runner: [self-hosted, macOS, ARM64]
+            vscode_arch: arm64
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: . get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+        if: env.VSCODE_ARCH == 'x64'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.generate_assets == 'true'

.github/workflows/ci-build-windows.yml

@@ -0,0 +1,164 @@
+name: CI - Build - Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      generate_assets:
+        type: boolean
+        description: Generate assets
+      checkout_pr:
+        type: string
+        description: Checkout PR
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+env:
+  APP_NAME: VSCodium
+  BINARY_NAME: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'codium-insiders' || 'codium' }}
+  GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.head }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: windows
+  VSCODE_QUALITY: ${{ (github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'insider' || 'stable' }}
+
+permissions: {}
+
+jobs:
+  compile:
+    runs-on: windows-2022
+    defaults:
+      run:
+        shell: bash
+    env:
+      VSCODE_ARCH: 'x64'
+    outputs:
+      BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Clone VSCode repo
+        run: ./get_repo.sh
+
+      - name: Build
+        env:
+          SHOULD_BUILD: yes
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
+        run: ./build.sh
+
+      - name: Compress vscode artifact
+        run: |
+          find vscode -type f -not -path "*/node_modules/*" -not -path "vscode/.build/node/*" -not -path "vscode/.git/*" > vscode.txt
+          echo "vscode/.build/extensions/node_modules" >> vscode.txt
+          echo "vscode/.git" >> vscode.txt
+          tar -czf vscode.tar.gz -T vscode.txt
+
+      - name: Upload vscode artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vscode
+          path: ./vscode.tar.gz
+          retention-days: 1
+
+  build:
+    needs:
+      - compile
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        vscode_arch:
+          - x64
+          - arm64
+    defaults:
+      run:
+        shell: bash
+    env:
+      BUILD_SOURCEVERSION: ${{ needs.compile.outputs.BUILD_SOURCEVERSION }}
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
+    outputs:
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
+
+      - name: Switch to relevant branch
+        env:
+          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
+        run: ./get_pr.sh
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python 3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+
+      - name: Download vscode artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vscode
+
+      - name: Build
+        env:
+          DISABLE_MSI: ${{ vars[format('DISABLE_{0}_MSI', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_arch: ${{ matrix.vscode_arch }}
+          npm_config_target_arch: ${{ matrix.vscode_arch }}
+        run: ./build/windows/package.sh
+
+      - name: Prepare assets
+        run: ./prepare_assets.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Prepare checksums
+        run: ./prepare_checksums.sh
+        if: github.event.inputs.generate_assets == 'true'
+
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bin-${{ matrix.vscode_arch }}
+          path: assets/
+          retention-days: 3
+        if: github.event.inputs.generate_assets == 'true'

.github/workflows/insider-spearhead.yml

@@ -1,98 +0,0 @@
-name: insider-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-      dont_dispatch:
-        type: boolean
-        description: Disable dispatch
-  schedule:
-    - cron: '0 7 * * *'
-
-jobs:
-  build:
-    runs-on: macos-15
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}-insiders
-      BINARY_NAME: codium-insiders
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: insider
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: insider
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload sourcemaps
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./upload_sourcemaps.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v4
-        with:
-          event-type: insider
-        if: github.event.inputs.dont_dispatch != 'true' && (env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true')

.github/workflows/lint-zizmor.yml

@@ -0,0 +1,30 @@
+name: Lint - zizmor
+
+on:
+  push:
+    branches:
+      - master
+      - insider
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches:
+      - "**"
+    paths-ignore:
+      - "**/*.md"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

.github/workflows/lock.yml

@@ -1,17 +0,0 @@
-name: Lock Closed Threads
-
-on:
-  schedule:
-    - cron: '0 2 * * *'
-
-jobs:
-  lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/lock-threads@v6
-        with:
-          github-token: ${{ github.token }}
-          issue-inactive-days: '90'
-          pr-inactive-days: '90'
-          discussion-inactive-days: '90'
-          log-output: true

.github/workflows/mod-lock-closed-threads.yml

@@ -0,0 +1,22 @@
+name: Moderation - Lock Closed Threads
+
+on:
+  schedule:
+    - cron: 0 2 * * *
+
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: "90"
+          pr-inactive-days: "90"
+          discussion-inactive-days: "90"
+          log-output: true

.github/workflows/mod-stale-issue-pr.yml

@@ -0,0 +1,24 @@
+name: Moderation - Stale Issues & PR
+
+on:
+  schedule:
+    - cron: 0 1 * * *
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          days-before-stale: 90
+          days-before-close: 30
+          operations-per-run: 1024
+          stale-issue-message: This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
+          close-issue-message: This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
+          exempt-issue-labels: discussion,never-stale
+          stale-pr-message: This PR has been automatically marked as stale.
+          close-pr-message: This PR has been closed due to inactivity, and will not be monitored.
+          only-pr-labels: needs-information

.github/workflows/publish-insider-linux.yml

@@ -1,37 +1,19 @@
-name: insider-linux
+name: Publish - Insider - Linux
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [insider]
-  push:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-insider
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -40,77 +22,66 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -123,8 +94,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +108,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +120,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -185,29 +159,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -221,11 +188,11 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
@@ -246,36 +213,30 @@ jobs:
           VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
           VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -308,37 +269,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -349,7 +304,7 @@ jobs:
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -359,38 +314,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -409,34 +359,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -449,45 +393,38 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium-insiders-bin
         - package_name: vscodium-insiders
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
 
     steps:
       - name: Get version
@@ -496,7 +433,7 @@ jobs:
         run: echo "PACKAGE_VERSION=${RELEASE_VERSION/-*/}" >> "${GITHUB_ENV}"
 
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_version: ${{ env.PACKAGE_VERSION }}
@@ -509,6 +446,9 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium-insiders
@@ -518,21 +458,17 @@ jobs:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_INSIDER_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
-      - uses: docker/setup-qemu-action@v4
-
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
         with:
           path: stores/snapcraft/insider
           architecture: ${{ matrix.platform }}
@@ -543,7 +479,7 @@ jobs:
       #     snap: ${{ steps.build.outputs.snap }}
       #     isClassic: 'true'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -555,11 +491,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-insider-macos.yml

@@ -1,35 +1,17 @@
-name: insider-macos
+name: Publish - Insider - macOS
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [insider]
-  push:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-insider
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,6 +20,9 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
@@ -50,39 +35,29 @@ jobs:
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
+          persist-credentials: false
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -98,30 +73,21 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-insider-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Insider - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 7 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}-insiders
+  BINARY_NAME: codium-insiders
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: insider
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: insider
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-insider
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-insider-windows.yml

@@ -1,35 +1,17 @@
-name: insider-windows
+name: Publish - Insider - Windows
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [insider]
-  push:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ insider ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-insider
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}-insiders
   BINARY_NAME: codium-insiders
-  GITHUB_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || 'insider' }}
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: insider
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -38,41 +20,33 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: windows-2022
+    permissions: {}
     defaults:
       run:
         shell: bash
@@ -80,52 +54,38 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      # - name: Setup GCC
-      #   uses: egor-tensin/setup-gcc@v1
-      #   with:
-      #     version: 10
-      #     platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
-      # - name: Install libkrb5-dev
-      #   run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
-      #   if: env.SHOULD_BUILD == 'yes'
-
       - name: Clone VSCode repo
         run: ./get_repo.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -138,11 +98,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -150,6 +110,9 @@ jobs:
       - check
       - compile
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -164,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -203,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -218,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -242,52 +198,46 @@ jobs:
           artifact-configuration-slug: ${{ matrix.vscode_arch }}
           wait-for-completion: true
           # 3h to manually approve the request
-          wait-for-completion-timeout-in-seconds: 10800
+          wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes' && vars.DISABLE_INSIDER_WINDOWS_SIGNING != 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
   winget:
     needs: build
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium.Insiders
       ASSETS_REPOSITORY: vscodium-insiders
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -295,7 +245,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/publish-stable-linux.yml

@@ -1,39 +1,19 @@
-name: stable-linux
+name: Publish - Stable - Linux
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      force_snap:
-        type: boolean
-        description: Force Snap
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [stable]
-  push:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-stable
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
-  DISABLE_UPDATE: 'yes'
+  DISABLE_UPDATE: yes
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: linux
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -42,35 +22,26 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
           FORCE_LINUX_SNAP: ${{ github.event.inputs.force_snap }}
         run: ./check_tags.sh
 
@@ -78,44 +49,40 @@ jobs:
     needs:
       - check
     runs-on: ubuntu-22.04
+    permissions: {}
     env:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Install libkrb5-dev
@@ -128,8 +95,8 @@ jobs:
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -142,11 +109,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -154,6 +121,9 @@ jobs:
       - check
       - compile
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -190,29 +160,22 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-        if: env.DISABLED != 'yes'
-
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -226,11 +189,11 @@ jobs:
         run: ./build/linux/deps.sh
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
@@ -251,36 +214,30 @@ jobs:
           VSCODE_SYSROOT_VERSION: ${{ steps.build.outputs.VSCODE_SYSROOT_VERSION }}
           VSCODE_SYSROOT_PREFIX: ${{ steps.build.outputs.VSCODE_SYSROOT_PREFIX }}
         run: ./prepare_assets.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes'
 
   reh_linux:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -313,37 +270,31 @@ jobs:
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.DISABLED != 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.DISABLED != 'yes'
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
         if: env.DISABLED != 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.DISABLED != 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.DISABLED != 'yes'
@@ -354,7 +305,7 @@ jobs:
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.DISABLED != 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -364,38 +315,33 @@ jobs:
         if: env.DISABLED != 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/linux/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-linux-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   reh_alpine:
     needs:
       - check
       - compile
     runs-on: ubuntu-22.04
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -414,34 +360,28 @@ jobs:
       OS_NAME: alpine
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
-    if: needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true'
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Setup GCC
-        uses: egor-tensin/setup-gcc@v2
+        uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
         with:
           version: 10
           platform: x64
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Install GH
         run: ./build/linux/install_gh.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Check existing VSCodium tags/releases
         env:
@@ -454,51 +394,42 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.npm_arch }}
         run: ./build/alpine/package_reh.sh
-        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no' || github.event.inputs.generate_assets == 'true')
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./release.sh
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: reh-alpine-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.DISABLED != 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
   aur:
     needs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         include:
         - package_name: vscodium
           package_type: stable
-        # - package_name: vscodium-git
-        #   package_type: rolling
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
       - name: Publish ${{ matrix.package_name }}
-        uses: zokugun/github-actions-aur-releaser@v1
+        uses: zokugun/github-actions-aur-releaser@4348c8a4124434a85d0a5e7457d0ef4079dab490 # v1
         with:
           package_name: ${{ matrix.package_name }}
           package_type: ${{ matrix.package_type }}
@@ -511,6 +442,8 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
+    environment: publish
+    permissions: {}
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium
@@ -521,17 +454,13 @@ jobs:
         platform:
         - amd64
         - arm64
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
+    if: needs.check.outputs.SHOULD_BUILD_SNAP != 'no' && vars.DISABLE_STABLE_SNAP != 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Check version
         env:
@@ -541,23 +470,21 @@ jobs:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         run: ./stores/snapcraft/check_version.sh
 
-      - uses: docker/setup-qemu-action@v4
-        if: env.SHOULD_BUILD == 'yes'
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
-      - uses: diddlesnaps/snapcraft-multiarch-action@v1
+      - uses: diddlesnaps/snapcraft-multiarch-action@cfd7a246fad6bea65bb92f69a1c8d07898c231e5 # v1.9.0
         with:
           path: stores/snapcraft/stable
           architecture: ${{ matrix.platform }}
         id: build
-        if: env.SHOULD_BUILD == 'yes'
 
-      - uses: diddlesnaps/snapcraft-review-action@v1
+      - uses: diddlesnaps/snapcraft-review-action@40554b42331cf84dab19ef98c382620427f13482 # v1.3.1
         with:
           snap: ${{ steps.build.outputs.snap }}
           isClassic: 'true'
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes' || env.SHOULD_DEPLOY_TO_STORE == 'yes'
 
-      - uses: svenstaro/upload-release-action@v2
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -565,7 +492,7 @@ jobs:
           tag: ${{ env.RELEASE_VERSION }}
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes'
 
-      - uses: snapcore/action-publish@master
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         with:
@@ -578,7 +505,8 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
@@ -591,11 +519,12 @@ jobs:
       - check
       - build
     runs-on: ubuntu-latest
-    if: needs.check.outputs.SHOULD_DEPLOY == 'yes' && github.event.inputs.generate_assets != 'true'
+    environment: publish
+    permissions: {}
 
     steps:
       - name: Trigger repository rebuild
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           repository: VSCodium/repositories-linux

.github/workflows/publish-stable-macos.yml

@@ -1,34 +1,17 @@
-name: stable-macos
+name: Publish - Stable - macOS
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [stable]
-  push:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-stable
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: osx
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,6 +20,9 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
+    environment: publish
+    permissions:
+      contents: write
     env:
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     strategy:
@@ -49,39 +35,29 @@ jobs:
             vscode_arch: arm64
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: . get_pr.sh
+          persist-credentials: false
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.VSCODE_ARCH == 'x64'
 
       - name: Clone VSCode repo
         run: . get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: . check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: . check_tags.sh
-        if: env.SHOULD_DEPLOY == 'yes'
 
       - name: Build
         env:
@@ -97,29 +73,20 @@ jobs:
           CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
           CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_NEW_TEAM_ID }}
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Clean up keychain
         if: always()

.github/workflows/publish-stable-spearhead.yml

@@ -0,0 +1,122 @@
+name: Publish - Stable - Spearhead
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_release:
+        type: boolean
+        description: Force new Release
+      dont_update:
+        type: boolean
+        description: Don't update VSCode
+      dont_dispatch:
+        type: boolean
+        description: Disable dispatch
+  schedule:
+    - cron: 0 18 * * *
+
+env:
+  APP_NAME: VSCodium
+  ASSETS_REPOSITORY: ${{ github.repository }}
+  BINARY_NAME: codium
+  GH_REPO_PATH: ${{ github.repository }}
+  ORG_NAME: ${{ github.repository_owner }}
+  OS_NAME: osx
+  SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
+  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
+  VSCODE_ARCH: arm64
+  VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
+  VSCODE_QUALITY: stable
+
+jobs:
+  check:
+    runs-on: macos-15
+    permissions: {}
+    outputs:
+      MS_COMMIT: ${{ env.MS_COMMIT }}
+      MS_TAG: ${{ env.MS_TAG }}
+      RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Check existing VSCodium tags/releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEW_RELEASE: ${{ github.event.inputs.new_release }}
+          IS_SPEARHEAD: 'yes'
+        run: . check_tags.sh
+
+  build:
+    needs:
+      - check
+    runs-on: macos-15
+    environment: publish
+    permissions:
+      contents: write   # Release
+    env:
+      MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
+      MS_TAG: ${{ needs.check.outputs.MS_TAG }}
+      RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+    if: needs.check.outputs.SHOULD_BUILD == 'yes'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          persist-credentials: false
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Clone VSCode repo
+        run: . get_repo.sh
+
+      - name: Build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build.sh
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Update upstream version
+        run: ./update_upstream.sh
+        if: github.event.inputs.dont_update != 'true'
+
+      - name: Prepare source
+        run: ./prepare_src.sh
+
+      - name: Upload sourcemaps
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./upload_sourcemaps.sh
+
+      - name: Release source
+        env:
+          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          GITHUB_USERNAME: ${{ github.repository_owner }}
+        run: ./release.sh
+
+      - name: Dispatch builds
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          event-type: publish-stable
+        if: github.event.inputs.dont_dispatch != 'true'

.github/workflows/publish-stable-windows.yml

@@ -1,34 +1,17 @@
-name: stable-windows
+name: Publish - Stable - Windows
 
 on:
-  workflow_dispatch:
-    inputs:
-      force_version:
-        type: boolean
-        description: Force update version
-      generate_assets:
-        type: boolean
-        description: Generate assets
-      checkout_pr:
-        type: string
-        description: Checkout PR
+  workflow_dispatch: {}
   repository_dispatch:
-    types: [stable]
-  push:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
-    - 'upstream/*.json'
-  pull_request:
-    branches: [ master ]
-    paths-ignore:
-    - '**/*.md'
+    types:
+      - publish-stable
 
 env:
   APP_NAME: VSCodium
   ASSETS_REPOSITORY: ${{ github.repository }}
   BINARY_NAME: codium
   GH_REPO_PATH: ${{ github.repository }}
+  GITHUB_BRANCH: master
   ORG_NAME: ${{ github.repository_owner }}
   OS_NAME: windows
   VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
@@ -37,41 +20,33 @@ env:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
       SHOULD_BUILD: ${{ env.SHOULD_BUILD }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
 
       - name: Clone VSCode repo
         run: ./get_repo.sh
 
-      - name: Check PR or cron
-        env:
-          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
-        run: ./check_cron_or_pr.sh
-
       - name: Check existing VSCodium tags/releases
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_ALL: 'yes'
+          CHECK_ALL: yes
         run: ./check_tags.sh
 
   compile:
     needs:
       - check
     runs-on: windows-2022
+    permissions: {}
     defaults:
       run:
         shell: bash
@@ -79,52 +54,38 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      VSCODE_ARCH: 'x64'
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
+      VSCODE_ARCH: x64
     outputs:
       BUILD_SOURCEVERSION: ${{ env.BUILD_SOURCEVERSION }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
-
-      # - name: Setup GCC
-      #   uses: egor-tensin/setup-gcc@v1
-      #   with:
-      #     version: 10
-      #     platform: x64
-
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
         if: env.SHOULD_BUILD == 'yes'
 
-      # - name: Install libkrb5-dev
-      #   run: sudo apt-get update -y && sudo apt-get install -y libkrb5-dev
-      #   if: env.SHOULD_BUILD == 'yes'
-
       - name: Clone VSCode repo
         run: ./get_repo.sh
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Build
         env:
-          SHOULD_BUILD_REH: 'no'
-          SHOULD_BUILD_REH_WEB: 'no'
+          SHOULD_BUILD_REH: no
+          SHOULD_BUILD_REH_WEB: no
         run: ./build.sh
         if: env.SHOULD_BUILD == 'yes'
 
@@ -137,11 +98,11 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload vscode artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vscode
           path: ./vscode.tar.gz
-          retention-days: ${{ needs.check.outputs.SHOULD_DEPLOY == 'yes' && 30 || 1 }}
+          retention-days: 30
         if: env.SHOULD_BUILD == 'yes'
 
   build:
@@ -149,6 +110,9 @@ jobs:
       - check
       - compile
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -163,33 +127,26 @@ jobs:
       MS_COMMIT: ${{ needs.check.outputs.MS_COMMIT }}
       MS_TAG: ${{ needs.check.outputs.MS_TAG }}
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
-      SHOULD_BUILD: ${{ (needs.check.outputs.SHOULD_BUILD == 'yes' || github.event.inputs.generate_assets == 'true') && 'yes' || 'no' }}
-      SHOULD_DEPLOY: ${{ needs.check.outputs.SHOULD_DEPLOY }}
+      SHOULD_BUILD: ${{ needs.check.outputs.SHOULD_BUILD }}
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
     outputs:
       RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
-      SHOULD_DEPLOY: ${{ env.SHOULD_DEPLOY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Switch to relevant branch
-        env:
-          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
-        run: ./get_pr.sh
+          persist-credentials: false
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version-file: '.nvmrc'
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Setup Python 3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
         if: env.SHOULD_BUILD == 'yes'
@@ -202,7 +159,7 @@ jobs:
         if: env.SHOULD_BUILD == 'yes'
 
       - name: Download vscode artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode
         if: env.SHOULD_BUILD == 'yes'
@@ -217,21 +174,21 @@ jobs:
 
       - name: Prepare assets
         run: ./prepare_assets.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Upload unsigned artifacts
         id: upload-unsigned-artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unsigned-${{ matrix.vscode_arch }}
           path: |
             assets/*.exe
             assets/*.msi
           retention-days: 1
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Signing
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -243,48 +200,42 @@ jobs:
           # 8h to manually approve the request
           wait-for-completion-timeout-in-seconds: 28800
           output-artifact-directory: assets/
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Prepare checksums
         run: ./prepare_checksums.sh
-        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
+        if: env.SHOULD_BUILD == 'yes'
 
       - name: Update versions repo
         env:
-          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
         run: ./update_version.sh
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
-
-      - name: Upload assets
-        uses: actions/upload-artifact@v7
-        with:
-          name: bin-${{ matrix.vscode_arch }}
-          path: assets/
-          retention-days: 3
-        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true'
+        if: env.SHOULD_BUILD == 'yes'
 
   winget:
     needs: build
     runs-on: windows-2022
+    environment: publish
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash
     env:
       APP_IDENTIFIER: VSCodium.VSCodium
-    if: needs.build.outputs.SHOULD_DEPLOY == 'yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.GITHUB_BRANCH }}
+          persist-credentials: false
 
       - name: Check version
         run: ./stores/winget/check_version.sh
@@ -292,7 +243,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@main
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}

.github/workflows/stable-spearhead.yml

@@ -1,93 +0,0 @@
-name: stable-spearhead
-
-on:
-  workflow_dispatch:
-    inputs:
-      new_release:
-        type: boolean
-        description: Force new Release
-      force_dispatch:
-        type: boolean
-        description: Force dispatch
-      dont_update:
-        type: boolean
-        description: Don't update VSCode
-  schedule:
-    - cron: '0 18 * * *'
-
-jobs:
-  build:
-    runs-on: macos-15
-    env:
-      APP_NAME: VSCodium
-      ASSETS_REPOSITORY: ${{ github.repository }}
-      BINARY_NAME: codium
-      GH_REPO_PATH: ${{ github.repository }}
-      ORG_NAME: ${{ github.repository_owner }}
-      OS_NAME: osx
-      SOURCEMAPS_REPOSITORY: ${{ github.repository_owner }}/sourcemaps
-      VERSIONS_REPOSITORY: ${{ github.repository_owner }}/versions
-      VSCODE_ARCH: arm64
-      VSCODE_LATEST: ${{ github.event.inputs.dont_update == 'true' && 'no' || 'yes' }}
-      VSCODE_QUALITY: stable
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup Node.js environment
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Clone VSCode repo
-        run: . get_repo.sh
-
-      - name: Check existing VSCodium tags/releases
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_RELEASE: ${{ github.event.inputs.new_release }}
-          IS_SPEARHEAD: 'yes'
-        run: . check_tags.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./build.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Update upstream version
-        run: ./update_upstream.sh
-        if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
-
-      - name: Prepare source
-        run: ./prepare_src.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Upload sourcemaps
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./upload_sourcemaps.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Release source
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
-        run: ./release.sh
-        if: env.SHOULD_BUILD == 'yes'
-
-      - name: Dispatch builds
-        uses: peter-evans/repository-dispatch@v4
-        with:
-          event-type: stable
-        if: env.SHOULD_BUILD == 'yes' || github.event.inputs.force_dispatch == 'true'

.github/workflows/stale.yml

@@ -1,25 +0,0 @@
-name: Stale Issues
-
-on:
-  schedule:
-    - cron: '0 1 * * *'
-
-permissions:
-  issues: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v10
-        with:
-          days-before-stale: 180
-          days-before-close: 30
-          stale-issue-label: stale
-          operations-per-run: 1024
-          stale-issue-message: >
-            This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment**, and we'll keep it open. If you have any new additional information, please include it with your comment!
-          close-issue-message: >
-            This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue, please open a new issue.
-          exempt-issue-labels: discussion,never-stale
-          only-pr-labels: needs-information

.nvmrc

@@ -1 +1 @@
-22.22.0
+22.22.1

build.sh

@@ -13,14 +13,9 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
   cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
   export NODE_OPTIONS="--max-old-space-size=8192"
+  export VSCODE_PUBLISH_COUNTER=1
 
-  npm run monaco-compile-check
-  npm run valid-layers-check
-
-  npm run gulp compile-build-without-mangling
-  npm run gulp compile-extension-media
-  npm run gulp compile-extensions-build
-  npm run gulp minify-vscode
+  npm run gulp vscode-min-prepack
 
   if [[ "${OS_NAME}" == "osx" ]]; then
     # remove win32 node modules
@@ -30,7 +25,7 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
     npm run copy-policy-dto --prefix build
     node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc darwin
 
-    npm run gulp "vscode-darwin-${VSCODE_ARCH}-min-ci"
+    npm run gulp "vscode-darwin-${VSCODE_ARCH}-min-packing"
 
     find "../VSCode-darwin-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 
@@ -46,7 +41,7 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
       npm run copy-policy-dto --prefix build
       node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc win32
 
-      npm run gulp "vscode-win32-${VSCODE_ARCH}-min-ci"
+      npm run gulp "vscode-win32-${VSCODE_ARCH}-min-packing"
 
       if [[ "${VSCODE_ARCH}" != "x64" ]]; then
         SHOULD_BUILD_REH="no"
@@ -67,7 +62,7 @@ if [[ "${SHOULD_BUILD}" == "yes" ]]; then
       npm run copy-policy-dto --prefix build
       node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc linux
 
-      npm run gulp "vscode-linux-${VSCODE_ARCH}-min-ci"
+      npm run gulp "vscode-linux-${VSCODE_ARCH}-min-packing"
 
       find "../VSCode-linux-${VSCODE_ARCH}" -print0 | xargs -0 touch -c
 

build/linux/package_bin.sh

@@ -7,6 +7,9 @@ if [[ "${CI_BUILD}" == "no" ]]; then
   exit 1
 fi
 
+npm -v
+node -v
+
 # include common functions
 . ./utils.sh
 
@@ -136,7 +139,7 @@ find .build/extensions -type f -name '*.node' -print -delete
 npm run copy-policy-dto --prefix build
 node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc linux
 
-npm run gulp "vscode-linux-${VSCODE_ARCH}-min-ci"
+npm run gulp "vscode-linux-${VSCODE_ARCH}-min-packing"
 
 if [[ -f "../build/linux/${VSCODE_ARCH}/ripgrep.sh" ]]; then
   bash "../build/linux/${VSCODE_ARCH}/ripgrep.sh" "../VSCode-linux-${VSCODE_ARCH}/resources/app/node_modules"

build/windows/package.sh

@@ -31,7 +31,7 @@ find .build/extensions -type f -name '*.node' -print -delete
 npm run copy-policy-dto --prefix build
 node build/lib/policies/policyGenerator.ts build/lib/policies/policyData.jsonc win32
 
-npm run gulp "vscode-win32-${VSCODE_ARCH}-min-ci"
+npm run gulp "vscode-win32-${VSCODE_ARCH}-min-packing"
 
 . ../build_cli.sh
 

dev/patch.sh

@@ -30,19 +30,63 @@ normalize_file "${1}"
 if [[ "${FILE}" != "../patches/helper/settings.patch" ]]; then
   git apply --reject "../patches/helper/settings.patch"
 
-  while [ $# -gt 1 ]; do
-    echo "Parameter: $1"
+  if [[ $# -gt 1 ]]; then
+    while [ $# -gt 1 ]; do
+      echo "Parameter: $1"
+      normalize_file "${1}"
+
+      git apply --reject "${FILE}"
+
+      shift
+    done
+
+    git add .
+    git commit --no-verify -q -m "VSCODIUM HELPER"
+
+    normalize_file "${1}"
+  else
     normalize_file "${1}"
 
-    git apply --reject "${FILE}"
+    BASENAME=$(basename "${FILE}")
+    DIRNAME=$(dirname "${FILE}")
 
-    shift
-  done
+    if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+      GROUP_ID="${BASH_REMATCH[1]}"
+      INDEX="${BASH_REMATCH[2]}"
+      ENDNAME="${BASH_REMATCH[3]}"
 
-  git add .
-  git commit --no-verify -q -m "VSCODIUM HELPER"
+      for ((I = 0; I < INDEX; I++)); do
+        NOT_FOUND=1
 
-  normalize_file "${1}"
+        for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+          if [[ -f "$CANDIDATE" ]]; then
+            echo "Candidate: ${CANDIDATE}"
+            normalize_file "${CANDIDATE}"
+
+            git apply --reject "${FILE}"
+
+            NOT_FOUND=0
+          fi
+        done
+
+        if (( $NOT_FOUND )); then
+          for CANDIDATE in "${DIRNAME}/../${GROUP_ID}${I}-"*.patch; do
+            if [[ -f "$CANDIDATE" ]]; then
+              echo "Candidate: ${CANDIDATE}"
+              normalize_file "${CANDIDATE}"
+
+              git apply --reject "${FILE}"
+            fi
+          done
+        fi
+      done
+
+      git add .
+      git commit --no-verify -q -m "VSCODIUM HELPER"
+
+      normalize_file "${1}"
+    fi
+  fi
 fi
 
 echo "FILE: ${FILE}"

dev/update_patches.sh

@@ -119,6 +119,7 @@ check_file() {
       fi
 
       while [[ -n "$( find . -name '*.rej' -print )" ]]; do
+        echo "patch: ${1}"
         find . -name '*.rej' -print
         read -rp "Press any key when the conflict have been resolved..." -n1 -s
         echo
@@ -144,8 +145,26 @@ while [[ -n "$( git log -1 | grep "VSCODIUM HELPER" )" ]]; do
 done
 
 for FILE in ../patches/*.patch; do
-  if [[ "${FILE}" == *"/fix-policies.patch" ]]; then
-    check_file "../patches/fix-keymap.patch" "../patches/fix-policies.patch"
+  ADDITIONAL_FILES=()
+  BASENAME=$(basename "${FILE}")
+  DIRNAME=$(dirname "${FILE}")
+
+  if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+    GROUP_ID="${BASH_REMATCH[1]}"
+    INDEX="${BASH_REMATCH[2]}"
+    ENDNAME="${BASH_REMATCH[3]}"
+
+    for ((I = 0; I < INDEX; I++)); do
+      for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+        if [[ -f "$CANDIDATE" ]]; then
+          ADDITIONAL_FILES+=("$CANDIDATE")
+        fi
+      done
+    done
+  fi
+
+  if [[ ${#ADDITIONAL_FILES[@]} -gt 0 ]]; then
+    check_file ${ADDITIONAL_FILES[@]} "${FILE}"
   else
     check_file "${FILE}"
   fi
@@ -159,25 +178,44 @@ fi
 
 for ARCH in alpine linux osx windows; do
   for FILE in "../patches/${ARCH}/"*.patch; do
-    if [[ "${ARCH}" == "linux" && "${FILE}" == *"/arch-"* ]] || [[ "${ARCH}" == "linux" && "${FILE}" == *"/fix-dependencies.patch" ]] || [[ "${ARCH}" == "windows" && "${FILE}" == *"/cli"* ]]; then
-      echo "skip ${FILE}"
+    ADDITIONAL_FILES=()
+    BASENAME=$(basename "${FILE}")
+    DIRNAME=$(dirname "${FILE}")
+
+    if [[ "${BASENAME}" =~ ^([0-9])([1-9])(-.*)\.patch$ ]]; then
+      GROUP_ID="${BASH_REMATCH[1]}"
+      INDEX="${BASH_REMATCH[2]}"
+      ENDNAME="${BASH_REMATCH[3]}"
+
+      for ((I = 0; I < INDEX; I++)); do
+        NOT_FOUND=1
+
+        for CANDIDATE in "${DIRNAME}/${GROUP_ID}${I}-"*.patch; do
+          if [[ -f "$CANDIDATE" ]]; then
+            ADDITIONAL_FILES+=("$CANDIDATE")
+            NOT_FOUND=0
+          fi
+        done
+
+        if (( $NOT_FOUND )); then
+          for CANDIDATE in "${DIRNAME}/../${GROUP_ID}${I}-"*.patch; do
+            if [[ -f "$CANDIDATE" ]]; then
+              ADDITIONAL_FILES+=("$CANDIDATE")
+            fi
+          done
+        fi
+      done
+
+      if [[ ${#ADDITIONAL_FILES[@]} -gt 0 ]]; then
+        check_file ${ADDITIONAL_FILES[@]} "${FILE}"
+      else
+        check_file "${FILE}"
+      fi
     else
       check_file "${FILE}"
     fi
   done
 
-  if [[ "${ARCH}" == "linux" ]]; then
-    check_file "../patches/optional-tree-sitter.patch" "../patches/linux/fix-dependencies.patch"
-
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch" "../patches/linux/arch-3-loong64.patch"
-    check_file "../patches/cli.patch" "../patches/linux/arch-0-support.patch" "../patches/linux/arch-1-ppc64le.patch" "../patches/linux/arch-2-riscv64.patch" "../patches/linux/arch-3-loong64.patch" "../patches/linux/arch-4-s390x.patch"
-  elif [[ "${ARCH}" == "windows" ]]; then
-    check_file "../patches/cli.patch" "../patches/windows/cli.patch"
-  fi
-
   for TARGET in client reh; do
     for FILE in "../patches/${ARCH}/${TARGET}/"*.patch; do
       check_file "${FILE}"

justfile

@@ -0,0 +1,10 @@
+set shell := ["bash", "-uc"]
+
+ci-lint:
+	zizmor .
+
+ci-lint-fix:
+  zizmor . --fix=all
+
+ci-update:
+	PINACT_MIN_AGE=7 pinact run

patches/00-build-disable-esbuild.patch

@@ -0,0 +1,8 @@
+diff --git a/build/buildConfig.ts b/build/buildConfig.ts
+index a4299d26..a815dd51 100644
+--- a/build/buildConfig.ts
++++ b/build/buildConfig.ts
+@@ -11,2 +11,2 @@
+  */
+-export const useEsbuildTranspile = true;
++export const useEsbuildTranspile = false;

patches/00-copilot-fix-action-condition.patch

@@ -0,0 +1,140 @@
+diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
+index f7d4917d..b62a8a43 100644
+--- a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
++++ b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
+@@ -1144,3 +1144,3 @@ export function registerChatActions() {
+ 				precondition: ContextKeyExpr.and(
+-					ChatContextKeys.Setup.installed,
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.disabled.negate(),
+diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
+index 04243ca9..5241910f 100644
+--- a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
++++ b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
+@@ -316,3 +316,4 @@ class AttachSelectionToChatAction extends Action2 {
+ 						ResourceContextKey.Scheme.isEqualTo(Schemas.vscodeUserData)
+-					)
++					),
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 				)
+diff --git a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
+index 7e9c73f6..03da6f20 100644
+--- a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
++++ b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
+@@ -1420,3 +1420,3 @@ configurationRegistry.registerConfiguration({
+ 			description: nls.localize('chat.disableAIFeatures', "Disable and hide built-in AI features provided by GitHub Copilot, including chat and inline suggestions."),
+-			default: false,
++			default: true,
+ 			scope: ConfigurationScope.WINDOW
+diff --git a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
+index 8ac8f531..f56d3e96 100644
+--- a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
++++ b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
+@@ -72,2 +72,3 @@ const chatViewDescriptor: IViewDescriptor = {
+ 		ContextKeyExpr.and(
++			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 			ChatContextKeys.Setup.hidden.negate(),
+diff --git a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
+index 3fa75da3..b1832fcb 100644
+--- a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
++++ b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
+@@ -232,8 +232,9 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					f1: true,
+-					precondition: ContextKeyExpr.or(
+-						ChatContextKeys.Setup.hidden,
+-						ChatContextKeys.Setup.disabledInWorkspace,
+-						ChatContextKeys.Setup.untrusted,
+-						ChatContextKeys.Setup.completed.negate(),
+-						ChatContextKeys.Entitlement.canSignUp
++					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
++						ChatContextKeys.Setup.hidden.negate(),
++						ChatContextKeys.Setup.disabledInWorkspace.negate(),
++						ChatContextKeys.Setup.untrusted.negate(),
++						ChatContextKeys.Setup.completed,
++						ChatContextKeys.Entitlement.canSignUp.negate()
+ 					)
+@@ -353,2 +354,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 						when: ContextKeyExpr.and(
++							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 							ChatContextKeys.Setup.hidden.negate(),
+@@ -385,2 +387,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 						when: ContextKeyExpr.and(
++							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 							IsWebContext.negate(),
+@@ -415,2 +418,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 						ChatContextKeys.Setup.hidden.negate(),
+@@ -472,2 +476,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 						ChatContextKeys.Setup.hidden.negate(),
+@@ -564,2 +569,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
+ 		const internalGenerateCodeContext = ContextKeyExpr.and(
++			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 			ChatContextKeys.Setup.hidden.negate(),
+@@ -801,3 +807,7 @@ export class ChatTeardownContribution extends Disposable implements IWorkbenchCo
+ 					category: CHAT_CATEGORY,
+-					precondition: ContextKeyExpr.and(ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate()),
++					precondition: ContextKeyExpr.and(
++						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
++						ChatContextKeys.Setup.hidden.negate(),
++						ChatContextKeys.Setup.disabledInWorkspace.negate()
++					),
+ 					menu: {
+diff --git a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
+index 2c244736..2f5023d8 100644
+--- a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
++++ b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
+@@ -43,3 +43,4 @@ const inlineChatContextKey = ContextKeyExpr.and(
+ 	EditorContextKeys.writable,
+-	EditorContextKeys.editorSimpleInput.negate()
++	EditorContextKeys.editorSimpleInput.negate(),
++	ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ );
+diff --git a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
+index dc231e44..633de730 100644
+--- a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
++++ b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
+@@ -545,3 +545,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{}]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate()),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -554,3 +554,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{}]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`)), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -563,3 +563,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{}]),
+-				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
++				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`)), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 			},
+@@ -569,3 +569,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{ showWelcome: true }]),
+-				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
++				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 				weight: 40,
+@@ -578,3 +578,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
+ 				ctorDescriptor: new SyncDescriptor(McpServersListView, [{ showWelcome: true }]),
+-				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
++				when: ContextKeyExpr.and(SearchMcpServersContext, ChatContextKeys.Setup.hidden.negate(), ChatContextKeys.Setup.disabledInWorkspace.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate()),
+ 			}
+diff --git a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
+index 6bdf7f36..3bfc7d19 100644
+--- a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
++++ b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
+@@ -703,2 +703,3 @@ registerAction2(class extends Action2 {
+ 				when: ContextKeyExpr.and(
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.hidden.negate(),
+diff --git a/src/vs/workbench/contrib/scm/browser/scmInput.ts b/src/vs/workbench/contrib/scm/browser/scmInput.ts
+index 6adf03c6..38a6d42c 100644
+--- a/src/vs/workbench/contrib/scm/browser/scmInput.ts
++++ b/src/vs/workbench/contrib/scm/browser/scmInput.ts
+@@ -848,2 +848,3 @@ registerAction2(class extends Action2 {
+ 				when: ContextKeyExpr.and(
++					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
+ 					ChatContextKeys.Setup.hidden.negate(),

patches/00-ext-github-authentication-use-pat.patch

@@ -1,5 +1,5 @@
 diff --git a/extensions/github-authentication/src/common/env.ts b/extensions/github-authentication/src/common/env.ts
-index 5456fb8..18fd732 100644
+index 56cad4be..18fd7327 100644
 --- a/extensions/github-authentication/src/common/env.ts
 +++ b/extensions/github-authentication/src/common/env.ts
 @@ -7,24 +7,4 @@ import { AuthProviderType } from '../github';
@@ -8,9 +8,9 @@ index 5456fb8..18fd732 100644
 -	'vscode',
 -	'vscode-insiders',
 -	'vscode-exploration',
--	'vscode-sessions',
--	'vscode-sessions-insiders',
--	'vscode-sessions-exploration',
+-	'vscode-agents',
+-	'vscode-agents-insiders',
+-	'vscode-agents-exploration',
 -	// On Windows, some browsers don't seem to redirect back to OSS properly.
 -	// As a result, you get stuck in the auth flow. We exclude this from the
 -	// list until we can figure out a way to fix this behavior in browsers.

patches/00-ui-custom-font.patch

@@ -1,5 +1,5 @@
 diff --git a/src/vs/base/browser/ui/actionbar/actionbar.css b/src/vs/base/browser/ui/actionbar/actionbar.css
-index e9e55ad..0ce9147 100644
+index e9e55ad9..0ce9147c 100644
 --- a/src/vs/base/browser/ui/actionbar/actionbar.css
 +++ b/src/vs/base/browser/ui/actionbar/actionbar.css
 @@ -127 +127,72 @@
@@ -77,10 +77,10 @@ index e9e55ad..0ce9147 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/button/button.css b/src/vs/base/browser/ui/button/button.css
-index 8496f1b..964455a 100644
+index 0ec4cbb4..0fc77fae 100644
 --- a/src/vs/base/browser/ui/button/button.css
 +++ b/src/vs/base/browser/ui/button/button.css
-@@ -183 +183,43 @@
+@@ -184 +184,43 @@
  }
 +
 +
@@ -126,7 +126,7 @@ index 8496f1b..964455a 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/codicons/codicon/codicon.css b/src/vs/base/browser/ui/codicons/codicon/codicon.css
-index d7f257d..af55bdd 100644
+index d7f257db..af55bddb 100644
 --- a/src/vs/base/browser/ui/codicons/codicon/codicon.css
 +++ b/src/vs/base/browser/ui/codicons/codicon/codicon.css
 @@ -25 +25,7 @@
@@ -139,7 +139,7 @@ index d7f257d..af55bdd 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/iconLabel/iconlabel.css b/src/vs/base/browser/ui/iconLabel/iconlabel.css
-index d3dfd9a..cf59627 100644
+index d3dfd9a5..cf596272 100644
 --- a/src/vs/base/browser/ui/iconLabel/iconlabel.css
 +++ b/src/vs/base/browser/ui/iconLabel/iconlabel.css
 @@ -119 +119,21 @@
@@ -166,7 +166,7 @@ index d3dfd9a..cf59627 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/inputbox/inputBox.css b/src/vs/base/browser/ui/inputbox/inputBox.css
-index dc5e637..b580762 100644
+index dc5e637f..b580762b 100644
 --- a/src/vs/base/browser/ui/inputbox/inputBox.css
 +++ b/src/vs/base/browser/ui/inputbox/inputBox.css
 @@ -107 +107,28 @@
@@ -200,7 +200,7 @@ index dc5e637..b580762 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/selectBox/selectBox.css b/src/vs/base/browser/ui/selectBox/selectBox.css
-index fd4d00e..92ddc99 100644
+index fd4d00ea..92ddc996 100644
 --- a/src/vs/base/browser/ui/selectBox/selectBox.css
 +++ b/src/vs/base/browser/ui/selectBox/selectBox.css
 @@ -35 +35,16 @@
@@ -222,7 +222,7 @@ index fd4d00e..92ddc99 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts b/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts
-index b7cbca1..16f531c 100644
+index b7cbca15..16f531cb 100644
 --- a/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts
 +++ b/src/vs/base/browser/ui/selectBox/selectBoxCustom.ts
 @@ -8,2 +8,3 @@ import * as arrays from '../../../common/arrays.js';
@@ -235,7 +235,7 @@ index b7cbca1..16f531c 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/base/browser/ui/splitview/paneview.css b/src/vs/base/browser/ui/splitview/paneview.css
-index 7bb4282..92c027a 100644
+index 7bb4282a..92c027a2 100644
 --- a/src/vs/base/browser/ui/splitview/paneview.css
 +++ b/src/vs/base/browser/ui/splitview/paneview.css
 @@ -153 +153,38 @@
@@ -279,7 +279,7 @@ index 7bb4282..92c027a 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/splitview/paneview.ts b/src/vs/base/browser/ui/splitview/paneview.ts
-index fb2e1f4..3b1e23f 100644
+index fb2e1f40..3b1e23f2 100644
 --- a/src/vs/base/browser/ui/splitview/paneview.ts
 +++ b/src/vs/base/browser/ui/splitview/paneview.ts
 @@ -21,2 +21,3 @@ import { IView, Sizing, SplitView } from './splitview.js';
@@ -302,7 +302,7 @@ index fb2e1f4..3b1e23f 100644
 +		const headerSize = this.headerSize;
  
 diff --git a/src/vs/base/browser/ui/toggle/toggle.css b/src/vs/base/browser/ui/toggle/toggle.css
-index e2d206d..e69352c 100644
+index e2d206d3..e69352c8 100644
 --- a/src/vs/base/browser/ui/toggle/toggle.css
 +++ b/src/vs/base/browser/ui/toggle/toggle.css
 @@ -69 +69,27 @@
@@ -335,7 +335,7 @@ index e2d206d..e69352c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/base/browser/ui/toggle/toggle.ts b/src/vs/base/browser/ui/toggle/toggle.ts
-index 0b2fcbb..6370e6f 100644
+index 0b2fcbbb..6370e6f7 100644
 --- a/src/vs/base/browser/ui/toggle/toggle.ts
 +++ b/src/vs/base/browser/ui/toggle/toggle.ts
 @@ -5,2 +5,3 @@
@@ -350,7 +350,7 @@ index 0b2fcbb..6370e6f 100644
  	}
 diff --git a/src/vs/base/common/font.ts b/src/vs/base/common/font.ts
 new file mode 100644
-index 0000000..8b9689c
+index 00000000..8b9689c7
 --- /dev/null
 +++ b/src/vs/base/common/font.ts
 @@ -0,0 +1,187 @@
@@ -544,7 +544,7 @@ index 0000000..8b9689c
 \ No newline at end of file
 diff --git a/src/vs/base/test/common/font.test.ts b/src/vs/base/test/common/font.test.ts
 new file mode 100644
-index 0000000..62a49d5
+index 00000000..62a49d53
 --- /dev/null
 +++ b/src/vs/base/test/common/font.test.ts
 @@ -0,0 +1,482 @@
@@ -1031,7 +1031,7 @@ index 0000000..62a49d5
 +	});
 +});
 diff --git a/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts b/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts
-index 328285f..0735dfa 100644
+index 328285f0..0735dfa2 100644
 --- a/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts
 +++ b/src/vs/platform/quickinput/browser/tree/quickInputDelegate.ts
 @@ -6,2 +6,3 @@
@@ -1044,7 +1044,7 @@ index 328285f..0735dfa 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/browser/media/style.css b/src/vs/workbench/browser/media/style.css
-index 0d6a2da..6127a14 100644
+index 1f6e583f..79401713 100644
 --- a/src/vs/workbench/browser/media/style.css
 +++ b/src/vs/workbench/browser/media/style.css
 @@ -11,20 +11,20 @@
@@ -1089,7 +1089,7 @@ index 0d6a2da..6127a14 100644
 +	font-family: var(--vscode-workbench-font-family, var(--monaco-font));
 +	font-size: var(--vscode-workbench-font-size, 13px);
  
-@@ -335 +337,41 @@ body {
+@@ -356 +358,41 @@ body {
  }
 +
 +
@@ -1133,33 +1133,33 @@ index 0d6a2da..6127a14 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts b/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts
-index 0307cab..5e5f6f3 100644
+index 86c8b184..bfd30e64 100644
 --- a/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts
 +++ b/src/vs/workbench/browser/parts/activitybar/activitybarPart.ts
-@@ -40,2 +40,3 @@ import { IViewsService } from '../../../services/views/common/viewsService.js';
+@@ -41,2 +41,3 @@ import { IViewsService } from '../../../services/views/common/viewsService.js';
  import { SwitchCompositeViewAction } from '../compositeBarActions.js';
 +import { FONT, getFontSize, updateActivityBarSize } from '../../../../base/common/font.js';
  
-@@ -45,2 +46,3 @@ export class ActivitybarPart extends Part {
+@@ -46,2 +47,3 @@ export class ActivitybarPart extends Part {
  	static readonly COMPACT_ACTION_HEIGHT = 32;
 +	static readonly COMPACT_ACTION_HEIGHT_RATIO = 32/48;
  
-@@ -48,2 +50,3 @@ export class ActivitybarPart extends Part {
+@@ -49,2 +51,3 @@ export class ActivitybarPart extends Part {
  	static readonly COMPACT_ACTIVITYBAR_WIDTH = 36;
 +	static readonly COMPACT_ACTIVITYBAR_WIDTH_RATIO = 36/48;
  
-@@ -51,2 +54,3 @@ export class ActivitybarPart extends Part {
+@@ -52,2 +55,3 @@ export class ActivitybarPart extends Part {
  	static readonly COMPACT_ICON_SIZE = 16;
 +	static readonly COMPACT_ICON_SIZE_RATIO = 16/24;
  
-@@ -58,4 +62,4 @@ export class ActivitybarPart extends Part {
+@@ -59,4 +63,4 @@ export class ActivitybarPart extends Part {
  
 -	get minimumWidth(): number { return this._isCompact ? ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH : ActivitybarPart.ACTIVITYBAR_WIDTH; }
 -	get maximumWidth(): number { return this._isCompact ? ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH : ActivitybarPart.ACTIVITYBAR_WIDTH; }
 +	get minimumWidth(): number { return this._isCompact ? FONT.activityBarSize48 * ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH_RATIO : FONT.activityBarSize48; }
 +	get maximumWidth(): number { return this._isCompact ? FONT.activityBarSize48 * ActivitybarPart.COMPACT_ACTIVITYBAR_WIDTH_RATIO : FONT.activityBarSize48; }
  	readonly minimumHeight: number = 0;
-@@ -90,2 +94,11 @@ export class ActivitybarPart extends Part {
+@@ -91,2 +95,11 @@ export class ActivitybarPart extends Part {
  		}));
 +
 +		this._register(configurationService.onDidChangeConfiguration(e => {
@@ -1171,21 +1171,21 @@ index 0307cab..5e5f6f3 100644
 +			}
 +		}));
  	}
-@@ -96,4 +109,4 @@ export class ActivitybarPart extends Part {
+@@ -97,4 +110,4 @@ export class ActivitybarPart extends Part {
  			this.element.style.setProperty('--activity-bar-width', `${this.minimumWidth}px`);
 -			this.element.style.setProperty('--activity-bar-action-height', `${this._isCompact ? ActivitybarPart.COMPACT_ACTION_HEIGHT : ActivitybarPart.ACTION_HEIGHT}px`);
 -			this.element.style.setProperty('--activity-bar-icon-size', `${this._isCompact ? ActivitybarPart.COMPACT_ICON_SIZE : ActivitybarPart.ICON_SIZE}px`);
 +			this.element.style.setProperty('--activity-bar-action-height', `${this._isCompact ? FONT.activityBarSize32 : FONT.activityBarSize48}px`);
 +			this.element.style.setProperty('--activity-bar-icon-size', `${this._isCompact ? FONT.activityBarSize : FONT.activityBarSize24}px`);
  		}
-@@ -153,2 +166,6 @@ export class ActivitybarPart extends Part {
+@@ -154,2 +167,6 @@ export class ActivitybarPart extends Part {
  
 +		// Apply font settings before show() so composite bar uses correct sizes
 +		this.applyActivityBarFontFamily(parent);
 +		this.applyActivityBarFontSize(parent);
 +
  		this.updateCompactStyle();
-@@ -162,2 +179,34 @@ export class ActivitybarPart extends Part {
+@@ -163,2 +180,34 @@ export class ActivitybarPart extends Part {
  
 +	private applyActivityBarFontFamily(container?: HTMLElement): void {
 +		const target = container ?? this.getContainer();
@@ -1221,7 +1221,7 @@ index 0307cab..5e5f6f3 100644
 +
  	getPinnedPaneCompositeIds(): string[] {
 diff --git a/src/vs/workbench/browser/parts/activitybar/media/activityaction.css b/src/vs/workbench/browser/parts/activitybar/media/activityaction.css
-index a40a351..51eb067 100644
+index a40a3515..51eb067d 100644
 --- a/src/vs/workbench/browser/parts/activitybar/media/activityaction.css
 +++ b/src/vs/workbench/browser/parts/activitybar/media/activityaction.css
 @@ -230 +230,60 @@
@@ -1287,7 +1287,7 @@ index a40a351..51eb067 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css b/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css
-index 568a721..b3d7e50 100644
+index 568a7212..b3d7e506 100644
 --- a/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css
 +++ b/src/vs/workbench/browser/parts/activitybar/media/activitybarpart.css
 @@ -8,2 +8,4 @@
@@ -1306,7 +1306,7 @@ index 568a721..b3d7e50 100644
 +	height: calc(var(--vscode-workbench-activitybar-font-size) * 2.1875);
  }
 diff --git a/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts b/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts
-index d32082b..ad7e524 100644
+index d32082b4..ad7e524c 100644
 --- a/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts
 +++ b/src/vs/workbench/browser/parts/auxiliarybar/auxiliaryBarPart.ts
 @@ -36,2 +36,4 @@ import { VisibleViewContainersTracker } from '../visibleViewContainersTracker.js
@@ -1362,7 +1362,7 @@ index d32082b..ad7e524 100644
 +		this._onDidChange.fire(undefined); // Signal grid that size constraints changed
  	}
 diff --git a/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css b/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css
-index aec3de2..b0e1fd8 100644
+index aec3de2d..b0e1fd8f 100644
 --- a/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css
 +++ b/src/vs/workbench/browser/parts/auxiliarybar/media/auxiliaryBarPart.css
 @@ -28,2 +28,8 @@
@@ -1375,7 +1375,7 @@ index aec3de2..b0e1fd8 100644
 +
  .monaco-workbench .part.auxiliarybar > .title > .title-label {
 diff --git a/src/vs/workbench/browser/parts/editor/editorTabsControl.ts b/src/vs/workbench/browser/parts/editor/editorTabsControl.ts
-index b0a44e2..e711a80 100644
+index b0a44e2c..e711a809 100644
 --- a/src/vs/workbench/browser/parts/editor/editorTabsControl.ts
 +++ b/src/vs/workbench/browser/parts/editor/editorTabsControl.ts
 @@ -48,2 +48,4 @@ import { MarkdownString } from '../../../../base/common/htmlContent.js';
@@ -1451,7 +1451,7 @@ index b0a44e2..e711a80 100644
 +
  	private get editorActionsEnabled(): boolean {
 diff --git a/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css b/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css
-index 57ab8ca..72a328f 100644
+index 57ab8ca5..72a328fc 100644
 --- a/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css
 +++ b/src/vs/workbench/browser/parts/editor/media/editortabscontrol.css
 @@ -9,2 +9,3 @@
@@ -1498,7 +1498,7 @@ index 57ab8ca..72a328f 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css b/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css
-index a24f761..6b15b9c 100644
+index a24f7613..6b15b9c2 100644
 --- a/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css
 +++ b/src/vs/workbench/browser/parts/editor/media/editortitlecontrol.css
 @@ -47 +47,28 @@
@@ -1532,7 +1532,7 @@ index a24f761..6b15b9c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css b/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css
-index 4f9477d..b47fd85 100644
+index 4f9477d0..b47fd85b 100644
 --- a/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css
 +++ b/src/vs/workbench/browser/parts/editor/media/multieditortabscontrol.css
 @@ -176,4 +176,4 @@
@@ -1663,7 +1663,7 @@ index 4f9477d..b47fd85 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts b/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts
-index b0befd9..7c25771 100644
+index b56047d6..d6e6c7ed 100644
 --- a/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts
 +++ b/src/vs/workbench/browser/parts/editor/multiEditorTabsControl.ts
 @@ -6,2 +6,3 @@
@@ -1697,7 +1697,7 @@ index b0befd9..7c25771 100644
 +		super(parent, editorPartsView, groupsView, groupView, tabsModel, contextMenuService, instantiationService, contextKeyService, keybindingService, notificationService, quickInputService, themeService, editorResolverService, hostService, configurationService);
  
 diff --git a/src/vs/workbench/browser/parts/media/paneCompositePart.css b/src/vs/workbench/browser/parts/media/paneCompositePart.css
-index fe0f2ad..195267c 100644
+index fe0f2adf..195267cf 100644
 --- a/src/vs/workbench/browser/parts/media/paneCompositePart.css
 +++ b/src/vs/workbench/browser/parts/media/paneCompositePart.css
 @@ -369 +369,119 @@
@@ -1822,7 +1822,7 @@ index fe0f2ad..195267c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/panel/media/panelpart.css b/src/vs/workbench/browser/parts/panel/media/panelpart.css
-index e1c147d..63d0e10 100644
+index e1c147d8..63d0e109 100644
 --- a/src/vs/workbench/browser/parts/panel/media/panelpart.css
 +++ b/src/vs/workbench/browser/parts/panel/media/panelpart.css
 @@ -10,2 +10,7 @@
@@ -1887,7 +1887,7 @@ index e1c147d..63d0e10 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/panel/panelPart.ts b/src/vs/workbench/browser/parts/panel/panelPart.ts
-index 9afcf59..a8d4c2e 100644
+index 9afcf596..a8d4c2e6 100644
 --- a/src/vs/workbench/browser/parts/panel/panelPart.ts
 +++ b/src/vs/workbench/browser/parts/panel/panelPart.ts
 @@ -34,2 +34,3 @@ import { IConfigurationService } from '../../../../platform/configuration/common
@@ -1942,7 +1942,7 @@ index 9afcf59..a8d4c2e 100644
 +		this._onDidChange.fire(undefined); // Signal grid that size constraints changed
  	}
 diff --git a/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css b/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css
-index decb51a..d0db436 100644
+index decb51ab..d0db4363 100644
 --- a/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css
 +++ b/src/vs/workbench/browser/parts/sidebar/media/sidebarpart.css
 @@ -15,3 +15,3 @@
@@ -1999,7 +1999,7 @@ index decb51a..d0db436 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts b/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts
-index 101b9c6..970cdaa 100644
+index 101b9c6c..970cdaae 100644
 --- a/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts
 +++ b/src/vs/workbench/browser/parts/sidebar/sidebarPart.ts
 @@ -36,2 +36,3 @@ import { VisibleViewContainersTracker } from '../visibleViewContainersTracker.js
@@ -2061,7 +2061,7 @@ index 101b9c6..970cdaa 100644
 +
  	private registerActions(): void {
 diff --git a/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css b/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css
-index 1f3b102..42ad22c 100644
+index 1f3b102e..42ad22c0 100644
 --- a/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css
 +++ b/src/vs/workbench/browser/parts/statusbar/media/statusbarpart.css
 @@ -11,2 +11,3 @@
@@ -2141,7 +2141,7 @@ index 1f3b102..42ad22c 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts b/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts
-index 18340a8..0a33ce0 100644
+index 18340a8a..0a33ce06 100644
 --- a/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts
 +++ b/src/vs/workbench/browser/parts/statusbar/statusbarPart.ts
 @@ -38,2 +38,4 @@ import { IView } from '../../../../base/browser/ui/grid/grid.js';
@@ -2237,7 +2237,7 @@ index 18340a8..0a33ce0 100644
 +		super(`workbench.parts.auxiliaryStatus.${id}`, instantiationService, themeService, contextService, storageService, layoutService, contextMenuService, contextKeyService, configurationService);
  	}
 diff --git a/src/vs/workbench/browser/parts/views/media/paneviewlet.css b/src/vs/workbench/browser/parts/views/media/paneviewlet.css
-index aca98de..5bf9bf7 100644
+index aca98deb..5bf9bf71 100644
 --- a/src/vs/workbench/browser/parts/views/media/paneviewlet.css
 +++ b/src/vs/workbench/browser/parts/views/media/paneviewlet.css
 @@ -87 +87,30 @@
@@ -2273,7 +2273,7 @@ index aca98de..5bf9bf7 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/browser/parts/views/treeView.ts b/src/vs/workbench/browser/parts/views/treeView.ts
-index 1c9305b..6471a0d 100644
+index 1c9305bd..6471a0d3 100644
 --- a/src/vs/workbench/browser/parts/views/treeView.ts
 +++ b/src/vs/workbench/browser/parts/views/treeView.ts
 @@ -79,2 +79,3 @@ import { IAccessibleViewInformationService } from '../../../services/accessibili
@@ -2290,10 +2290,10 @@ index 1c9305b..6471a0d 100644
 -	static readonly ITEM_HEIGHT = 22;
  	static readonly TREE_TEMPLATE_ID = 'treeExplorer';
 diff --git a/src/vs/workbench/browser/workbench.contribution.ts b/src/vs/workbench/browser/workbench.contribution.ts
-index 058693c..ee81a59 100644
+index bdc603ff..4bc6d153 100644
 --- a/src/vs/workbench/browser/workbench.contribution.ts
 +++ b/src/vs/workbench/browser/workbench.contribution.ts
-@@ -702,2 +702,85 @@ const registry = Registry.as<IConfigurationRegistry>(ConfigurationExtensions.Con
+@@ -698,2 +698,85 @@ const registry = Registry.as<IConfigurationRegistry>(ConfigurationExtensions.Con
  			},
 +			'workbench.experimental.fontFamily': {
 +				type: 'string',
@@ -2380,7 +2380,7 @@ index 058693c..ee81a59 100644
 +			},
  			'workbench.settings.editor': {
 diff --git a/src/vs/workbench/browser/workbench.ts b/src/vs/workbench/browser/workbench.ts
-index 10e2c3e..74e3bbe 100644
+index 10e2c3ed..74e3bbe9 100644
 --- a/src/vs/workbench/browser/workbench.ts
 +++ b/src/vs/workbench/browser/workbench.ts
 @@ -9,2 +9,3 @@ import { Event, Emitter, setGlobalLeakWarningThreshold } from '../../base/common
@@ -2460,7 +2460,7 @@ index 10e2c3e..74e3bbe 100644
 +		this.updateFontSize(configurationService);
  
 diff --git a/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts b/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts
-index 6f58865..3ab0ee4 100644
+index 6f588651..3ab0ee4e 100644
 --- a/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts
 +++ b/src/vs/workbench/contrib/callHierarchy/browser/callHierarchyTree.ts
 @@ -17,2 +17,3 @@ import { localize } from '../../../../nls.js';
@@ -2473,43 +2473,31 @@ index 6f58865..3ab0ee4 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts b/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts
-index bcb46c6..0aef82b 100644
+index d4f277de..4f386424 100644
 --- a/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts
 +++ b/src/vs/workbench/contrib/chat/browser/agentSessions/agentSessionsViewer.ts
-@@ -52,2 +52,3 @@ import { BugIndicatingError } from '../../../../../base/common/errors.js';
- import { ILogService } from '../../../../../platform/log/common/log.js';
+@@ -53,2 +53,3 @@ import { BugIndicatingError } from '../../../../../base/common/errors.js';
+ import { compareIgnoreCase } from '../../../../../base/common/strings.js';
 +import { FONT } from '../../../../../base/common/font.js';
  
-@@ -638,5 +639,2 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
+@@ -838,5 +839,2 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
  
 -	static readonly ITEM_HEIGHT = 54;
 -	static readonly SECTION_HEIGHT = 26;
 -
- 	constructor(private readonly _approvalModel?: AgentSessionApprovalModel) { }
-@@ -645,6 +643,6 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
+ 	constructor(private readonly _approvalModel?: AgentSessionApprovalModel,
+@@ -847,3 +845,3 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
  		if (isAgentSessionSection(element)) {
 -			return AgentSessionsListDelegate.SECTION_HEIGHT;
 +			return FONT.sidebarSize26;
  		}
+@@ -854,3 +852,3 @@ export class AgentSessionsListDelegate implements IListVirtualDelegate<AgentSess
  
 -		let height = AgentSessionsListDelegate.ITEM_HEIGHT;
 +		let height = FONT.sidebarSize54;
  		const approval = this._approvalModel?.getApproval(element.resource).get();
-diff --git a/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts b/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts
-index ad2c82a..6cb6bce 100644
---- a/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chatManagement/chatManagementEditor.ts
-@@ -34,2 +34,3 @@ import { IContextKey, IContextKeyService } from '../../../../../platform/context
- import { CONTEXT_MODELS_EDITOR } from '../../common/constants.js';
-+import { FONT } from '../../../../../base/common/font.js';
- 
-@@ -439,3 +440,3 @@ class SectionItemDelegate implements IListVirtualDelegate<SectionItem> {
- 	getHeight(element: SectionItem) {
--		return 22;
-+		return FONT.sidebarSize22;
- 	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts
-index cc7bb15..f260d0e 100644
+index cc7bb156..f260d0e3 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatChangesSummaryPart.ts
 @@ -33,2 +33,3 @@ import { ResourcePool } from './chatCollections.js';
@@ -2522,7 +2510,7 @@ index cc7bb15..f260d0e 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts
-index 15ae799..06a95d5 100644
+index 15ae7996..06a95d59 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatMultiDiffContentPart.ts
 @@ -36,2 +36,3 @@ import { ChatTreeItem } from '../../chat.js';
@@ -2535,7 +2523,7 @@ index 15ae799..06a95d5 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts
-index 8493938..50a19e4 100644
+index 84939387..50a19e4f 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatReferencesContentPart.ts
 @@ -50,2 +50,3 @@ import { IHoverService } from '../../../../../../platform/hover/browser/hover.js
@@ -2548,20 +2536,20 @@ index 8493938..50a19e4 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts
-index 619d00a..9edbd1b 100644
+index 8f0f2c48..52818d1d 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTodoListWidget.ts
 @@ -11,2 +11,3 @@ import { IListRenderer, IListVirtualDelegate } from '../../../../../../base/brow
  import { Codicon } from '../../../../../../base/common/codicons.js';
 +import { FONT } from '../../../../../../base/common/font.js';
  import { Disposable, DisposableStore } from '../../../../../../base/common/lifecycle.js';
-@@ -23,3 +24,3 @@ class TodoListDelegate implements IListVirtualDelegate<IChatTodo> {
+@@ -24,3 +25,3 @@ class TodoListDelegate implements IListVirtualDelegate<IChatTodo> {
  	getHeight(element: IChatTodo): number {
 -		return 22;
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts
-index 703940e..e0fa9eb 100644
+index 703940ed..e0fa9eb5 100644
 --- a/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts
 +++ b/src/vs/workbench/contrib/chat/browser/widget/chatContentParts/chatTreeContentPart.ts
 @@ -12,2 +12,3 @@ import { IAsyncDataSource, ITreeNode } from '../../../../../../base/browser/ui/t
@@ -2577,7 +2565,7 @@ index 703940e..e0fa9eb 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css b/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css
-index 83799c1..b2d3db2 100644
+index 83799c15..b2d3db2c 100644
 --- a/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css
 +++ b/src/vs/workbench/contrib/chat/browser/widgetHosts/viewPane/media/chatViewPane.css
 @@ -169 +169,68 @@
@@ -2651,7 +2639,7 @@ index 83799c1..b2d3db2 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts b/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts
-index c6298b3..8fcab5f 100644
+index c6298b30..8fcab5f3 100644
 --- a/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts
 +++ b/src/vs/workbench/contrib/codeEditor/browser/outline/documentSymbolsTree.ts
 @@ -15,2 +15,3 @@ import { safeIntl } from '../../../../../base/common/date.js';
@@ -2664,7 +2652,7 @@ index c6298b3..8fcab5f 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts b/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts
-index cacba31..7785734 100644
+index cacba319..77857347 100644
 --- a/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts
 +++ b/src/vs/workbench/contrib/codeEditor/browser/suggestEnabledInput/suggestEnabledInput.ts
 @@ -40,2 +40,3 @@ import { SelectionClipboardContributionID } from '../selectionClipboard.js';
@@ -2679,14 +2667,14 @@ index cacba31..7785734 100644
 +		lineHeight: FONT.sidebarSize20,
  		wordWrap: 'off',
 diff --git a/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts b/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts
-index b5234b6..b36e465 100644
+index 5162553b..5adbed8f 100644
 --- a/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts
 +++ b/src/vs/workbench/contrib/comments/browser/commentsTreeViewer.ts
 @@ -43,2 +43,3 @@ import { MarshalledCommentThread, MarshalledCommentThreadInternal } from '../../
  import { IHoverService } from '../../../../platform/hover/browser/hover.js';
 +import { FONT } from '../../../../base/common/font.js';
  
-@@ -83,5 +84,5 @@ class CommentsModelVirtualDelegate implements IListVirtualDelegate<ResourceWithC
+@@ -84,5 +85,5 @@ class CommentsModelVirtualDelegate implements IListVirtualDelegate<ResourceWithC
  		if ((element instanceof CommentNode) && element.hasReply()) {
 -			return 44;
 +			return FONT.sidebarSize44;
@@ -2695,7 +2683,7 @@ index b5234b6..b36e465 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/breakpointsView.ts b/src/vs/workbench/contrib/debug/browser/breakpointsView.ts
-index 6f82df1..6c8ae0d 100644
+index 6f82df16..6c8ae0d6 100644
 --- a/src/vs/workbench/contrib/debug/browser/breakpointsView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/breakpointsView.ts
 @@ -63,2 +63,3 @@ import { equals } from '../../../../base/common/arrays.js';
@@ -2708,7 +2696,7 @@ index 6f82df1..6c8ae0d 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/callStackView.ts b/src/vs/workbench/contrib/debug/browser/callStackView.ts
-index 35c9c1e..f8bf9c5 100644
+index 35c9c1e5..f8bf9c5b 100644
 --- a/src/vs/workbench/contrib/debug/browser/callStackView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/callStackView.ts
 @@ -22,2 +22,3 @@ import { Event } from '../../../../base/common/event.js';
@@ -2729,7 +2717,7 @@ index 35c9c1e..f8bf9c5 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/callStackWidget.ts b/src/vs/workbench/contrib/debug/browser/callStackWidget.ts
-index 42e4cbe..bfaf21e 100644
+index 42e4cbeb..bfaf21e4 100644
 --- a/src/vs/workbench/contrib/debug/browser/callStackWidget.ts
 +++ b/src/vs/workbench/contrib/debug/browser/callStackWidget.ts
 @@ -13,2 +13,3 @@ import { Codicon } from '../../../../base/common/codicons.js';
@@ -2757,7 +2745,7 @@ index 42e4cbe..bfaf21e 100644
 -
  interface IAbstractFrameRendererTemplateData {
 diff --git a/src/vs/workbench/contrib/debug/browser/debugHover.ts b/src/vs/workbench/contrib/debug/browser/debugHover.ts
-index fe8ae2b..5830976 100644
+index fe8ae2b6..5830976e 100644
 --- a/src/vs/workbench/contrib/debug/browser/debugHover.ts
 +++ b/src/vs/workbench/contrib/debug/browser/debugHover.ts
 @@ -15,2 +15,3 @@ import { coalesce } from '../../../../base/common/arrays.js';
@@ -2770,7 +2758,7 @@ index fe8ae2b..5830976 100644
 +		return FONT.sidebarSize18;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts b/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts
-index 531c114..909a66d 100644
+index 531c1146..909a66db 100644
 --- a/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/loadedScriptsView.ts
 @@ -14,2 +14,3 @@ import { Codicon } from '../../../../base/common/codicons.js';
@@ -2783,7 +2771,7 @@ index 531c114..909a66d 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css b/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css
-index ca34e6f..611b495 100644
+index ca34e6f7..611b4950 100644
 --- a/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css
 +++ b/src/vs/workbench/contrib/debug/browser/media/debugToolBar.css
 @@ -55 +55,25 @@
@@ -2814,7 +2802,7 @@ index ca34e6f..611b495 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css b/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css
-index 4a627af..86f37c5 100644
+index 4a627af1..86f37c5a 100644
 --- a/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css
 +++ b/src/vs/workbench/contrib/debug/browser/media/debugViewlet.css
 @@ -371 +371,103 @@
@@ -2923,7 +2911,7 @@ index 4a627af..86f37c5 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/debug/browser/variablesView.ts b/src/vs/workbench/contrib/debug/browser/variablesView.ts
-index f18d41b..8863b19 100644
+index f18d41bf..8863b19d 100644
 --- a/src/vs/workbench/contrib/debug/browser/variablesView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/variablesView.ts
 @@ -18,2 +18,3 @@ import { Codicon } from '../../../../base/common/codicons.js';
@@ -2936,7 +2924,7 @@ index f18d41b..8863b19 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts b/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts
-index f290f70..3269808 100644
+index f290f709..3269808a 100644
 --- a/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts
 +++ b/src/vs/workbench/contrib/debug/browser/watchExpressionsView.ts
 @@ -42,2 +42,3 @@ import { watchExpressionsAdd, watchExpressionsRemoveAll } from './debugIcons.js'
@@ -2949,7 +2937,7 @@ index f290f70..3269808 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts b/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts
-index 3cd48a5..3238df4 100644
+index 3cd48a5b..3238df42 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionFeaturesTab.ts
 @@ -40,2 +40,3 @@ import { IHoverService } from '../../../../platform/hover/browser/hover.js';
@@ -2962,7 +2950,7 @@ index 3cd48a5..3238df4 100644
 +	getHeight() { return FONT.sidebarSize22; }
  	getTemplateId() { return 'extensionFeatureDescriptor'; }
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsList.ts b/src/vs/workbench/contrib/extensions/browser/extensionsList.ts
-index 42134f0..4e14bd1 100644
+index 42134f0b..4e14bd16 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsList.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsList.ts
 @@ -27,4 +27,3 @@ import { IActionViewItemOptions } from '../../../../base/browser/ui/actionbar/ac
@@ -2977,7 +2965,7 @@ index 42134f0..4e14bd1 100644
 +	getHeight() { return FONT.sidebarSize72; }
  	getTemplateId() { return 'extension'; }
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts b/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts
-index 418cb12..fbb30c5 100644
+index 418cb12e..fbb30c5c 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsViewer.ts
 @@ -40,2 +40,3 @@ import { ILogService } from '../../../../platform/log/common/log.js';
@@ -2990,7 +2978,7 @@ index 418cb12..fbb30c5 100644
 +		return FONT.sidebarSize62;
  	}
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts b/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts
-index 8bfac42..6430bf4 100644
+index 8bfac429..6430bf43 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts
 @@ -69,2 +69,3 @@ import { URI } from '../../../../base/common/uri.js';
@@ -3007,7 +2995,7 @@ index 8bfac42..6430bf4 100644
 +		const headerHeight = this.header && !!this.notificationContainer?.childNodes.length ? this.notificationContainer.clientHeight + searchBoxHeight + FONT.sidebarSize10 /*margin*/ : searchBoxHeight;
  		this.header!.style.height = `${headerHeight}px`;
 diff --git a/src/vs/workbench/contrib/extensions/browser/media/extension.css b/src/vs/workbench/contrib/extensions/browser/media/extension.css
-index 8454447..733b9a6 100644
+index 84544479..733b9a6b 100644
 --- a/src/vs/workbench/contrib/extensions/browser/media/extension.css
 +++ b/src/vs/workbench/contrib/extensions/browser/media/extension.css
 @@ -302 +302,91 @@
@@ -3104,7 +3092,7 @@ index 8454447..733b9a6 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css b/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css
-index 6326d45..cc5242a 100644
+index 6326d45f..cc5242ae 100644
 --- a/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css
 +++ b/src/vs/workbench/contrib/extensions/browser/media/extensionActions.css
 @@ -166 +166,26 @@
@@ -3136,7 +3124,7 @@ index 6326d45..cc5242a 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css b/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css
-index db5712f..0f75b63 100644
+index db5712fe..0f75b632 100644
 --- a/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css
 +++ b/src/vs/workbench/contrib/files/browser/media/explorerviewlet.css
 @@ -108 +108,24 @@
@@ -3166,7 +3154,7 @@ index db5712f..0f75b63 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/files/browser/views/explorerView.ts b/src/vs/workbench/contrib/files/browser/views/explorerView.ts
-index 5b11568..d276b5c 100644
+index 5b115684..d276b5c9 100644
 --- a/src/vs/workbench/contrib/files/browser/views/explorerView.ts
 +++ b/src/vs/workbench/contrib/files/browser/views/explorerView.ts
 @@ -511,3 +511,3 @@ export class ExplorerView extends ViewPane implements IExplorerView {
@@ -3175,7 +3163,7 @@ index 5b11568..d276b5c 100644
 +			paddingBottom: ExplorerDelegate.getHeight(),
  			overrideStyles: this.getLocationBasedColors().listOverrideStyles,
 diff --git a/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts b/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
-index ed7dbe0..dba05e8 100644
+index ed7dbe07..dba05e80 100644
 --- a/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 +++ b/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 @@ -76,2 +76,3 @@ import { listFilterMatchHighlight, listFilterMatchHighlightBorder } from '../../
@@ -3199,7 +3187,7 @@ index ed7dbe0..dba05e8 100644
 +			const offset = Math.max(39 - indent, 0); // derived via inspection
  			container.style.setProperty(`--vscode-explorer-align-offset-margin-left`, `${offset}px`);
 diff --git a/src/vs/workbench/contrib/files/browser/views/media/openeditors.css b/src/vs/workbench/contrib/files/browser/views/media/openeditors.css
-index d933ff9..3995b14 100644
+index d933ff97..3995b14f 100644
 --- a/src/vs/workbench/contrib/files/browser/views/media/openeditors.css
 +++ b/src/vs/workbench/contrib/files/browser/views/media/openeditors.css
 @@ -108 +108,28 @@
@@ -3233,7 +3221,7 @@ index d933ff9..3995b14 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts b/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts
-index 7229c14..33cae40 100644
+index 7229c14b..33cae40e 100644
 --- a/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts
 +++ b/src/vs/workbench/contrib/files/browser/views/openEditorsView.ts
 @@ -58,2 +58,3 @@ import { IHoverService } from '../../../../../platform/hover/browser/hover.js';
@@ -3259,7 +3247,7 @@ index 7229c14..33cae40 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts b/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts
-index f16d9fa..3296abc 100644
+index f16d9fa5..3296abc7 100644
 --- a/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts
 +++ b/src/vs/workbench/contrib/files/test/browser/explorerFindProvider.test.ts
 @@ -28,2 +28,3 @@ import { ExplorerFindProvider, FilesFilter } from '../../browser/views/explorerV
@@ -3272,7 +3260,7 @@ index f16d9fa..3296abc 100644
 +	getHeight() { return FONT.sidebarSize20; }
  	getTemplateId(element: ExplorerItem): string { return 'default'; }
 diff --git a/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts b/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts
-index 0176fb6..140cda1 100644
+index 0176fb67..140cda1d 100644
 --- a/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts
 +++ b/src/vs/workbench/contrib/markers/browser/markersTreeViewer.ts
 @@ -54,2 +54,3 @@ import type { IManagedHover } from '../../../../base/browser/ui/hover/hover.js';
@@ -3298,7 +3286,7 @@ index 0176fb6..140cda1 100644
 +				lineElement.style.height = `${FONT.sidebarSize22}px`;
  			}
 diff --git a/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts b/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts
-index 4c95a37..fcb18e0 100644
+index 4c95a373..fcb18e0e 100644
 --- a/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts
 +++ b/src/vs/workbench/contrib/notebook/browser/contrib/notebookVariables/notebookVariablesTree.ts
 @@ -10,2 +10,3 @@ import { ITreeNode, ITreeRenderer } from '../../../../../../base/browser/ui/tree
@@ -3311,7 +3299,7 @@ index 4c95a37..fcb18e0 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts b/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts
-index d812034..e2affd5 100644
+index d812034b..e2affd59 100644
 --- a/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts
 +++ b/src/vs/workbench/contrib/notebook/browser/contrib/outline/notebookOutline.ts
 @@ -56,2 +56,3 @@ import { ILanguageFeaturesService } from '../../../../../../editor/common/servic
@@ -3324,7 +3312,7 @@ index d812034..e2affd5 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/preferences/browser/tocTree.ts b/src/vs/workbench/contrib/preferences/browser/tocTree.ts
-index 0078e1e..b40fa10 100644
+index 0078e1ea..b40fa10d 100644
 --- a/src/vs/workbench/contrib/preferences/browser/tocTree.ts
 +++ b/src/vs/workbench/contrib/preferences/browser/tocTree.ts
 @@ -11,2 +11,3 @@ import { RenderIndentGuides } from '../../../../base/browser/ui/tree/abstractTre
@@ -3337,7 +3325,7 @@ index 0078e1e..b40fa10 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts b/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts
-index b54812a..05e5f75 100644
+index b54812a0..05e5f75b 100644
 --- a/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts
 +++ b/src/vs/workbench/contrib/processExplorer/browser/processExplorerControl.ts
 @@ -35,2 +35,3 @@ import { Schemas } from '../../../../base/common/network.js';
@@ -3350,7 +3338,7 @@ index b54812a..05e5f75 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/remote/browser/remote.ts b/src/vs/workbench/contrib/remote/browser/remote.ts
-index 530b0c4..b3c979d 100644
+index 2d7e4bb9..f4a5a5c1 100644
 --- a/src/vs/workbench/contrib/remote/browser/remote.ts
 +++ b/src/vs/workbench/contrib/remote/browser/remote.ts
 @@ -57,2 +57,3 @@ import { mainWindow } from '../../../../base/browser/window.js';
@@ -3363,7 +3351,7 @@ index 530b0c4..b3c979d 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/scm/browser/media/scm.css b/src/vs/workbench/contrib/scm/browser/media/scm.css
-index 408b771..7ccc6b9 100644
+index 408b771f..7ccc6b93 100644
 --- a/src/vs/workbench/contrib/scm/browser/media/scm.css
 +++ b/src/vs/workbench/contrib/scm/browser/media/scm.css
 @@ -800 +800,215 @@
@@ -3584,7 +3572,7 @@ index 408b771..7ccc6b9 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts b/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts
-index ab1900f..5ea8f3c 100644
+index 88c5c132..cd2b3759 100644
 --- a/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts
 +++ b/src/vs/workbench/contrib/scm/browser/scmHistoryViewPane.ts
 @@ -77,2 +77,3 @@ import { IMarkdownRendererService } from '../../../../platform/markdown/browser/
@@ -3597,7 +3585,7 @@ index ab1900f..5ea8f3c 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts b/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts
-index 1523a82..fe78847 100644
+index 1523a82c..fe788478 100644
 --- a/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts
 +++ b/src/vs/workbench/contrib/scm/browser/scmRepositoriesViewPane.ts
 @@ -49,2 +49,3 @@ import { IActionViewItemProvider } from '../../../../base/browser/ui/actionbar/a
@@ -3610,7 +3598,7 @@ index 1523a82..fe78847 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/scm/browser/scmViewPane.ts b/src/vs/workbench/contrib/scm/browser/scmViewPane.ts
-index a2887d4..5e81511 100644
+index a2887d47..5e81511f 100644
 --- a/src/vs/workbench/contrib/scm/browser/scmViewPane.ts
 +++ b/src/vs/workbench/contrib/scm/browser/scmViewPane.ts
 @@ -77,2 +77,3 @@ import { AccessibilityCommandId } from '../../accessibility/common/accessibility
@@ -3656,7 +3644,7 @@ index a2887d4..5e81511 100644
 +			return FONT.sidebarSize22;
  		}
 diff --git a/src/vs/workbench/contrib/search/browser/media/searchview.css b/src/vs/workbench/contrib/search/browser/media/searchview.css
-index 47e85d6..977a4dc 100644
+index 47e85d64..977a4dc6 100644
 --- a/src/vs/workbench/contrib/search/browser/media/searchview.css
 +++ b/src/vs/workbench/contrib/search/browser/media/searchview.css
 @@ -443 +443,121 @@
@@ -3783,7 +3771,7 @@ index 47e85d6..977a4dc 100644
 +}
 \ No newline at end of file
 diff --git a/src/vs/workbench/contrib/search/browser/searchResultsView.ts b/src/vs/workbench/contrib/search/browser/searchResultsView.ts
-index 62d5db9..f86dba1 100644
+index 62d5db99..f86dba1f 100644
 --- a/src/vs/workbench/contrib/search/browser/searchResultsView.ts
 +++ b/src/vs/workbench/contrib/search/browser/searchResultsView.ts
 @@ -36,2 +36,3 @@ import { ISearchTreeMatch, isSearchTreeMatch, RenderableMatch, ITextSearchHeadin
@@ -3802,7 +3790,7 @@ index 62d5db9..f86dba1 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/search/browser/searchView.ts b/src/vs/workbench/contrib/search/browser/searchView.ts
-index fb52bbb..09ca311 100644
+index fb52bbb7..09ca3111 100644
 --- a/src/vs/workbench/contrib/search/browser/searchView.ts
 +++ b/src/vs/workbench/contrib/search/browser/searchView.ts
 @@ -87,2 +87,3 @@ import { ITelemetryService } from '../../../../platform/telemetry/common/telemet
@@ -3834,7 +3822,7 @@ index fb52bbb..09ca311 100644
 +		this.tree.layout(this.size.height - widgetHeight - messagesHeight, this.size.width - FONT.sidebarSize28);
  	}
 diff --git a/src/vs/workbench/contrib/search/browser/searchWidget.ts b/src/vs/workbench/contrib/search/browser/searchWidget.ts
-index e9c0fcd..f3e23de 100644
+index e9c0fcd4..f3e23de0 100644
 --- a/src/vs/workbench/contrib/search/browser/searchWidget.ts
 +++ b/src/vs/workbench/contrib/search/browser/searchWidget.ts
 @@ -47,5 +47,3 @@ import { IDisposable, MutableDisposable } from '../../../../base/common/lifecycl
@@ -3864,7 +3852,7 @@ index e9c0fcd..f3e23de 100644
 +			this.replaceInput.width = width - FONT.sidebarSize28;
  			this.replaceInput.inputBox.layout();
 diff --git a/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts b/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts
-index 21118dd..b5e53a1 100644
+index 21118dd7..b5e53a1d 100644
 --- a/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts
 +++ b/src/vs/workbench/contrib/terminal/browser/terminalTabsList.ts
 @@ -58,2 +58,3 @@ import { TerminalStorageKeys } from '../common/terminalStorageKeys.js';
@@ -3891,20 +3879,20 @@ index 21118dd..b5e53a1 100644
 +		inputBox.element.style.height = `${FONT.bottomPaneSize22}px`;
  		inputBox.value = value;
 diff --git a/src/vs/workbench/contrib/testing/browser/testCoverageView.ts b/src/vs/workbench/contrib/testing/browser/testCoverageView.ts
-index e19fc27..56e4bbc 100644
+index 02fdfa31..3bed1bbb 100644
 --- a/src/vs/workbench/contrib/testing/browser/testCoverageView.ts
 +++ b/src/vs/workbench/contrib/testing/browser/testCoverageView.ts
 @@ -16,2 +16,3 @@ import { memoize } from '../../../../base/common/decorators.js';
  import { FuzzyScore, createMatches } from '../../../../base/common/filters.js';
 +import { FONT } from '../../../../base/common/font.js';
  import { Iterable } from '../../../../base/common/iterator.js';
-@@ -429,3 +430,3 @@ class TestCoverageTreeListDelegate implements IListVirtualDelegate<CoverageTreeE
+@@ -440,3 +441,3 @@ class TestCoverageTreeListDelegate implements IListVirtualDelegate<CoverageTreeE
  	getHeight(element: CoverageTreeElement): number {
 -		return 22;
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts b/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts
-index 631bd2a..902bb81 100644
+index 631bd2a2..902bb810 100644
 --- a/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts
 +++ b/src/vs/workbench/contrib/testing/browser/testResultsView/testResultsOutput.ts
 @@ -34,3 +34,2 @@ import { PANEL_BACKGROUND, SIDE_BAR_BACKGROUND } from '../../../../common/theme.
@@ -3921,20 +3909,20 @@ index 631bd2a..902bb81 100644
 +		let delta = Math.max(0, evt.scrollTop - (this.hasMultipleFrames ? FONT.sidebarSize24 : 0));
  		delta = Math.min(Math.max(0, this.contentHeight - this.viewHeight), delta);
 diff --git a/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts b/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts
-index 9257aa6..3819205 100644
+index 20d4dbdb..b48d2e90 100644
 --- a/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts
 +++ b/src/vs/workbench/contrib/testing/browser/testingExplorerView.ts
 @@ -85,2 +85,3 @@ import { DebugLastRun, ReRunLastRun } from './testExplorerActions.js';
  import { TestingExplorerFilter } from './testingExplorerFilter.js';
 +import { FONT } from '../../../../base/common/font.js';
  
-@@ -1427,3 +1428,3 @@ class ListDelegate implements IListVirtualDelegate<TestExplorerTreeElement> {
+@@ -1431,3 +1432,3 @@ class ListDelegate implements IListVirtualDelegate<TestExplorerTreeElement> {
  	getHeight(element: TestExplorerTreeElement) {
 -		return element instanceof TestTreeErrorMessage ? 17 + 10 : 22;
 +		return element instanceof TestTreeErrorMessage ? FONT.sidebarSize17 + 10 : FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/timeline/browser/timelinePane.ts b/src/vs/workbench/contrib/timeline/browser/timelinePane.ts
-index c7c9cc7..84510c2 100644
+index 7219c099..7c6bc96c 100644
 --- a/src/vs/workbench/contrib/timeline/browser/timelinePane.ts
 +++ b/src/vs/workbench/contrib/timeline/browser/timelinePane.ts
 @@ -59,4 +59,3 @@ import { IHoverService, WorkbenchHoverDelegate } from '../../../../platform/hove
@@ -3948,13 +3936,13 @@ index c7c9cc7..84510c2 100644
 -			pageSize = Math.max(20, Math.floor((this.tree?.renderHeight ?? 0 / ItemHeight) + (this.pageOnScroll ? 1 : -1)));
 +			pageSize = Math.max(20, Math.floor((this.tree?.renderHeight ?? 0 / FONT.sidebarSize22) + (this.pageOnScroll ? 1 : -1)));
  		}
-@@ -1147,3 +1146,3 @@ export class TimelineListVirtualDelegate implements IListVirtualDelegate<TreeEle
+@@ -1148,3 +1147,3 @@ export class TimelineListVirtualDelegate implements IListVirtualDelegate<TreeEle
  	getHeight(_element: TreeElement): number {
 -		return ItemHeight;
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts b/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts
-index 27c6580..0feb646 100644
+index 27c65807..0feb6465 100644
 --- a/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts
 +++ b/src/vs/workbench/contrib/typeHierarchy/browser/typeHierarchyTree.ts
 @@ -17,2 +17,3 @@ import { localize } from '../../../../nls.js';
@@ -3967,7 +3955,7 @@ index 27c6580..0feb646 100644
 +		return FONT.sidebarSize22;
  	}
 diff --git a/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts b/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts
-index 9e6ca13..478e4e7 100644
+index 0e3e5ccd..c7d20959 100644
 --- a/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts
 +++ b/src/vs/workbench/contrib/welcomeAgentSessions/browser/agentSessionsWelcome.ts
 @@ -49,3 +49,2 @@ import { AgentSessionsControl, IAgentSessionsControlOptions } from '../../chat/b
@@ -3978,12 +3966,12 @@ index 9e6ca13..478e4e7 100644
  import { ILogService } from '../../../../platform/log/common/log.js';
 +import { FONT } from '../../../../base/common/font.js';
  
-@@ -826,3 +826,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
+@@ -830,3 +830,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
  		);
 -		const sessionsHeight = visibleSessions * AgentSessionsListDelegate.ITEM_HEIGHT;
 +		const sessionsHeight = visibleSessions * FONT.sidebarSize22;
  		this.sessionsControl.layout(sessionsHeight, sessionsWidth);
-@@ -831,3 +831,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
+@@ -835,3 +835,3 @@ export class AgentSessionsWelcomePage extends EditorPane {
  		// Visual height = ceil(n/2) * ITEM_HEIGHT, so offset = floor(n/2) * ITEM_HEIGHT
 -		const marginOffset = Math.floor(visibleSessions / 2) * AgentSessionsListDelegate.ITEM_HEIGHT;
 +		const marginOffset = Math.floor(visibleSessions / 2) * FONT.sidebarSize22;

patches/00-vsce-use-custom-lib.patch

@@ -1,5 +1,5 @@
 diff --git a/build/.moduleignore b/build/.moduleignore
-index ed36151..022d6ed 100644
+index f83624f8..00779f06 100644
 --- a/build/.moduleignore
 +++ b/build/.moduleignore
 @@ -82,7 +82,7 @@ native-is-elevated/deps/**
@@ -16,30 +16,30 @@ index ed36151..022d6ed 100644
 +!@vscodium/vsce-sign/bin/**
  
 diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
-index 187726c..076f08b 100644
+index 080d97f3..180177c5 100644
 --- a/build/gulpfile.vscode.ts
 +++ b/build/gulpfile.vscode.ts
-@@ -449,3 +449,3 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
+@@ -460,3 +460,3 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
  				'**/*.wasm',
 -				'**/@vscode/vsce-sign/bin/*',
 +				'**/@vscodium/vsce-sign/bin/*',
  			], [
 diff --git a/build/lib/extensions.ts b/build/lib/extensions.ts
-index aacf25c..c4b0391 100644
+index a25395c9..d87ff9aa 100644
 --- a/build/lib/extensions.ts
 +++ b/build/lib/extensions.ts
-@@ -116,3 +116,3 @@ export function typeCheckExtensionStream(extensionPath: string, forWeb: boolean)
+@@ -126,3 +126,3 @@ export function typeCheckExtensionStream(extensionPath: string, forWeb: boolean)
  function fromLocalNormal(extensionPath: string): Stream {
 -	const vsce = require('@vscode/vsce') as typeof import('@vscode/vsce');
 +	const vsce = require('@vscodium/vsce') as typeof import('@vscodium/vsce');
  	const result = es.through();
-@@ -138,3 +138,3 @@ function fromLocalNormal(extensionPath: string): Stream {
+@@ -148,3 +148,3 @@ function fromLocalNormal(extensionPath: string): Stream {
  function fromLocalEsbuild(extensionPath: string, esbuildConfigFileName: string): Stream {
 -	const vsce = require('@vscode/vsce') as typeof import('@vscode/vsce');
 +	const vsce = require('@vscodium/vsce') as typeof import('@vscodium/vsce');
  	const result = es.through();
 diff --git a/build/package-lock.json b/build/package-lock.json
-index 644e16f..fac5de0 100644
+index 92f3b6a4..420464b0 100644
 --- a/build/package-lock.json
 +++ b/build/package-lock.json
 @@ -51,3 +51,3 @@
@@ -64,9 +64,9 @@ index 644e16f..fac5de0 100644
 +      }
 +    },
 +    "node_modules/@vscode/vsce/node_modules/brace-expansion": {
-+      "version": "5.0.4",
-+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
-+      "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
++      "version": "5.0.5",
++      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
++      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
 +      "extraneous": true,
 +      "license": "MIT",
 +      "dependencies": {
@@ -260,7 +260,7 @@ index 644e16f..fac5de0 100644
      },
 -    "node_modules/@vscode/vsce/node_modules/brace-expansion": {
 +    "node_modules/@vscodium/vsce/node_modules/brace-expansion": {
-       "version": "5.0.4",
+       "version": "5.0.5",
 @@ -2172,3 +2065,3 @@
      },
 -    "node_modules/@vscode/vsce/node_modules/chalk": {
@@ -331,7 +331,7 @@ index 644e16f..fac5de0 100644
 -      }
 -    },
      "node_modules/@xmldom/xmldom": {
-@@ -7001,2 +6886,12 @@
+@@ -7022,2 +6907,12 @@
      },
 +    "node_modules/yazl": {
 +      "version": "2.5.1",
@@ -345,7 +345,7 @@ index 644e16f..fac5de0 100644
 +    },
      "node_modules/yocto-queue": {
 diff --git a/build/package.json b/build/package.json
-index 8a65120..a36d5c4 100644
+index 4746ea2f..49867df9 100644
 --- a/build/package.json
 +++ b/build/package.json
 @@ -45,3 +45,3 @@
@@ -354,7 +354,7 @@ index 8a65120..a36d5c4 100644
 +    "@vscodium/vsce": "3.6.1-258428",
      "ansi-colors": "^3.2.3",
 diff --git a/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts b/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts
-index 98535c5..cc37d7b 100644
+index 98535c5e..cc37d7b4 100644
 --- a/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts
 +++ b/src/vs/platform/extensionManagement/node/extensionSignatureVerificationService.ts
 @@ -69,3 +69,3 @@ export class ExtensionSignatureVerificationService implements IExtensionSignatur

patches/11-update-use-github-release.patch

@@ -1,14 +1,14 @@
 diff --git a/src/vs/platform/update/common/update.ts b/src/vs/platform/update/common/update.ts
-index bc90a03..f8885b9 100644
+index 92ae7b96..c3fe6214 100644
 --- a/src/vs/platform/update/common/update.ts
 +++ b/src/vs/platform/update/common/update.ts
-@@ -54,3 +54,4 @@ export const enum UpdateType {
+@@ -55,3 +55,4 @@ export const enum UpdateType {
  	Archive,
 -	Snap
 +	Snap,
 +	WindowsInstaller,
  }
-@@ -120 +121,38 @@ export interface IUpdateService {
+@@ -123 +124,38 @@ export interface IUpdateService {
  }
 +
 +export type Architecture =
@@ -49,17 +49,21 @@ index bc90a03..f8885b9 100644
 +	| "user";
 \ No newline at end of file
 diff --git a/src/vs/platform/update/electron-main/abstractUpdateService.ts b/src/vs/platform/update/electron-main/abstractUpdateService.ts
-index c943bca..1395594 100644
+index e13d1ba5..3767c907 100644
 --- a/src/vs/platform/update/electron-main/abstractUpdateService.ts
 +++ b/src/vs/platform/update/electron-main/abstractUpdateService.ts
-@@ -17,4 +17,4 @@ import { ILogService } from '../../log/common/log.js';
+@@ -17,3 +17,3 @@ import { ILogService } from '../../log/common/log.js';
  import { IProductService } from '../../product/common/productService.js';
 -import { IRequestService } from '../../request/common/request.js';
++import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
+ import { StorageScope, StorageTarget } from '../../storage/common/storage.js';
+@@ -21,3 +21,4 @@ import { IApplicationStorageMainService } from '../../storage/electron-main/stor
+ import { ITelemetryService } from '../../telemetry/common/telemetry.js';
 -import { AvailableForDownload, DisablementReason, IUpdateService, State, StateType, UpdateType } from '../common/update.js';
-+import { IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
-+import { Architecture, AvailableForDownload, DisablementReason, IUpdateService, Platform, State, StateType, Target, UpdateType } from '../common/update.js';
++import { Architecture, AvailableForDownload, DisablementReason, IUpdate, IUpdateService, Platform, State, StateType, Target, UpdateType } from '../common/update.js';
++import * as semver from 'semver';
  
-@@ -25,12 +25,8 @@ export interface IUpdateURLOptions {
+@@ -30,12 +31,8 @@ export interface IUpdateURLOptions {
  
 -export function createUpdateURL(baseUpdateUrl: string, platform: string, quality: string, commit: string, options?: IUpdateURLOptions): string {
 -	const url = new URL(`${baseUpdateUrl}/api/update/${platform}/${quality}/${commit}`);
@@ -77,30 +81,72 @@ index c943bca..1395594 100644
 -
 -	return url.toString();
  }
-@@ -322,3 +318,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+@@ -434,3 +431,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
  
 -		if (mode === 'none') {
 +		if (mode === 'none' || mode === 'manual') {
  			return undefined;
-@@ -336,3 +332,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
- 		try {
+@@ -444,18 +441,37 @@ export abstract class AbstractUpdateService implements IUpdateService {
+ 
++		return this._isLatestVersion(url, false)
++			.then((result) => {
++				return Promise.resolve(result ? result.lastest : result);
++			})
++			.then(undefined, (error) => {
++				this.logService.error('update#isLatestVersion(): failed to check for updates');
++				this.logService.error(error);
++
++				return Promise.resolve(undefined);
++			});
++	}
++
++	_isLatestVersion(url: string, explicit: boolean): Promise<{lastest: boolean, update: IUpdate} | undefined> {
+ 		const headers = getUpdateRequestHeaders(this.productService.version);
+-		this.logService.trace('update#isLatestVersion() - checking update server', { url, headers });
+ 
+-		try {
 -			const context = await this.requestService.request({ url, headers, callSite: 'updateService.isLatestVersion' }, token);
-+			const context = await this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, token);
- 			const statusCode = context.res.statusCode;
+-			const statusCode = context.res.statusCode;
+-			this.logService.trace('update#isLatestVersion() - response', { statusCode });
+-			// The update server replies with 204 (No Content) when no
+-			// update is available - that's all we want to know.
+-			return statusCode === 204;
++		this.logService.info('update#isLatestVersion() - checking update server', { url, headers });
+ 
+-		} catch (error) {
+-			this.logService.error('update#isLatestVersion(): failed to check for updates');
+-			this.logService.error(error);
+-			return undefined;
+-		}
++		return this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
++			.then<IUpdate | null>(asJson)
++			.then(update => {
++				if (!update || !update.url || !update.version || !update.productVersion) {
++					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
++
++					return Promise.resolve(undefined);
++				}
++
++				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3');
++				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3');
++
++				this.logService.info('update#isLatestVersion() - found version', fetchedVersion, currentVersion);
++
++				const lastest = semver.compareBuild(currentVersion, fetchedVersion) >= 0;
++
++				return Promise.resolve({ lastest, update });
++			})
+ 	}
 diff --git a/src/vs/platform/update/electron-main/updateService.darwin.ts b/src/vs/platform/update/electron-main/updateService.darwin.ts
-index 40b38a2..323919e 100644
+index 3ddb310e..26738a64 100644
 --- a/src/vs/platform/update/electron-main/updateService.darwin.ts
 +++ b/src/vs/platform/update/electron-main/updateService.darwin.ts
 @@ -16,3 +16,3 @@ import { ILogService } from '../../log/common/log.js';
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
 +import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
- import { ITelemetryService } from '../../telemetry/common/telemetry.js';
-@@ -22,2 +22,3 @@ import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdat
- import { INodeProcess } from '../../../base/common/platform.js';
-+import * as semver from 'semver';
- 
-@@ -99,15 +100,4 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+ import { IApplicationStorageMainService } from '../../storage/electron-main/storageMainService.js';
+@@ -101,15 +101,4 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string | undefined {
 -		const assetID = this.productService.darwinUniversalAssetId ?? (process.arch === 'x64' ? 'darwin' : 'darwin-arm64');
@@ -118,107 +164,130 @@ index 40b38a2..323919e 100644
 +	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string | undefined {
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch);
  	}
-@@ -154,3 +144,30 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
- 		this.logService.trace('update#doCheckForUpdates - using Electron autoUpdater', { url, explicit, background });
+@@ -145,4 +134,30 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+ 
+-		this.logService.trace('update#doCheckForUpdates - using Electron autoUpdater', { url, explicit, background });
 -		electron.autoUpdater.checkForUpdates();
-+		this.requestService.request({ url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
-+			.then<IUpdate | null>(asJson)
-+			.then(update => {
-+				if (!update || !update.url || !update.version || !update.productVersion) {
-+					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
 +
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
++				if(!result) {
 +					return Promise.resolve(null);
 +				}
 +
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
++				if(result.lastest) {
 +					this.setState(State.Idle(UpdateType.Setup, undefined, explicit || undefined));
 +				}
 +				else {
++					this.logService.info('update#doCheckForUpdates - using Electron autoUpdater');
++
 +					electron.autoUpdater.setFeedURL({ url });
 +					electron.autoUpdater.checkForUpdates();
 +				}
 +
 +				return Promise.resolve(null);
 +			})
-+			.then(undefined, err => {
-+				this.logService.error(err);
++			.then(undefined, (error) => {
++				this.logService.error(error);
++
 +				// only show message when explicitly checking for updates
-+				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
++
 +				this.setState(State.Idle(UpdateType.Setup, message));
 +			});
  	}
-@@ -167,3 +184,3 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
+@@ -159,3 +174,3 @@ export class DarwinUpdateService extends AbstractUpdateService implements IRelau
  		try {
 -			const context = await this.requestService.request({ url, headers, callSite: 'updateService.darwin.checkForUpdates' }, CancellationToken.None);
 +			const context = await this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None);
  			const statusCode = context.res.statusCode;
 diff --git a/src/vs/platform/update/electron-main/updateService.linux.ts b/src/vs/platform/update/electron-main/updateService.linux.ts
-index 0eb5d74..8ce708e 100644
+index 2be53f61..8776a7f6 100644
 --- a/src/vs/platform/update/electron-main/updateService.linux.ts
 +++ b/src/vs/platform/update/electron-main/updateService.linux.ts
-@@ -13,5 +13,6 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
+@@ -5,3 +5,2 @@
+ 
+-import { CancellationToken } from '../../../base/common/cancellation.js';
+ import { IConfigurationService } from '../../configuration/common/configuration.js';
+@@ -13,6 +12,6 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
-+import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
- import { AvailableForDownload, IUpdate, State, UpdateType } from '../common/update.js';
++import { IRequestService } from '../../request/common/request.js';
+ import { IApplicationStorageMainService } from '../../storage/electron-main/storageMainService.js';
+ import { ITelemetryService } from '../../telemetry/common/telemetry.js';
+-import { AvailableForDownload, IUpdate, State, UpdateType } from '../common/update.js';
++import { AvailableForDownload, State, UpdateType } from '../common/update.js';
  import { AbstractUpdateService, createUpdateURL, IUpdateURLOptions } from './abstractUpdateService.js';
-+import * as semver from 'semver';
- 
-@@ -32,4 +33,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
+@@ -36,4 +35,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string {
 -		return createUpdateURL(this.productService.updateUrl!, `linux-${process.arch}`, quality, commit, options);
 +	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string {
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch);
  	}
-@@ -46,3 +47,3 @@ export class LinuxUpdateService extends AbstractUpdateService {
+@@ -45,2 +44,4 @@ export class LinuxUpdateService extends AbstractUpdateService {
+ 
++		this.setState(State.CheckingForUpdates(explicit));
++
+ 		const internalOrg = this.getInternalOrg();
+@@ -48,17 +49,26 @@ export class LinuxUpdateService extends AbstractUpdateService {
+ 		const url = this.buildUpdateFeedUrl(this.quality, this.productService.commit!, { background, internalOrg });
+-		this.setState(State.CheckingForUpdates(explicit));
  
 -		this.requestService.request({ url, callSite: 'updateService.linux.checkForUpdates' }, CancellationToken.None)
-+		this.requestService.request({ url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
- 			.then<IUpdate | null>(asJson)
-@@ -51,5 +52,17 @@ export class LinuxUpdateService extends AbstractUpdateService {
- 					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
--				} else {
+-			.then<IUpdate | null>(asJson)
+-			.then(update => {
+-				if (!update || !update.url || !update.version || !update.productVersion) {
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
 +
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
++				if(!result) {
 +					return Promise.resolve(null);
 +				}
 +
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
-+					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
-+				}
-+				else {
- 					this.setState(State.AvailableForDownload(update));
++				if(result.lastest) {
+ 					this.setState(State.Idle(UpdateType.Archive, undefined, explicit || undefined));
+-				} else {
+-					this.setState(State.AvailableForDownload(update));
  				}
++				else {
++					this.setState(State.AvailableForDownload(result.update));
++				}
 +
 +				return Promise.resolve(null);
  			})
+-			.then(undefined, err => {
+-				this.logService.error(err);
++			.then(undefined, (error) => {
++				this.logService.error(error);
++
+ 				// only show message when explicitly checking for updates
+-				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
++
+ 				this.setState(State.Idle(UpdateType.Archive, message));
 diff --git a/src/vs/platform/update/electron-main/updateService.win32.ts b/src/vs/platform/update/electron-main/updateService.win32.ts
-index d02d7c3..4e8c541 100644
+index 222db559..0037e002 100644
 --- a/src/vs/platform/update/electron-main/updateService.win32.ts
 +++ b/src/vs/platform/update/electron-main/updateService.win32.ts
 @@ -14,3 +14,2 @@ import { CancellationToken, CancellationTokenSource } from '../../../base/common
  import { memoize } from '../../../base/common/decorators.js';
 -import { hash } from '../../../base/common/hash.js';
  import * as path from '../../../base/common/path.js';
-@@ -31,7 +30,8 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
+@@ -32,7 +31,7 @@ import { INativeHostMainService } from '../../native/electron-main/nativeHostMai
  import { IProductService } from '../../product/common/productService.js';
 -import { asJson, IRequestService } from '../../request/common/request.js';
-+import { asJson, IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
++import { IRequestService, NO_FETCH_TELEMETRY } from '../../request/common/request.js';
+ import { IApplicationStorageMainService } from '../../storage/electron-main/storageMainService.js';
  import { ITelemetryService } from '../../telemetry/common/telemetry.js';
 -import { AvailableForDownload, DisablementReason, IUpdate, State, StateType, UpdateType } from '../common/update.js';
 -import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdateURLOptions, UpdateErrorClassification } from './abstractUpdateService.js';
 +import { AvailableForDownload, DisablementReason, IUpdate, State, StateType, Target, UpdateType } from '../common/update.js';
-+import { AbstractUpdateService, createUpdateURL, getUpdateRequestHeaders, IUpdateURLOptions } from './abstractUpdateService.js';
- import { INodeProcess } from '../../../base/common/platform.js';
-+import * as semver from 'semver';
++import { AbstractUpdateService, createUpdateURL, IUpdateURLOptions } from './abstractUpdateService.js';
  
-@@ -49,5 +49,9 @@ function getUpdateType(): UpdateType {
+@@ -50,5 +49,9 @@ function getUpdateType(): UpdateType {
  	if (typeof _updateType === 'undefined') {
 -		_updateType = existsSync(path.join(path.dirname(process.execPath), 'unins000.exe'))
 -			? UpdateType.Setup
@@ -231,12 +300,12 @@ index d02d7c3..4e8c541 100644
 +			_updateType = UpdateType.Archive;
 +		}
  	}
-@@ -164,3 +168,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -158,3 +161,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  		} else {
 -			const fastUpdatesEnabled = this.configurationService.getValue('update.enableWindowsBackgroundUpdates');
 +			const fastUpdatesEnabled = getUpdateType() === UpdateType.Setup && this.configurationService.getValue('update.enableWindowsBackgroundUpdates');
  			// GC for background updates in system setup happens via inno_setup since it requires
-@@ -182,12 +186,22 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -178,12 +181,22 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
 -	protected buildUpdateFeedUrl(quality: string, commit: string, options?: IUpdateURLOptions): string | undefined {
 -		let platform = `win32-${process.arch}`;
@@ -245,7 +314,7 @@ index d02d7c3..4e8c541 100644
 -			platform += '-archive';
 -		} else if (this.productService.target === 'user') {
 -			platform += '-user';
-+	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string | undefined {
++	protected buildUpdateFeedUrl(quality: string, _commit: string, _options?: IUpdateURLOptions): string {
 +		let target: Target;
 +
 +		switch (getUpdateType()) {
@@ -267,32 +336,60 @@ index d02d7c3..4e8c541 100644
 -		return createUpdateURL(this.productService.updateUrl!, platform, quality, commit, options);
 +		return createUpdateURL(this.productService, quality, process.platform, process.arch, target);
  	}
-@@ -209,3 +223,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
- 		const headers = getUpdateRequestHeaders(this.productService.version);
--		this.requestService.request({ url, headers, callSite: 'updateService.win32.checkForUpdates' }, CancellationToken.None)
-+		this.requestService.request({ url, headers, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
- 			.then<IUpdate | null>(asJson)
-@@ -226,2 +240,10 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -195,6 +208,2 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
-+				const fetchedVersion = /\d+\.\d+\.\d+\.\d+/.test(update.productVersion) ? update.productVersion.replace(/(\d+\.\d+\.\d+)\.\d+(\-\w+)?/, '$1$2') : update.productVersion.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
-+				const currentVersion = this.productService.version.replace(/(\d+\.\d+\.)0+(\d+)(\-\w+)?/, '$1$2$3')
+-		const internalOrg = this.getInternalOrg();
+-		const background = !explicit && !internalOrg;
+-		const url = this.buildUpdateFeedUrl(this.quality, pendingCommit ?? this.productService.commit!, { background, internalOrg });
+-
+ 		// Only set CheckingForUpdates if we're not already in Overwriting state
+@@ -204,9 +213,13 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 
+-		const headers = getUpdateRequestHeaders(this.productService.version);
+-		this.requestService.request({ url, headers, callSite: 'updateService.win32.checkForUpdates' }, CancellationToken.None)
+-			.then<IUpdate | null>(asJson)
+-			.then(update => {
++		const internalOrg = this.getInternalOrg();
++		const background = !explicit && !internalOrg;
++		const url = this.buildUpdateFeedUrl(this.quality, pendingCommit ?? this.productService.commit!, { background, internalOrg });
 +
-+				if(semver.compareBuild(currentVersion, fetchedVersion) >= 0) {
++		this.logService.info('update#doCheckForUpdates', { url, explicit, background });
++
++		this._isLatestVersion(url, explicit)
++			.then((result) => {
+ 				const updateType = getUpdateType();
+ 
+-				if (!update || !update.url || !update.version || !update.productVersion) {
++				if(!result) {
+ 					// If we were checking for an overwrite update and found nothing newer,
+@@ -222,2 +235,9 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 
++				const { lastest, update } = result;
++
++				if(lastest) {
 +					this.setState(State.Idle(updateType, undefined, explicit || undefined));
 +					return Promise.resolve(null);
 +				}
 +
  				if (updateType === UpdateType.Archive) {
-@@ -258,3 +280,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+@@ -247,3 +267,3 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  
 -							return this.requestService.request({ url: update.url, callSite: 'updateService.win32.downloadUpdate' }, CancellationToken.None)
 +							return this.requestService.request({ url: update.url, callSite: NO_FETCH_TELEMETRY }, CancellationToken.None)
  								.then(context => {
-@@ -304,3 +326,2 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
- 			.then(undefined, err => {
+@@ -292,8 +312,7 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+ 			})
+-			.then(undefined, err => {
 -				this.telemetryService.publicLog2<{ messageHash: string }, UpdateErrorClassification>('update:error', { messageHash: String(hash(String(err))) });
- 				this.logService.error(err);
-@@ -368,20 +389,31 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
+-				this.logService.error(err);
++			.then(undefined, (error) => {
++				this.logService.error(error);
+ 
+ 				// only show message when explicitly checking for updates
+-				const message: string | undefined = explicit ? (err.message || err) : undefined;
++				const message: string | undefined = explicit ? (error.message || error) : undefined;
+ 
+@@ -357,20 +376,31 @@ export class Win32UpdateService extends AbstractUpdateService implements IRelaun
  		await pfs.Promises.writeFile(this.availableUpdate.updateFilePath, 'flag');
 -		const child = spawn(this.availableUpdate.packagePath,
 -			[

patches/12-update-add-cooldown.patch

@@ -0,0 +1,52 @@
+diff --git a/src/vs/platform/update/common/update.config.contribution.ts b/src/vs/platform/update/common/update.config.contribution.ts
+index 6061e15b..84246033 100644
+--- a/src/vs/platform/update/common/update.config.contribution.ts
++++ b/src/vs/platform/update/common/update.config.contribution.ts
+@@ -65,2 +65,8 @@ configurationRegistry.registerConfiguration({
+ 		},
++		'update.minReleaseAge': {
++			type: 'integer',
++			default: 7,
++			scope: ConfigurationScope.APPLICATION,
++			description: localize('update.cooldown', "Configure how old an update need to be before installing it (in days)."),
++		},
+ 		'update.enableWindowsBackgroundUpdates': {
+diff --git a/src/vs/platform/update/electron-main/abstractUpdateService.ts b/src/vs/platform/update/electron-main/abstractUpdateService.ts
+index 3767c907..9b3c17bf 100644
+--- a/src/vs/platform/update/electron-main/abstractUpdateService.ts
++++ b/src/vs/platform/update/electron-main/abstractUpdateService.ts
+@@ -470,3 +470,3 @@ export abstract class AbstractUpdateService implements IUpdateService {
+ 
+-				this.logService.info('update#isLatestVersion() - found version', fetchedVersion, currentVersion);
++				this.logService.info(`update#isLatestVersion() - found: ${fetchedVersion}, current: ${currentVersion}`);
+ 
+@@ -474,3 +474,28 @@ export abstract class AbstractUpdateService implements IUpdateService {
+ 
+-				return Promise.resolve({ lastest, update });
++				const minReleaseAge = this.configurationService.getValue<number>('update.minReleaseAge');
++
++				if(minReleaseAge === 0) {
++					return Promise.resolve({ lastest, update });
++				}
++
++				this.logService.info(`update#isLatestVersion() - ${update.timestamp} ${typeof update.timestamp}`);
++
++				const releaseDate = update.timestamp ? new Date(Number.parseInt(String(update.timestamp), 10)) : null;
++
++				this.logService.info(`update#isLatestVersion() - releaseDate: ${releaseDate}`);
++
++				if(!releaseDate || isNaN(releaseDate.getTime())) {
++					return Promise.resolve(undefined);
++				}
++
++				const age = Math.round(Math.abs(Date.now() - releaseDate.getTime()) / (1000 * 60 * 60 * 24));
++
++				this.logService.info(`update#isLatestVersion() - releaseAge: ${age}, minReleaseAge: ${minReleaseAge}`);
++
++				if(age >= minReleaseAge) {
++					return Promise.resolve({ lastest, update });
++				}
++				else {
++					return Promise.resolve(undefined);
++				}
+ 			})

patches/20-keymap-use-custom-lib.patch

@@ -1,5 +1,5 @@
 diff --git a/.npmrc b/.npmrc
-index a275846..87f881f 100644
+index 8255ca3e..98dc0d47 100644
 --- a/.npmrc
 +++ b/.npmrc
 @@ -6,2 +6,3 @@ ignore-scripts=false
@@ -7,7 +7,7 @@ index a275846..87f881f 100644
 +build_from_source_native_keymap="no"
  legacy-peer-deps="true"
 diff --git a/build/.moduleignore b/build/.moduleignore
-index ed36151..5b040cc 100644
+index f83624f8..aaa384bf 100644
 --- a/build/.moduleignore
 +++ b/build/.moduleignore
 @@ -65,7 +65,7 @@ fsevents/test/**
@@ -24,27 +24,27 @@ index ed36151..5b040cc 100644
 +!@vscodium/native-keymap/build/Release/*.node
  
 diff --git a/eslint.config.js b/eslint.config.js
-index 73f062a..f008259 100644
+index 51bda2c3..494a2c2c 100644
 --- a/eslint.config.js
 +++ b/eslint.config.js
-@@ -1481,3 +1481,3 @@ export default tseslint.config(
+@@ -1526,3 +1526,3 @@ export default tseslint.config(
  						'node:module',
 -						'native-keymap',
 +						'@vscodium/native-keymap',
  						'net',
 diff --git a/package-lock.json b/package-lock.json
-index bc72a21..ae566c1 100644
+index 75b98719..88c2aee4 100644
 --- a/package-lock.json
 +++ b/package-lock.json
-@@ -32,2 +32,3 @@
+@@ -39,2 +39,3 @@
          "@vscode/windows-registry": "^1.2.0",
 +        "@vscodium/native-keymap": "3.3.7-258424",
-         "@xterm/addon-clipboard": "^0.3.0-beta.191",
-@@ -49,3 +50,2 @@
+         "@xterm/addon-clipboard": "^0.3.0-beta.197",
+@@ -56,3 +57,2 @@
          "native-is-elevated": "0.9.0",
 -        "native-keymap": "^3.3.5",
-         "node-pty": "^1.2.0-beta.10",
-@@ -4862,2 +4862,9 @@
+         "node-pty": "^1.2.0-beta.12",
+@@ -4168,2 +4168,9 @@
      },
 +    "node_modules/@vscodium/native-keymap": {
 +      "version": "3.3.7-258424",
@@ -54,7 +54,7 @@ index bc72a21..ae566c1 100644
 +      "license": "MIT"
 +    },
      "node_modules/@wdio/config": {
-@@ -15159,5 +15166,6 @@
+@@ -14280,5 +14287,6 @@
      "node_modules/napi-build-utils": {
 -      "version": "1.0.2",
 -      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.2.tgz",
@@ -64,7 +64,7 @@ index bc72a21..ae566c1 100644
 +      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
 +      "license": "MIT"
      },
-@@ -15170,9 +15178,2 @@
+@@ -14291,9 +14299,2 @@
      },
 -    "node_modules/native-keymap": {
 -      "version": "3.3.9",
@@ -74,7 +74,7 @@ index bc72a21..ae566c1 100644
 -      "license": "MIT"
 -    },
      "node_modules/natural-compare": {
-@@ -16693,5 +16694,6 @@
+@@ -15805,5 +15806,6 @@
      "node_modules/prebuild-install": {
 -      "version": "7.1.2",
 -      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.2.tgz",
@@ -84,22 +84,22 @@ index bc72a21..ae566c1 100644
 +      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
 +      "license": "MIT",
        "dependencies": {
-@@ -16702,3 +16704,3 @@
+@@ -15814,3 +15816,3 @@
          "mkdirp-classic": "^0.5.3",
 -        "napi-build-utils": "^1.0.1",
 +        "napi-build-utils": "^2.0.0",
          "node-abi": "^3.3.0",
 diff --git a/package.json b/package.json
-index d727d5a..54d14ad 100644
+index b925a690..166f0cae 100644
 --- a/package.json
 +++ b/package.json
-@@ -119,3 +119,3 @@
+@@ -133,3 +133,3 @@
      "native-is-elevated": "0.9.0",
 -    "native-keymap": "^3.3.5",
 +    "@vscodium/native-keymap": "3.3.7-258424",
-     "node-pty": "^1.2.0-beta.10",
+     "node-pty": "^1.2.0-beta.12",
 diff --git a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
-index c30c6da..ca6cea2 100644
+index c30c6da5..ca6cea22 100644
 --- a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 +++ b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 @@ -44,8 +44,8 @@ flakySuite('Native Modules (all platforms)', () => {
@@ -116,7 +116,7 @@ index c30c6da..ca6cea2 100644
 +		assert.ok(result, testErrorMessage('@vscodium/native-keymap'));
  	});
 diff --git a/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts b/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts
-index 8950ce2..f31cea6 100644
+index 8950ce21..f31cea62 100644
 --- a/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts
 +++ b/src/vs/platform/keyboardLayout/electron-main/keyboardLayoutMainService.ts
 @@ -5,3 +5,3 @@

patches/21-policy-use-custom-lib.patch

@@ -1,10 +1,8 @@
-# Fix: Replace @vscode/policy-watcher with @vscodium/policy-watcher
-# Documentation: docs/patches.md#fix-policies
 diff --git a/build/.moduleignore b/build/.moduleignore
-index 5b040cc..8d5fd71 100644
+index aaa384bf..25adcdbf 100644
 --- a/build/.moduleignore
 +++ b/build/.moduleignore
-@@ -128,9 +128,11 @@ vsda/**
+@@ -153,9 +153,11 @@ vsda/**
  
 -@vscode/policy-watcher/build/**
 -@vscode/policy-watcher/.husky/**
@@ -24,7 +22,7 @@ index 5b040cc..8d5fd71 100644
 +!@vscodium/policy-watcher/build/Release/vscodium-policy-watcher.node
  
 diff --git a/build/lib/policies/basePolicy.ts b/build/lib/policies/basePolicy.ts
-index 7f650ba..db927cb 100644
+index 7f650ba7..db927cb4 100644
 --- a/build/lib/policies/basePolicy.ts
 +++ b/build/lib/policies/basePolicy.ts
 @@ -38,3 +38,3 @@ export abstract class BasePolicy implements Policy {
@@ -33,7 +31,7 @@ index 7f650ba..db927cb 100644
 +			`<policy name="${this.name}" class="Both" displayName="$(string.${this.name})" explainText="$(string.${this.name}_${this.description.nlsKey.replace(/\./g, '_')})" key="Software\\Policies\\!!ORG_NAME!!\\${regKey}" presentation="$(presentation.${this.name})">`,
  			`	<parentCategory ref="${this.category.name.nlsKey}" />`,
 diff --git a/build/lib/policies/render.ts b/build/lib/policies/render.ts
-index 47b485d..8437fd4 100644
+index 47b485d1..8437fd47 100644
 --- a/build/lib/policies/render.ts
 +++ b/build/lib/policies/render.ts
 @@ -49,3 +49,3 @@ export function renderADMX(regKey: string, versions: string[], categories: Categ
@@ -67,27 +65,27 @@ index 47b485d..8437fd4 100644
 +		<string>!!ORG_NAME!!</string>
  		<key>PayloadType</key>
 diff --git a/eslint.config.js b/eslint.config.js
-index f008259..f87fda1 100644
+index 494a2c2c..c53b46aa 100644
 --- a/eslint.config.js
 +++ b/eslint.config.js
-@@ -1464,3 +1464,3 @@ export default tseslint.config(
+@@ -1509,3 +1509,3 @@ export default tseslint.config(
  						'@vscode/native-watchdog',
 -						'@vscode/policy-watcher',
 +						'@vscodium/policy-watcher',
  						'@vscode/proxy-agent',
 diff --git a/package-lock.json b/package-lock.json
-index ae566c1..3b3a5dd 100644
+index 88c2aee4..d8852aa8 100644
 --- a/package-lock.json
 +++ b/package-lock.json
-@@ -21,3 +21,2 @@
+@@ -28,3 +28,2 @@
          "@vscode/native-watchdog": "^1.4.6",
 -        "@vscode/policy-watcher": "^1.3.2",
-         "@vscode/proxy-agent": "^0.39.1",
-@@ -33,2 +32,3 @@
+         "@vscode/proxy-agent": "^0.41.0",
+@@ -40,2 +39,3 @@
          "@vscodium/native-keymap": "3.3.7-258424",
 +        "@vscodium/policy-watcher": "^1.3.2-252465",
-         "@xterm/addon-clipboard": "^0.3.0-beta.191",
-@@ -4538,22 +4538,2 @@
+         "@xterm/addon-clipboard": "^0.3.0-beta.197",
+@@ -3844,22 +3844,2 @@
      },
 -    "node_modules/@vscode/policy-watcher": {
 -      "version": "1.3.7",
@@ -110,7 +108,7 @@ index ae566c1..3b3a5dd 100644
 -      }
 -    },
      "node_modules/@vscode/proxy-agent": {
-@@ -4869,2 +4849,22 @@
+@@ -4175,2 +4155,22 @@
      },
 +    "node_modules/@vscodium/policy-watcher": {
 +      "version": "1.3.2-255408",
@@ -134,16 +132,16 @@ index ae566c1..3b3a5dd 100644
 +    },
      "node_modules/@wdio/config": {
 diff --git a/package.json b/package.json
-index 54d14ad..47778c2 100644
+index 166f0cae..51cd5977 100644
 --- a/package.json
 +++ b/package.json
-@@ -91,3 +91,3 @@
+@@ -105,3 +105,3 @@
      "@vscode/native-watchdog": "^1.4.6",
 -    "@vscode/policy-watcher": "^1.3.2",
 +    "@vscodium/policy-watcher": "^1.3.2-252465",
-     "@vscode/proxy-agent": "^0.39.1",
+     "@vscode/proxy-agent": "^0.41.0",
 diff --git a/src/vs/base/test/node/uri.perf.data.txt b/src/vs/base/test/node/uri.perf.data.txt
-index ee0a24b..881ce36 100644
+index ee0a24b5..881ce36a 100644
 --- a/src/vs/base/test/node/uri.perf.data.txt
 +++ b/src/vs/base/test/node/uri.perf.data.txt
 @@ -14698,48 +14698,48 @@
@@ -242,7 +240,7 @@ index ee0a24b..881ce36 100644
 +/Users/example/node_modules/@vscodium/policy-watcher/src/windows/NumberPolicy.hh
  /Users/example/node_modules/@vscode/vscode-languagedetection/CODE_OF_CONDUCT.md
 diff --git a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
-index ca6cea2..32b22fe 100644
+index ca6cea22..32b22fed 100644
 --- a/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 +++ b/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
 @@ -62,5 +62,5 @@ flakySuite('Native Modules (all platforms)', () => {
@@ -255,7 +253,7 @@ index ca6cea2..32b22fe 100644
 +		assert.ok(typeof watcher.createWatcher === 'function', testErrorMessage('@vscodium/policy-watcher'));
  	});
 diff --git a/src/vs/platform/policy/node/nativePolicyService.ts b/src/vs/platform/policy/node/nativePolicyService.ts
-index feb4ba1..4d9e0c3 100644
+index 6039dbb7..f2ea09cf 100644
 --- a/src/vs/platform/policy/node/nativePolicyService.ts
 +++ b/src/vs/platform/policy/node/nativePolicyService.ts
 @@ -8,3 +8,3 @@ import { IStringDictionary } from '../../../base/common/collections.js';
@@ -268,8 +266,8 @@ index feb4ba1..4d9e0c3 100644
 -		const { createWatcher } = await import('@vscode/policy-watcher');
 +		const { createWatcher } = await import('@vscodium/policy-watcher');
  
-@@ -31,3 +31,3 @@ export class NativePolicyService extends AbstractPolicyService implements IPolic
- 			try {
+@@ -32,3 +32,3 @@ export class NativePolicyService extends AbstractPolicyService implements IPolic
+ 				this.logService.trace(`Creating watcher for productName ${this.productName}`);
 -				this.watcher.value = createWatcher(this.productName, policyDefinitions, update => {
 +				this.watcher.value = createWatcher('VSCodium', this.productName, policyDefinitions, update => {
  					this._onDidPolicyChange(update);

patches/40-cli-use-reh-archive.patch

@@ -1,5 +1,5 @@
 diff --git a/cli/src/commands/serve_web.rs b/cli/src/commands/serve_web.rs
-index d3f7db8..988024b 100644
+index d3a9a88a..7cf60f0b 100644
 --- a/cli/src/commands/serve_web.rs
 +++ b/cli/src/commands/serve_web.rs
 @@ -756,3 +756,3 @@ impl ConnectionManager {
@@ -13,10 +13,10 @@ index d3f7db8..988024b 100644
 +			.join(args.release.quality.server_entrypoint().unwrap());
  
 diff --git a/cli/src/constants.rs b/cli/src/constants.rs
-index 1e277a8..97f17d3 100644
+index 9e2b066d..974ee57c 100644
 --- a/cli/src/constants.rs
 +++ b/cli/src/constants.rs
-@@ -35,3 +35,6 @@ pub const DOCUMENTATION_URL: Option<&'static str> = option_env!("VSCODE_CLI_DOCU
+@@ -37,3 +37,6 @@ pub const DOCUMENTATION_URL: Option<&'static str> = option_env!("VSCODE_CLI_DOCU
  pub const VSCODE_CLI_COMMIT: Option<&'static str> = option_env!("VSCODE_CLI_COMMIT");
 -pub const VSCODE_CLI_UPDATE_ENDPOINT: Option<&'static str> = option_env!("VSCODE_CLI_UPDATE_URL");
 +pub const VSCODE_CLI_UPDATE_ENDPOINT: Option<&'static str> = option_env!("VSCODE_CLI_UPDATE_ENDPOINT");
@@ -25,7 +25,7 @@ index 1e277a8..97f17d3 100644
 +pub const VSCODE_CLI_BINARY_NAME: Option<&'static str> = option_env!("VSCODE_CLI_BINARY_NAME");
  
 diff --git a/cli/src/options.rs b/cli/src/options.rs
-index 7d152c0..c0f2fb2 100644
+index 7d152c0e..c0f2fb2e 100644
 --- a/cli/src/options.rs
 +++ b/cli/src/options.rs
 @@ -9,3 +9,3 @@ use serde::{Deserialize, Serialize};
@@ -57,8 +57,17 @@ index 7d152c0..c0f2fb2 100644
 -		server_name
 +		Ok(server_name)
  	}
+diff --git a/cli/src/tunnels/agent_host.rs b/cli/src/tunnels/agent_host.rs
+index 9d1f240c..2e67da43 100644
+--- a/cli/src/tunnels/agent_host.rs
++++ b/cli/src/tunnels/agent_host.rs
+@@ -162,3 +162,3 @@ impl AgentHostManager {
+ 				.join("bin")
+-				.join(release.quality.server_entrypoint())
++				.join(release.quality.server_entrypoint().unwrap())
+ 		};
 diff --git a/cli/src/tunnels/code_server.rs b/cli/src/tunnels/code_server.rs
-index bbabadc..b454d0e 100644
+index bbabadcf..b454d0ea 100644
 --- a/cli/src/tunnels/code_server.rs
 +++ b/cli/src/tunnels/code_server.rs
 @@ -462,3 +462,3 @@ impl<'a> ServerBuilder<'a> {
@@ -67,7 +76,7 @@ index bbabadc..b454d0e 100644
 +							.join(self.server_params.release.quality.server_entrypoint().unwrap()),
  						&["--version"],
 diff --git a/cli/src/tunnels/paths.rs b/cli/src/tunnels/paths.rs
-index 3d7d718..98529bc 100644
+index 3d7d718a..98529bc6 100644
 --- a/cli/src/tunnels/paths.rs
 +++ b/cli/src/tunnels/paths.rs
 @@ -100,3 +100,3 @@ impl InstalledServer {
@@ -76,7 +85,7 @@ index 3d7d718..98529bc 100644
 +					.join(self.quality.server_entrypoint().unwrap())
  			},
 diff --git a/cli/src/update_service.rs b/cli/src/update_service.rs
-index 55f1dad..3b7ef5c 100644
+index 55f1dadc..3b7ef5c4 100644
 --- a/cli/src/update_service.rs
 +++ b/cli/src/update_service.rs
 @@ -10,3 +10,3 @@ use serde::{Deserialize, Serialize};
@@ -303,7 +312,7 @@ index 55f1dad..3b7ef5c 100644
 -
  	pub fn env_default() -> Option<Platform> {
 diff --git a/extensions/tunnel-forwarding/src/extension.ts b/extensions/tunnel-forwarding/src/extension.ts
-index 2f71999..e689f62 100644
+index 2f71999b..e689f628 100644
 --- a/extensions/tunnel-forwarding/src/extension.ts
 +++ b/extensions/tunnel-forwarding/src/extension.ts
 @@ -37,3 +37,3 @@ if (process.env.VSCODE_FORWARDING_IS_DEV) {

patches/50-build-improve-gulp-tasks.patch

@@ -0,0 +1,55 @@
+diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
+index 080d97f3..93b5f711 100644
+--- a/build/gulpfile.vscode.ts
++++ b/build/gulpfile.vscode.ts
+@@ -30,3 +30,3 @@ import { createAsar } from './lib/asar.ts';
+ import minimist from 'minimist';
+-import { compileBuildWithoutManglingTask, compileBuildWithManglingTask } from './gulpfile.compile.ts';
++import { compileBuildWithoutManglingTask } from './gulpfile.compile.ts';
+ import { compileNonNativeExtensionsBuildTask, compileNativeExtensionsBuildTask, compileAllExtensionsBuildTask, compileExtensionMediaBuildTask, cleanExtensionsBuildTask, compileCopilotExtensionBuildTask } from './gulpfile.extensions.ts';
+@@ -197,3 +197,2 @@ function runEsbuildBundle(outDir: string, minify: boolean, nls: boolean, target:
+ 			args.push('--minify');
+-			args.push('--mangle-privates');
+ 		}
+@@ -757,3 +756,4 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 			);
+-			vscodeTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}`, task.series(
++
++			const prepackTask = task.define(`vscode${dashed(minified)}-prepack`, task.series(
+ 				copyCodiconsTask,
+@@ -763,2 +763,6 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 				compileExtensionMediaBuildTask,
++			));
++			gulp.task(prepackTask);
++
++			const packingTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}-packing`, task.series(
+ 				writeISODate('out-build'),
+@@ -767,5 +771,11 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 			));
+-		} else {
++			gulp.task(packingTask);
++
+ 			vscodeTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}`, task.series(
+-				minified ? compileBuildWithManglingTask : compileBuildWithoutManglingTask,
++				prepackTask,
++				packingTask,
++			));
++		} else {
++			const prepackTask = task.define(`vscode${dashed(minified)}-prepack`, task.series(
++				compileBuildWithoutManglingTask,
+ 				cleanExtensionsBuildTask,
+@@ -775,4 +785,14 @@ BUILD_TARGETS.forEach(buildTarget => {
+ 				minified ? minifyVSCodeTask : bundleVSCodeTask,
++			));
++			gulp.task(prepackTask);
++
++			const packingTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}-packing`, task.series(
+ 				vscodeTaskCI
+ 			));
++			gulp.task(packingTask);
++
++			vscodeTask = task.define(`vscode${dashed(platform)}${dashed(arch)}${dashed(minified)}`, task.series(
++				prepackTask,
++				packingTask,
++			));
+ 		}

patches/disable-copilot.patch

@@ -1,133 +0,0 @@
-diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
-index 1998414..cdc533b 100644
---- a/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
-+++ b/src/vs/workbench/contrib/chat/browser/actions/chatActions.ts
-@@ -206,3 +206,4 @@ abstract class OpenChatGlobalAction extends Action2 {
- 				ChatContextKeys.Setup.hidden.negate(),
--				ChatContextKeys.Setup.disabled.negate()
-+				ChatContextKeys.Setup.disabled.negate(),
-+				ContextKeyExpr.has('config.chat.disableAIFeatures').negate()
- 			)
-@@ -1142,3 +1143,3 @@ export function registerChatActions() {
- 				precondition: ContextKeyExpr.and(
--					ChatContextKeys.Setup.installed,
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 					ChatContextKeys.Setup.disabled.negate(),
-@@ -1715,3 +1716,4 @@ MenuRegistry.appendMenuItem(MenuId.EditorContext, {
- 		ChatContextKeys.Setup.hidden.negate(),
--		ChatContextKeys.Setup.disabled.negate()
-+		ChatContextKeys.Setup.disabled.negate(),
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate()
- 	)
-diff --git a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
-index b8c8e03..512e40f 100644
---- a/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
-+++ b/src/vs/workbench/contrib/chat/browser/actions/chatContextActions.ts
-@@ -314,3 +314,4 @@ class AttachSelectionToChatAction extends Action2 {
- 						ResourceContextKey.Scheme.isEqualTo(Schemas.vscodeUserData)
--					)
-+					),
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 				)
-diff --git a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
-index be62dda..7b5f1ed 100644
---- a/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chat.contribution.ts
-@@ -1237,3 +1237,3 @@ configurationRegistry.registerConfiguration({
- 			description: nls.localize('chat.disableAIFeatures', "Disable and hide built-in AI features provided by GitHub Copilot, including chat and inline suggestions."),
--			default: false,
-+			default: true,
- 			scope: ConfigurationScope.WINDOW
-diff --git a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
-index ddb5df4..7831288 100644
---- a/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chatParticipant.contribution.ts
-@@ -70,10 +70,9 @@ const chatViewDescriptor: IViewDescriptor = {
- 	ctorDescriptor: new SyncDescriptor(ChatViewPane),
--	when: ContextKeyExpr.or(
--		ContextKeyExpr.or(
--			ChatContextKeys.Setup.hidden,
--			ChatContextKeys.Setup.disabled
--		)?.negate(),
--		ChatContextKeys.panelParticipantRegistered,
--		ChatContextKeys.extensionInvalid
--	)
-+	when: ContextKeyExpr.and(
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
-+		ChatContextKeys.Setup.disabled.negate(),
-+		ChatContextKeys.Setup.hidden.negate(),
-+ 		ChatContextKeys.panelParticipantRegistered,
-+		ChatContextKeys.extensionInvalid.negate()
-+ 	)
- };
-diff --git a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
-index 4a71579..f8b3e83 100644
---- a/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
-+++ b/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts
-@@ -228,2 +228,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
- 						ChatContextKeys.Setup.untrusted,
-+						ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 						ChatContextKeys.Setup.installed.negate(),
-@@ -346,2 +347,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
- 							ChatContextKeys.Setup.hidden.negate(),
-+							ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 							ChatContextKeys.Setup.installed.negate(),
-@@ -518,2 +520,3 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
- 			ChatContextKeys.Setup.disabled.negate(),
-+			ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 			ChatContextKeys.Setup.installed.negate(),
-diff --git a/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts b/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts
-index c8fc17b..fbd2afd 100644
---- a/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts
-+++ b/src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts
-@@ -163,3 +163,3 @@ export namespace ChatContextKeyExprs {
- 	export const chatSetupTriggerContext = ContextKeyExpr.or(
--		ChatContextKeys.Setup.installed.negate(),
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 		ChatContextKeys.Entitlement.canSignUp
-diff --git a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
-index e9b4077..b33d6f2 100644
---- a/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
-+++ b/src/vs/workbench/contrib/inlineChat/browser/inlineChatActions.ts
-@@ -133,3 +133,9 @@ MenuRegistry.appendMenuItem(MenuId.InlineChatEditorAffordance, {
- 	order: 1,
--	when: ContextKeyExpr.and(EditorContextKeys.writable, EditorContextKeys.hasNonEmptySelection, CTX_INLINE_CHAT_FILE_BELONGS_TO_CHAT.negate(), ChatEntitlementContextKeys.Setup.hidden.negate()),
-+	when: ContextKeyExpr.and(
-+		EditorContextKeys.writable,
-+		EditorContextKeys.hasNonEmptySelection,
-+		CTX_INLINE_CHAT_FILE_BELONGS_TO_CHAT.negate(),
-+		ChatEntitlementContextKeys.Setup.hidden.negate(),
-+		ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
-+	),
- 	command: {
-diff --git a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
-index 864cc4f..b877a8e 100644
---- a/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
-+++ b/src/vs/workbench/contrib/mcp/browser/mcpServersView.ts
-@@ -554,3 +554,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
- 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{}]),
--				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
-+				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyExpr.or(ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`), ProductQualityContext.notEqualsTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`))),
- 				weight: 40,
-@@ -569,3 +569,3 @@ export class McpServersViewsContribution extends Disposable implements IWorkbenc
- 				ctorDescriptor: new SyncDescriptor(DefaultBrowseMcpServersView, [{ showWelcome: true }]),
--				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
-+				when: ContextKeyExpr.and(DefaultViewsContext, HasInstalledMcpServersContext.toNegated(), ContextKeyExpr.has('config.chat.disableAIFeatures').negate(), ChatContextKeys.Setup.hidden.negate(), McpServersGalleryStatusContext.isEqualTo(McpGalleryManifestStatus.Available), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceUrlConfig}`).negate(), ProductQualityContext.isEqualTo('stable'), ContextKeyDefinedExpr.create(`config.${mcpGalleryServiceEnablementConfig}`).negate()),
- 				weight: 40,
-diff --git a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
-index 8f2ea73..429e28f 100644
---- a/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
-+++ b/src/vs/workbench/contrib/scm/browser/scm.contribution.ts
-@@ -705,3 +705,3 @@ registerAction2(class extends Action2 {
- 					ChatContextKeys.Setup.disabled.negate(),
--					ChatContextKeys.Setup.installed.negate(),
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 					ContextKeyExpr.in(ResourceContextKey.Resource.key, 'git.mergeChanges'),
-diff --git a/src/vs/workbench/contrib/scm/browser/scmInput.ts b/src/vs/workbench/contrib/scm/browser/scmInput.ts
-index a35d479..da5a449 100644
---- a/src/vs/workbench/contrib/scm/browser/scmInput.ts
-+++ b/src/vs/workbench/contrib/scm/browser/scmInput.ts
-@@ -850,2 +850,3 @@ registerAction2(class extends Action2 {
- 					ChatContextKeys.Setup.disabled.negate(),
-+					ContextKeyExpr.has('config.chat.disableAIFeatures').negate(),
- 					ChatContextKeys.Setup.installed.negate(),

patches/insider/system-extensions.patch

@@ -1,13 +1,13 @@
 diff --git a/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts b/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-index 150908a..0759a8d 100644
+index 58422886..a1eac31e 100644
 --- a/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ b/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -104,2 +104,3 @@ export class Extension implements IExtension {
+@@ -112,2 +112,3 @@ export class Extension implements IExtension {
  		@IFileService private readonly fileService: IFileService,
 +		// @ts-ignore
  		@IProductService private readonly productService: IProductService
-@@ -325,3 +326,3 @@ export class Extension implements IExtension {
+@@ -341,3 +342,3 @@ export class Extension implements IExtension {
  			// Do not allow updating system extensions in stable
--			if (this.type === ExtensionType.System && this.productService.quality === 'stable') {
-+			if (this.type === ExtensionType.System) {
+-			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
++			if (this.type === ExtensionType.System && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
  				return false;

patches/linux/31-build-fix-dependencies.patch

@@ -1,5 +1,5 @@
 diff --git a/build/linux/dependencies-generator.ts b/build/linux/dependencies-generator.ts
-index 874c802..04731cf 100644
+index 874c8026..04731cfd 100644
 --- a/build/linux/dependencies-generator.ts
 +++ b/build/linux/dependencies-generator.ts
 @@ -13,3 +13,3 @@ import { type DebianArchString, isDebianArchString } from './debian/types.ts';
@@ -18,7 +18,7 @@ index 874c802..04731cf 100644
 +	// files.push(path.join(buildDir, 'bin', product.tunnelApplicationName));
  	// Add the main executable.
 diff --git a/build/package-lock.json b/build/package-lock.json
-index b78c4c8..58ee897 100644
+index 507ec216..a7440867 100644
 --- a/build/package-lock.json
 +++ b/build/package-lock.json
 @@ -17,3 +17,2 @@
@@ -189,7 +189,7 @@ index b78c4c8..58ee897 100644
 -      }
 -    },
      "node_modules/@esbuild/aix-ppc64": {
-@@ -1367,5 +1320,5 @@
+@@ -1344,5 +1297,5 @@
      "node_modules/@textlint/ast-node-types": {
 -      "version": "15.2.2",
 -      "resolved": "https://registry.npmjs.org/@textlint/ast-node-types/-/ast-node-types-15.2.2.tgz",
@@ -198,7 +198,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/@textlint/ast-node-types/-/ast-node-types-15.4.1.tgz",
 +      "integrity": "sha512-XifMpBMdo0E1Fuh85YdcYAgy+okNg9WKBzIPIO4JUDnSWUVFihnogrM4cjDapeHkgzSgulwR8oJVJ17eyxI1bA==",
        "dev": true,
-@@ -1374,5 +1327,5 @@
+@@ -1351,5 +1304,5 @@
      "node_modules/@textlint/linter-formatter": {
 -      "version": "15.2.2",
 -      "resolved": "https://registry.npmjs.org/@textlint/linter-formatter/-/linter-formatter-15.2.2.tgz",
@@ -207,7 +207,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/@textlint/linter-formatter/-/linter-formatter-15.4.1.tgz",
 +      "integrity": "sha512-kAV7Sup3vwvqxKvBbf9lx/JaPHkRybQp/LLvA73U1AorPZE6XyfBAFG24BbMiCs4OX1ax4g7kXRuFPgMLWRf+g==",
        "dev": true,
-@@ -1382,8 +1335,8 @@
+@@ -1359,8 +1312,8 @@
          "@azu/style-format": "^1.0.1",
 -        "@textlint/module-interop": "15.2.2",
 -        "@textlint/resolver": "15.2.2",
@@ -221,7 +221,7 @@ index b78c4c8..58ee897 100644
 +        "debug": "^4.4.3",
 +        "js-yaml": "^4.1.0",
          "lodash": "^4.17.21",
-@@ -1459,2 +1412,9 @@
+@@ -1436,2 +1389,9 @@
      },
 +    "node_modules/@textlint/linter-formatter/node_modules/emoji-regex": {
 +      "version": "8.0.0",
@@ -231,7 +231,7 @@ index b78c4c8..58ee897 100644
 +      "license": "MIT"
 +    },
      "node_modules/@textlint/linter-formatter/node_modules/has-flag": {
-@@ -1476,2 +1436,17 @@
+@@ -1453,2 +1413,17 @@
      },
 +    "node_modules/@textlint/linter-formatter/node_modules/string-width": {
 +      "version": "4.2.3",
@@ -249,7 +249,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/@textlint/linter-formatter/node_modules/strip-ansi": {
-@@ -1503,5 +1478,5 @@
+@@ -1480,5 +1455,5 @@
      "node_modules/@textlint/module-interop": {
 -      "version": "15.2.2",
 -      "resolved": "https://registry.npmjs.org/@textlint/module-interop/-/module-interop-15.2.2.tgz",
@@ -258,7 +258,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/@textlint/module-interop/-/module-interop-15.4.1.tgz",
 +      "integrity": "sha512-jHtM2E5CR68P3z/+FGrEU5pml2fQVzEo2sez9FEjrVHSPCrHtqHcPaKfsYbQJjc9C48ObwaWrCzRNaL3KedNCQ==",
        "dev": true,
-@@ -1510,5 +1485,5 @@
+@@ -1487,5 +1462,5 @@
      "node_modules/@textlint/resolver": {
 -      "version": "15.2.2",
 -      "resolved": "https://registry.npmjs.org/@textlint/resolver/-/resolver-15.2.2.tgz",
@@ -267,7 +267,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/@textlint/resolver/-/resolver-15.4.1.tgz",
 +      "integrity": "sha512-uVssyG3XXXKNY+O7NOajGvQZTyOuhPviwlq7Xek6ZT9K1eDQtA8074cPkAQoLMYhi/TUyOE5P5kpz42UF8Lmdw==",
        "dev": true,
-@@ -1517,5 +1492,5 @@
+@@ -1494,5 +1469,5 @@
      "node_modules/@textlint/types": {
 -      "version": "15.2.2",
 -      "resolved": "https://registry.npmjs.org/@textlint/types/-/types-15.2.2.tgz",
@@ -276,12 +276,12 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/@textlint/types/-/types-15.4.1.tgz",
 +      "integrity": "sha512-WByVZ3zblbvuI+voWQplUP7seSTKXI9z6TMVXEB3dY3JFrZCIXWKNfLbETX5lZV7fYkCMaDtILO1l6s11wdbQA==",
        "dev": true,
-@@ -1523,3 +1498,3 @@
+@@ -1500,3 +1475,3 @@
        "dependencies": {
 -        "@textlint/ast-node-types": "15.2.2"
 +        "@textlint/ast-node-types": "15.4.1"
        }
-@@ -1617,12 +1592,2 @@
+@@ -1594,12 +1569,2 @@
      },
 -    "node_modules/@types/graceful-fs": {
 -      "version": "4.1.9",
@@ -294,7 +294,7 @@ index b78c4c8..58ee897 100644
 -      }
 -    },
      "node_modules/@types/gulp": {
-@@ -1944,2 +1909,17 @@
+@@ -1921,2 +1886,17 @@
      },
 +    "node_modules/@typespec/ts-http-runtime": {
 +      "version": "0.3.2",
@@ -312,11 +312,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/@vscode/iconv-lite-umd": {
-@@ -2270,2 +2250,3 @@
-       "dev": true,
-+      "license": "ISC",
-       "bin": {
-@@ -2347,5 +2328,5 @@
+@@ -2233,5 +2213,5 @@
      "node_modules/ansi-escapes": {
 -      "version": "7.1.1",
 -      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.1.1.tgz",
@@ -325,11 +321,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.2.0.tgz",
 +      "integrity": "sha512-g6LhBsl+GBPRWGWsBtutpzBYuIIdBkLEvad5C/va/74Db018+5TZiyA26cZJAr3Rft5lprVqOIPxf5Vid6tqAw==",
        "dev": true,
-@@ -2392,2 +2373,3 @@
-       "dev": true,
-+      "license": "BSD-2-Clause",
-       "dependencies": {
-@@ -2422,17 +2404,7 @@
+@@ -2308,17 +2288,7 @@
      "node_modules/argparse": {
 -      "version": "1.0.10",
 -      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
@@ -351,25 +343,25 @@ index b78c4c8..58ee897 100644
 -      "license": "BSD-3-Clause"
 +      "license": "Python-2.0"
      },
-@@ -2480,2 +2452,3 @@
+@@ -2366,2 +2336,3 @@
        "dev": true,
 +      "license": "BSD-2-Clause",
        "dependencies": {
-@@ -2564,2 +2537,3 @@
+@@ -2450,2 +2421,3 @@
        "dev": true,
 +      "license": "MIT",
        "optional": true,
-@@ -2575,3 +2549,4 @@
+@@ -2461,3 +2433,4 @@
        "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
 -      "dev": true
 +      "dev": true,
 +      "license": "ISC"
      },
-@@ -2677,2 +2652,3 @@
+@@ -2563,2 +2536,3 @@
        "dev": true,
-+      "license": "MIT",
++      "license": "BSD-2-Clause",
        "dependencies": {
-@@ -2736,6 +2712,7 @@
+@@ -2622,6 +2596,7 @@
      "node_modules/cheerio": {
 -      "version": "1.0.0-rc.12",
 -      "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0-rc.12.tgz",
@@ -380,7 +372,7 @@ index b78c4c8..58ee897 100644
        "dev": true,
 +      "license": "MIT",
        "dependencies": {
-@@ -2744,9 +2721,13 @@
+@@ -2630,9 +2605,13 @@
          "domhandler": "^5.0.3",
 -        "domutils": "^3.0.1",
 -        "htmlparser2": "^8.0.1",
@@ -399,7 +391,11 @@ index b78c4c8..58ee897 100644
 -        "node": ">= 6"
 +        "node": ">=20.18.1"
        },
-@@ -2961,6 +2942,7 @@
+@@ -2647,2 +2626,3 @@
+       "dev": true,
++      "license": "MIT",
+       "dependencies": {
+@@ -2847,6 +2827,7 @@
      "node_modules/css-what": {
 -      "version": "6.1.0",
 -      "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.1.0.tgz",
@@ -410,13 +406,13 @@ index b78c4c8..58ee897 100644
        "dev": true,
 +      "license": "BSD-2-Clause",
        "engines": {
-@@ -3119,3 +3101,4 @@
+@@ -3005,3 +2986,4 @@
          }
 -      ]
 +      ],
 +      "license": "BSD-2-Clause"
      },
-@@ -3137,6 +3120,7 @@
+@@ -3023,6 +3005,7 @@
      "node_modules/domutils": {
 -      "version": "3.0.1",
 -      "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.0.1.tgz",
@@ -427,12 +423,12 @@ index b78c4c8..58ee897 100644
        "dev": true,
 +      "license": "BSD-2-Clause",
        "dependencies": {
-@@ -3144,3 +3128,3 @@
+@@ -3030,3 +3013,3 @@
          "domelementtype": "^2.3.0",
 -        "domhandler": "^5.0.1"
 +        "domhandler": "^5.0.3"
        },
-@@ -3211,5 +3195,5 @@
+@@ -3097,5 +3080,5 @@
      "node_modules/emoji-regex": {
 -      "version": "8.0.0",
 -      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
@@ -441,7 +437,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
 +      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
        "dev": true,
-@@ -3217,2 +3201,16 @@
+@@ -3103,2 +3086,16 @@
      },
 +    "node_modules/encoding-sniffer": {
 +      "version": "0.2.1",
@@ -458,7 +454,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/end-of-stream": {
-@@ -3227,6 +3225,7 @@
+@@ -3113,6 +3110,7 @@
      "node_modules/entities": {
 -      "version": "4.4.0",
 -      "resolved": "https://registry.npmjs.org/entities/-/entities-4.4.0.tgz",
@@ -469,7 +465,7 @@ index b78c4c8..58ee897 100644
        "dev": true,
 +      "license": "BSD-2-Clause",
        "engines": {
-@@ -3367,16 +3366,2 @@
+@@ -3253,16 +3251,2 @@
      },
 -    "node_modules/esprima": {
 -      "version": "4.0.1",
@@ -486,19 +482,19 @@ index b78c4c8..58ee897 100644
 -      }
 -    },
      "node_modules/events": {
-@@ -3418,2 +3403,3 @@
+@@ -3433,2 +3417,3 @@
        "dev": true,
 +      "license": "ISC",
        "dependencies": {
-@@ -3617,2 +3603,3 @@
+@@ -3625,2 +3610,3 @@
        "dev": true,
 +      "license": "ISC",
        "optional": true
-@@ -3924,2 +3911,3 @@
+@@ -3828,2 +3814,3 @@
        "dev": true,
 +      "license": "MIT",
        "engines": {
-@@ -3983,5 +3971,5 @@
+@@ -3887,5 +3874,5 @@
      "node_modules/htmlparser2": {
 -      "version": "8.0.1",
 -      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-8.0.1.tgz",
@@ -507,7 +503,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-10.0.0.tgz",
 +      "integrity": "sha512-TwAZM+zE5Tq3lrEHvOlvwgj1XLWQCtaaibSN11Q+gGBAS7Y1uZSWwXXRe4iF6OXnaq1riyQAPFOBtYc77Mxq0g==",
        "dev": true,
-@@ -3994,7 +3982,21 @@
+@@ -3898,7 +3885,21 @@
        ],
 +      "license": "MIT",
        "dependencies": {
@@ -532,7 +528,7 @@ index b78c4c8..58ee897 100644
 +      "funding": {
 +        "url": "https://github.com/fb55/entities?sponsor=1"
        }
-@@ -4048,2 +4050,15 @@
+@@ -3952,2 +3953,15 @@
      },
 +    "node_modules/iconv-lite": {
 +      "version": "0.6.3",
@@ -548,7 +544,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/ieee754": {
-@@ -4080,5 +4095,5 @@
+@@ -3984,5 +3998,5 @@
      "node_modules/index-to-position": {
 -      "version": "1.1.0",
 -      "resolved": "https://registry.npmjs.org/index-to-position/-/index-to-position-1.1.0.tgz",
@@ -557,11 +553,15 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/index-to-position/-/index-to-position-1.2.0.tgz",
 +      "integrity": "sha512-Yg7+ztRkqslMAS2iFaU+Oa4KTSidr63OsFGlOrJoW981kIYO3CGCS3wA95P1mUi/IVSJkn0D479KTJpVpvFNuw==",
        "dev": true,
-@@ -4114,2 +4129,3 @@
+@@ -4018,2 +4032,3 @@
        "dev": true,
 +      "license": "MIT",
        "optional": true
-@@ -4288,5 +4304,5 @@
+@@ -4037,2 +4052,3 @@
+       "dev": true,
++      "license": "ISC",
+       "bin": {
+@@ -4192,5 +4208,5 @@
      "node_modules/js-yaml": {
 -      "version": "3.14.2",
 -      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
@@ -570,25 +570,25 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
 +      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
        "dev": true,
-@@ -4294,4 +4310,3 @@
+@@ -4198,4 +4214,3 @@
        "dependencies": {
 -        "argparse": "^1.0.7",
 -        "esprima": "^4.0.0"
 +        "argparse": "^2.0.1"
        },
-@@ -4360,2 +4375,3 @@
-       "dev": true,
-+      "license": "BSD-2-Clause",
-       "dependencies": {
-@@ -4438,2 +4454,3 @@
+@@ -4342,2 +4357,3 @@
        "hasInstallScript": true,
 +      "license": "MIT",
        "optional": true,
-@@ -4449,2 +4466,3 @@
+@@ -4353,2 +4369,3 @@
+       "dev": true,
++      "license": "BSD-2-Clause",
+       "dependencies": {
+@@ -4410,2 +4427,3 @@
        "dev": true,
 +      "license": "MIT",
        "dependencies": {
-@@ -4531,9 +4549,2 @@
+@@ -4435,9 +4453,2 @@
      },
 -    "node_modules/markdown-it/node_modules/argparse": {
 -      "version": "2.0.1",
@@ -598,19 +598,11 @@ index b78c4c8..58ee897 100644
 -      "license": "Python-2.0"
 -    },
      "node_modules/matcher": {
-@@ -4543,2 +4554,3 @@
-       "dev": true,
-+      "license": "(MIT OR WTFPL)",
-       "optional": true,
-@@ -4556,2 +4568,3 @@
+@@ -4598,2 +4609,3 @@
        "dev": true,
 +      "license": "MIT",
-       "optional": true,
-@@ -4693,2 +4706,3 @@
-       "dev": true,
-+      "license": "ISC",
        "optional": true
-@@ -4709,6 +4723,7 @@
+@@ -4614,6 +4626,7 @@
      "node_modules/napi-build-utils": {
 -      "version": "1.0.2",
 -      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.2.tgz",
@@ -621,11 +613,19 @@ index b78c4c8..58ee897 100644
        "dev": true,
 +      "license": "MIT",
        "optional": true
-@@ -4755,2 +4770,3 @@
+@@ -4625,2 +4638,3 @@
+       "dev": true,
++      "license": "(MIT OR WTFPL)",
+       "optional": true,
+@@ -4638,2 +4652,3 @@
        "dev": true,
 +      "license": "MIT",
+       "optional": true,
+@@ -4660,2 +4675,3 @@
+       "dev": true,
++      "license": "ISC",
        "optional": true
-@@ -4770,5 +4786,5 @@
+@@ -4675,5 +4691,5 @@
      "node_modules/node-sarif-builder": {
 -      "version": "3.2.0",
 -      "resolved": "https://registry.npmjs.org/node-sarif-builder/-/node-sarif-builder-3.2.0.tgz",
@@ -634,12 +634,12 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/node-sarif-builder/-/node-sarif-builder-3.3.1.tgz",
 +      "integrity": "sha512-8z5dAbhpxmk/WRQHXlv4V0h+9Y4Ugk+w08lyhV/7E/CQX9yDdBc3025/EG+RSMJU2aPFh/IQ7XDV7Ti5TLt/TA==",
        "dev": true,
-@@ -4780,3 +4796,3 @@
+@@ -4685,3 +4701,3 @@
        "engines": {
 -        "node": ">=18"
 +        "node": ">=20"
        }
-@@ -4857,5 +4873,5 @@
+@@ -4762,5 +4778,5 @@
      "node_modules/normalize-package-data/node_modules/semver": {
 -      "version": "7.7.2",
 -      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
@@ -648,7 +648,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
 +      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
        "dev": true,
-@@ -4985,5 +5001,5 @@
+@@ -4890,5 +4906,5 @@
      "node_modules/p-map": {
 -      "version": "7.0.3",
 -      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.3.tgz",
@@ -657,7 +657,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
 +      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
        "dev": true,
-@@ -5063,8 +5079,9 @@
+@@ -4968,8 +4984,9 @@
      "node_modules/parse5": {
 -      "version": "7.1.2",
 -      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.1.2.tgz",
@@ -671,7 +671,7 @@ index b78c4c8..58ee897 100644
 -        "entities": "^4.4.0"
 +        "entities": "^6.0.0"
        },
-@@ -5075,8 +5092,22 @@
+@@ -4980,8 +4997,9 @@
      "node_modules/parse5-htmlparser2-tree-adapter": {
 -      "version": "7.0.0",
 -      "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.0.0.tgz",
@@ -681,25 +681,25 @@ index b78c4c8..58ee897 100644
 +      "integrity": "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==",
        "dev": true,
 +      "license": "MIT",
-+      "dependencies": {
+       "dependencies": {
+-        "domhandler": "^5.0.2",
 +        "domhandler": "^5.0.3",
-+        "parse5": "^7.0.0"
-+      },
-+      "funding": {
-+        "url": "https://github.com/inikulin/parse5?sponsor=1"
-+      }
-+    },
+         "parse5": "^7.0.0"
+@@ -4992,2 +5010,28 @@
+     },
 +    "node_modules/parse5-parser-stream": {
 +      "version": "7.1.2",
 +      "resolved": "https://registry.npmjs.org/parse5-parser-stream/-/parse5-parser-stream-7.1.2.tgz",
 +      "integrity": "sha512-JyeQc9iwFLn5TbvvqACIF/VXG6abODeB3Fwmv/TGdLk2LfbWkaySGY72at4+Ty7EkPZj854u4CrICqNk2qIbow==",
 +      "dev": true,
 +      "license": "MIT",
-       "dependencies": {
--        "domhandler": "^5.0.2",
-         "parse5": "^7.0.0"
-@@ -5087,2 +5118,15 @@
-     },
++      "dependencies": {
++        "parse5": "^7.0.0"
++      },
++      "funding": {
++        "url": "https://github.com/inikulin/parse5?sponsor=1"
++      }
++    },
 +    "node_modules/parse5/node_modules/entities": {
 +      "version": "6.0.1",
 +      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
@@ -713,8 +713,8 @@ index b78c4c8..58ee897 100644
 +        "url": "https://github.com/fb55/entities?sponsor=1"
 +      }
 +    },
-     "node_modules/path-is-absolute": {
-@@ -5106,5 +5150,5 @@
+     "node_modules/path-expression-matcher": {
+@@ -5027,5 +5071,5 @@
      "node_modules/path-scurry": {
 -      "version": "2.0.0",
 -      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.0.tgz",
@@ -723,20 +723,16 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.1.tgz",
 +      "integrity": "sha512-oWyT4gICAu+kaA7QWk/jvCHWarMKNs6pXOGWKDTr7cw4IGcUbW+PeTfbaQiLGheFRpjo6O9J0PmyMfQPjH71oA==",
        "dev": true,
-@@ -5237,2 +5281,3 @@
-       "dev": true,
-+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
-       "optional": true,
-@@ -5244,3 +5289,3 @@
+@@ -5165,3 +5209,3 @@
          "mkdirp-classic": "^0.5.3",
 -        "napi-build-utils": "^1.0.1",
 +        "napi-build-utils": "^2.0.0",
          "node-abi": "^3.3.0",
-@@ -5292,2 +5337,3 @@
+@@ -5282,2 +5326,3 @@
        "dev": true,
-+      "license": "ISC",
-       "dependencies": {
-@@ -5385,22 +5431,2 @@
++      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+       "optional": true,
+@@ -5306,22 +5351,2 @@
      },
 -    "node_modules/rc-config-loader/node_modules/argparse": {
 -      "version": "2.0.1",
@@ -759,7 +755,11 @@ index b78c4c8..58ee897 100644
 -      }
 -    },
      "node_modules/read": {
-@@ -5591,7 +5617,15 @@
+@@ -5331,2 +5356,3 @@
+       "dev": true,
++      "license": "ISC",
+       "dependencies": {
+@@ -5512,7 +5538,15 @@
      },
 +    "node_modules/safer-buffer": {
 +      "version": "2.1.2",
@@ -779,27 +779,27 @@ index b78c4c8..58ee897 100644
 +      "dev": true,
 +      "license": "ISC"
      },
-@@ -5642,2 +5676,3 @@
+@@ -5563,2 +5597,3 @@
        "dev": true,
 +      "license": "MIT",
        "optional": true
-@@ -5649,2 +5684,3 @@
+@@ -5570,2 +5605,3 @@
        "dev": true,
 +      "license": "MIT",
        "optional": true,
-@@ -5789,2 +5825,3 @@
+@@ -5710,2 +5746,3 @@
        ],
 +      "license": "BSD-3-Clause",
        "optional": true
-@@ -5810,2 +5847,3 @@
+@@ -5731,2 +5768,3 @@
        ],
 +      "license": "MIT",
        "optional": true,
-@@ -5889,2 +5927,3 @@
+@@ -5862,2 +5900,3 @@
        "dev": true,
 +      "license": "MIT",
        "engines": {
-@@ -5968,5 +6007,5 @@
+@@ -5889,5 +5928,5 @@
      "node_modules/string-width": {
 -      "version": "4.2.3",
 -      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
@@ -808,7 +808,7 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
 +      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
        "dev": true,
-@@ -5990,31 +6029,11 @@
+@@ -5911,31 +5950,11 @@
        "dependencies": {
 -        "emoji-regex": "^8.0.0",
 -        "is-fullwidth-code-point": "^3.0.0",
@@ -846,7 +846,7 @@ index b78c4c8..58ee897 100644
 +      "funding": {
 +        "url": "https://github.com/sponsors/sindresorhus"
        }
-@@ -6031,2 +6050,9 @@
+@@ -5952,2 +5971,9 @@
      },
 +    "node_modules/string-width/node_modules/emoji-regex": {
 +      "version": "8.0.0",
@@ -856,18 +856,18 @@ index b78c4c8..58ee897 100644
 +      "license": "MIT"
 +    },
      "node_modules/string-width/node_modules/strip-ansi": {
-@@ -6124,4 +6150,5 @@
+@@ -6045,4 +6071,5 @@
        "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
 -      "integrity": "sha1-PFMZQukIwml8DsNEhYwobHygpgo= sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
 +      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
        "dev": true,
 +      "license": "MIT",
        "optional": true,
-@@ -6159,2 +6186,3 @@
+@@ -6092,2 +6119,3 @@
        "dev": true,
 +      "license": "MIT",
        "dependencies": {
-@@ -6245,2 +6273,24 @@
+@@ -6166,2 +6194,24 @@
      },
 +    "node_modules/table/node_modules/emoji-regex": {
 +      "version": "8.0.0",
@@ -892,7 +892,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/table/node_modules/strip-ansi": {
-@@ -6376,5 +6426,5 @@
+@@ -6297,5 +6347,5 @@
      "node_modules/tmp": {
 -      "version": "0.2.4",
 -      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.4.tgz",
@@ -901,14 +901,14 @@ index b78c4c8..58ee897 100644
 +      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
 +      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
        "dev": true,
-@@ -6500,4 +6550,5 @@
+@@ -6421,4 +6471,5 @@
        "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
 -      "integrity": "sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0= sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
 +      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
        "dev": true,
 +      "license": "Apache-2.0",
        "optional": true,
-@@ -6549,2 +6600,12 @@
+@@ -6470,2 +6521,12 @@
      },
 +    "node_modules/undici": {
 +      "version": "7.16.0",
@@ -921,13 +921,13 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/undici-types": {
-@@ -6588,3 +6649,4 @@
+@@ -6509,3 +6570,4 @@
        "integrity": "sha512-jk1+QP6ZJqyOiuEI9AEWQfju/nB2Pw466kbA0LEZljHwKeMgd9WrAEgEGxjPDD2+TNbbb37rTyhEfrCXfuKXnA==",
 -      "dev": true
 +      "dev": true,
 +      "license": "MIT"
      },
-@@ -6768,2 +6830,25 @@
+@@ -6690,2 +6752,25 @@
      },
 +    "node_modules/whatwg-encoding": {
 +      "version": "3.1.1",
@@ -953,7 +953,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/which": {
-@@ -6872,2 +6957,24 @@
+@@ -6794,2 +6879,24 @@
      },
 +    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
 +      "version": "8.0.0",
@@ -978,7 +978,7 @@ index b78c4c8..58ee897 100644
 +      }
 +    },
      "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
-@@ -6898,27 +7005,2 @@
+@@ -6820,27 +6927,2 @@
      },
 -    "node_modules/wrap-ansi/node_modules/emoji-regex": {
 -      "version": "9.2.2",
@@ -1006,7 +1006,7 @@ index b78c4c8..58ee897 100644
 -      }
 -    },
      "node_modules/wrappy": {
-@@ -6975,2 +7057,47 @@
+@@ -6897,2 +6979,47 @@
      },
 +    "node_modules/yargs/node_modules/ansi-regex": {
 +      "version": "5.0.1",
@@ -1055,10 +1055,61 @@ index b78c4c8..58ee897 100644
 +    },
      "node_modules/yauzl": {
 diff --git a/build/package.json b/build/package.json
-index 785f04f..e523427 100644
+index 3493ef4e..a3fa30b0 100644
 --- a/build/package.json
 +++ b/build/package.json
 @@ -11,3 +11,2 @@
      "@electron/get": "^2.0.0",
 -    "@electron/osx-sign": "^2.0.0",
      "@types/ansi-colors": "^3.2.0",
+diff --git a/package-lock.json b/package-lock.json
+index 75b98719..bb0879b3 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -5829,2 +5829,11 @@
+     },
++    "node_modules/buildcheck": {
++      "version": "0.0.7",
++      "resolved": "https://registry.npmjs.org/buildcheck/-/buildcheck-0.0.7.tgz",
++      "integrity": "sha512-lHblz4ahamxpTmnsk+MNTRWsjYKv965MwOrSJyeD588rR3Jcu7swE+0wN5F+PbL5cjgu/9ObkhfzEPuofEMwLA==",
++      "optional": true,
++      "engines": {
++        "node": ">=10.0.0"
++      }
++    },
+     "node_modules/bundle-name": {
+@@ -6825,2 +6834,16 @@
+     },
++    "node_modules/cpu-features": {
++      "version": "0.0.10",
++      "resolved": "https://registry.npmjs.org/cpu-features/-/cpu-features-0.0.10.tgz",
++      "integrity": "sha512-9IkYqtX3YHPCzoVg1Py+o9057a3i0fp7S530UWokCSaFVTc7CwXPRiOjRjBQQ18ZCNafx78YfnG+HALxtVmOGA==",
++      "hasInstallScript": true,
++      "optional": true,
++      "dependencies": {
++        "buildcheck": "~0.0.6",
++        "nan": "^2.19.0"
++      },
++      "engines": {
++        "node": ">=10.0.0"
++      }
++    },
+     "node_modules/crc-32": {
+diff --git a/package.json b/package.json
+index b925a690..96b8b994 100644
+--- a/package.json
++++ b/package.json
+@@ -255,3 +255,3 @@
+     "ssh2": {
+-      "cpu-features": "0.0.0"
++      "cpu-features": "0.0.10"
+     }
+diff --git a/remote/package.json b/remote/package.json
+index 5b9d937b..ef1851c1 100644
+--- a/remote/package.json
++++ b/remote/package.json
+@@ -55,3 +55,3 @@
+     "ssh2": {
+-      "cpu-features": "0.0.0"
++      "cpu-features": "0.0.10"
+     }

patches/osx/fix-codesign.patch.no

@@ -1,30 +0,0 @@
-diff --git a/build/darwin/sign.js b/build/darwin/sign.js
-index dff30fd..df48bee 100644
---- a/build/darwin/sign.js
-+++ b/build/darwin/sign.js
-@@ -56,5 +56,7 @@ async function main(buildDir) {
-         ignore: (filePath) => {
-+            const ext = path_1.default.extname(filePath);
-             return filePath.includes(gpuHelperAppName) ||
-                 filePath.includes(rendererHelperAppName) ||
--                filePath.includes(pluginHelperAppName);
-+                filePath.includes(pluginHelperAppName) ||
-+                ext == '.asar' || ext == '.dat' || ext == '.gif' || ext == '.icns' || ext == '.ico' || ext == '.json' || ext == '.mp3' || ext == '.nib' || ext == '.pak' || ext == '.png' || ext == '.scpt' || ext == '.ttf' || ext == '.wasm' || ext == '.woff' || ext == '.woff2';
-         }
-diff --git a/build/darwin/sign.ts b/build/darwin/sign.ts
-index ecf1627..a414032 100644
---- a/build/darwin/sign.ts
-+++ b/build/darwin/sign.ts
-@@ -60,6 +60,9 @@ async function main(buildDir?: string): Promise<void> {
- 		ignore: (filePath: string) => {
--			return filePath.includes(gpuHelperAppName) ||
--				filePath.includes(rendererHelperAppName) ||
--				filePath.includes(pluginHelperAppName);
-+			const ext = path.extname(filePath);
-+            return filePath.includes(gpuHelperAppName) ||
-+                filePath.includes(rendererHelperAppName) ||
-+                filePath.includes(pluginHelperAppName) ||
-+				ext == '.asar' || ext == '.dat' || ext == '.gif' || ext == '.icns' || ext == '.ico' || ext == '.json' || ext == '.mp3' || ext == '.nib' || ext == '.pak' || ext == '.png' || ext == '.scpt' || ext == '.ttf' || ext == '.wasm' || ext == '.woff' || ext == '.woff2';
- 		}
-+
- 	};

patches/windows/00-build-disable-appx.patch

@@ -1,8 +1,8 @@
 diff --git a/build/gulpfile.vscode.ts b/build/gulpfile.vscode.ts
-index d3ab651..d067b5b 100644
+index 080d97f3..6b1b4032 100644
 --- a/build/gulpfile.vscode.ts
 +++ b/build/gulpfile.vscode.ts
-@@ -432,19 +432,2 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
+@@ -620,19 +620,2 @@ function packageTask(platform: string, arch: string, sourceFolderName: string, d
  				.pipe(rename(f => f.dirname = `policies/${f.dirname}`)));
 -
 -			if (quality === 'stable' || quality === 'insider') {
@@ -23,10 +23,10 @@ index d3ab651..d067b5b 100644
 -			}
  		} else if (platform === 'linux') {
 diff --git a/build/gulpfile.vscode.win32.ts b/build/gulpfile.vscode.win32.ts
-index a7b01f0..43c93b8 100644
+index 7a711276..e6a838e2 100644
 --- a/build/gulpfile.vscode.win32.ts
 +++ b/build/gulpfile.vscode.win32.ts
-@@ -117,8 +117,2 @@ function buildWin32Setup(arch: string, target: string): task.CallbackTask {
+@@ -133,8 +133,2 @@ function buildWin32Setup(arch: string, target: string): task.CallbackTask {
  
 -		if (quality === 'stable' || quality === 'insider') {
 -			definitions['AppxPackage'] = `${quality === 'stable' ? 'code' : 'code_insider'}_${arch}.appx`;
@@ -34,4 +34,4 @@ index a7b01f0..43c93b8 100644
 -			definitions['AppxPackageName'] = `${product.win32AppUserModelId}`;
 -		}
 -
- 		packageInnoSetup(issPath, { definitions }, cb as (err?: Error | null) => void);
+ 		fs.writeFileSync(productJsonPath, JSON.stringify(productJson, undefined, '\t'));

prepare_vscode.sh

@@ -13,6 +13,8 @@ cp -f LICENSE vscode/LICENSE.txt
 
 cd vscode || { echo "'vscode' dir not found"; exit 1; }
 
+rm -rf extensions/copilot
+
 { set +x; } 2>/dev/null
 
 # {{{ product.json
@@ -144,7 +146,7 @@ echo "ORG_NAME=\"${ORG_NAME}\""
 echo "TUNNEL_APP_NAME=\"${TUNNEL_APP_NAME}\""
 
 if [[ "${DISABLE_UPDATE}" == "yes" ]]; then
-  mv ../patches/disable-update.patch.yet ../patches/disable-update.patch
+  mv ../patches/00-update-disable.patch.yet ../patches/00-update-disable.patch
 fi
 
 for file in ../patches/*.patch; do

product.json

@@ -49,7 +49,6 @@
   "extensionsEnabledWithApiProposalVersion": [
     "GitHub.copilot-chat",
     "ms-vscode.vscode-commander",
-    "ms-vscode.vscode-copilot-vision",
     "GitHub.vscode-pull-request-github"
   ],
   "extensionEnabledApiProposals": {
@@ -246,10 +245,14 @@
     ],
     "GitHub.copilot": [
       "inlineCompletionsAdditions",
+      "interactive",
+      "terminalDataWriteEvent",
       "devDeviceId"
     ],
     "GitHub.copilot-nightly": [
       "inlineCompletionsAdditions",
+      "interactive",
+      "terminalDataWriteEvent",
       "devDeviceId"
     ],
     "GitHub.copilot-chat": [
@@ -303,9 +306,11 @@
       "taskExecutionTerminal",
       "dataChannels",
       "chatSessionsProvider",
+      "chatSessionCustomizationProvider",
       "devDeviceId",
       "contribEditorContentMenu",
       "tokenInformation",
+      "toolInvocationApproveCombination",
       "chatPromptFiles",
       "mcpServerDefinitions",
       "tabInputMultiDiff",
@@ -379,7 +384,6 @@
       "terminalDataWriteEvent",
       "chatParticipantAdditions"
     ],
-    "vscjava.vscode-java-pack": [],
     "ms-dotnettools.csdevkit": [
       "inlineCompletionsAdditions"
     ],
@@ -403,9 +407,6 @@
       "languageModelSystem",
       "mcpServerDefinitions"
     ],
-    "ms-toolsai.datawrangler": [],
-    "ms-vscode.vscode-commander": [],
-    "ms-vscode.vscode-websearchforcopilot": [],
     "ms-vscode.vscode-copilot-vision": [
       "chatReferenceBinaryData",
       "codeActionAI"
@@ -413,6 +414,14 @@
     "ms-autodev.vscode-autodev": [
       "chatParticipantAdditions"
     ],
+    "codetrek.haystack-search": [
+      "fileSearchProvider",
+      "textSearchProvider2"
+    ],
+    "vscjava.migrate-java-to-azure": [
+      "chatParticipantAdditions",
+      "chatParticipantPrivate"
+    ],
     "vscjava.vscode-java-upgrade": [
       "chatParticipantAdditions",
       "chatParticipantPrivate"

upstream/insider.json

@@ -1,4 +1,4 @@
 {
-  "tag": "1.112.0",
-  "commit": "07ff9d6178ede9a1bd12ad3399074d726ebe6e43"
+  "tag": "1.116.0",
+  "commit": "560a9dba96f961efea7b1612916f89e5d5d4d679"
 }