Merge branch 'trunk' into fix/http-low-speed-timeout-for-ai-requests

Author: fredrikekelund

.buildkite/commands/build-for-windows.ps1

@@ -28,9 +28,13 @@ if ($Architecture -notin $VALID_ARCHITECTURES) {
     Exit 1
 }
 
-# setup_windows_code_signing.ps1 comes from CI Toolkit Plugin
-& "setup_windows_code_signing.ps1"
-If ($LastExitCode -ne 0) { Exit $LastExitCode }
+$signWindows = "$($env:SIGN_WINDOWS_BUILD)".Trim().ToLower()
+If (@('1', 'true') -contains $signWindows) {
+    Write-Host "--- :lock: Setting up Azure Trusted Signing"
+    $setupScript = (Get-Command setup_azure_trusted_signing.ps1 -ErrorAction Stop).Source
+    & $setupScript
+    If ($LastExitCode -ne 0) { Exit $LastExitCode }
+}
 
 Write-Host "--- :npm: Installing Node dependencies"
 bash .buildkite/commands/install-node-dependencies.sh
@@ -63,3 +67,7 @@ If ($LastExitCode -ne 0) { Exit $LastExitCode }
 Write-Host "--- :package: Building AppX package"
 node scripts/package-appx.mjs
 If ($LastExitCode -ne 0) { Exit $LastExitCode }
+
+Write-Host "--- :package: Building standalone CLI bundle"
+npm run cli:bundle -- win32 $Architecture
+If ($LastExitCode -ne 0) { Exit $LastExitCode }

.buildkite/commands/install-node-dependencies.sh

@@ -8,10 +8,8 @@ NODE_VERSION=$(node --version)
 PACKAGE_HASH=$(hash_file package-lock.json)
 
 PATCHES_HASH=nopatch
-if [ -d apps/cli/patches ] || [ -d apps/studio/patches ]; then
-  CLI_PATCHES_HASH=$( [ -d apps/cli/patches ] && hash_directory apps/cli/patches || echo none )
-  STUDIO_PATCHES_HASH=$( [ -d apps/studio/patches ] && hash_directory apps/studio/patches || echo none )
-  PATCHES_HASH="${CLI_PATCHES_HASH}-${STUDIO_PATCHES_HASH}"
+if [ -d apps/studio/patches ]; then
+  PATCHES_HASH=$( hash_directory apps/studio/patches )
 fi
 
 CACHEKEY="$BUILDKITE_PIPELINE_SLUG-npm-$PLATFORM-$ARCHITECTURE-node-$NODE_VERSION-$PACKAGE_HASH-$PATCHES_HASH"

.buildkite/commands/prepare-environment.sh

@@ -6,8 +6,5 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
-
 echo "--- :testflight: Fetching Signing Certificates"
-bundle exec fastlane set_up_signing
+bundle exec fastlane set_up_signing

.buildkite/commands/run-e2e-tests.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+trap 'echo "Termination signal received — failing the job."; exit 1' TERM INT
+
 PLATFORM=${1:?Expected platform to be provided as first parameter}
 ARCH=${2:?Expected architecture to be provided as second parameter}
 
@@ -9,7 +11,39 @@ if .buildkite/commands/should-skip-job.sh --job-type validation; then
 fi
 
 echo '--- :package: Install deps'
-bash .buildkite/commands/install-node-dependencies.sh
+if [ "$PLATFORM" = "linux" ]; then
+  # Linux runs inside a Debian Node container on the shared `default` queue.
+  # The a8c-ci-toolkit cache helpers (hash_file, restore_cache) only exist on
+  # the host, so install-node-dependencies.sh can't run here. Also install
+  # Electron's runtime libraries plus xvfb (CI agents are headless) and the
+  # browser dependencies Playwright would otherwise fetch via `npx playwright
+  # install-deps` — same set, but apt is faster than letting Playwright shell
+  # out to it again.
+  apt-get -o Acquire::Retries=3 update
+  apt-get install -y --no-install-recommends \
+    xvfb \
+    xauth \
+    libcap2-bin \
+    libnss3 \
+    libatk1.0-0 \
+    libatk-bridge2.0-0 \
+    libcups2 \
+    libdrm2 \
+    libgtk-3-0 \
+    libgbm1 \
+    libasound2 \
+    libxkbcommon0 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxfixes3 \
+    libxrandr2 \
+    libpango-1.0-0 \
+    libcairo2 \
+    libxss1
+  npm ci --unsafe-perm --no-audit --no-progress --maxsockets 1
+else
+  bash .buildkite/commands/install-node-dependencies.sh
+fi
 
 export IS_DEV_BUILD=true
 
@@ -21,6 +55,9 @@ case "$PLATFORM" in
   windows)
     FORGE_PLATFORM="win32"
     ;;
+  linux)
+    FORGE_PLATFORM="linux"
+    ;;
   *)
     echo "Unknown platform: $PLATFORM"
     exit 1
@@ -33,10 +70,122 @@ esac
 echo "--- :package: Package app for testing ($PLATFORM-$ARCH)"
 npm -w studio-app run package -- --arch="$ARCH" --platform="$FORGE_PLATFORM"
 
+if [ "$PLATFORM" = "linux" ]; then
+  # The packaged app under apps/studio/out was created by electron-forge
+  # running as root with restrictive default perms — the node user (which
+  # runs Playwright below) gets EACCES on scandir without this. `X` (capital)
+  # keeps directories traversable and existing executables executable,
+  # without making every regular file executable.
+  echo '--- :wrench: Open packaged app perms for non-root test user'
+  chmod -R go+rX apps/studio/out
+
+  # Chromium's setuid sandbox helper (`chrome-sandbox`) requires real-root
+  # ownership + setuid bit. Under Docker user-namespace remapping, the
+  # container's "root" isn't real-root, so the kernel doesn't honor setuid
+  # and Chromium aborts on the misconfigured helper. Removing the helper
+  # makes Chromium skip the SUID path and fall through to the user-
+  # namespace sandbox, which doesn't need setuid.
+  rm -f "apps/studio/out/Studio-linux-${ARCH}/chrome-sandbox"
+
+  # Grant cap_net_bind_service to the bundled node so the proxy daemon can
+  # listen on privileged ports 80/443 without running as root — mirrors the
+  # DEB postinst hook (apps/studio/installers/linux/postinst.sh), which
+  # doesn't run for `electron-forge package` output. Without this, custom-
+  # domain HTTP/HTTPS tests fail to bind in the non-root test process.
+  BUNDLED_NODE="apps/studio/out/Studio-linux-${ARCH}/resources/bin/node"
+  if [ -x "$BUNDLED_NODE" ]; then
+    echo '--- :shield: Grant cap_net_bind_service to bundled node'
+    setcap 'cap_net_bind_service=+ep' "$BUNDLED_NODE" || \
+      echo "warning: setcap failed on $BUNDLED_NODE; privileged-port tests may fail to bind." >&2
+  fi
+fi
+
+echo '--- :mag: Verify CLI build artifacts'
+CLI_DIST="apps/cli/dist/cli"
+missing=()
+for f in reprint-child.mjs main.mjs wp-files/reprint/reprint.phar; do
+  [ -f "$CLI_DIST/$f" ] || missing+=("$f")
+done
+if [ ${#missing[@]} -gt 0 ]; then
+  echo "Missing CLI build artifacts in $CLI_DIST: ${missing[*]}"
+  exit 1
+fi
+echo "All required CLI build artifacts present."
+
 echo '--- :playwright: Run End To End Tests'
 
-echo 'Installing Playwright browsers...'
-npx playwright install
+# Electron needs a display server to launch. CI Linux agents are headless,
+# so wrap with xvfb-run to provide a virtual display.
+if [ "$PLATFORM" = "linux" ]; then
+  # Run Playwright as the non-root `node` user (uid 1000, present in
+  # node:bookworm). Electron's main delegate aborts with a FATAL on
+  # `geteuid() == 0` in every helper subprocess; --no-sandbox from the
+  # parent argv doesn't reliably propagate to all helper types, so the
+  # only robust workaround is to not be root for the test invocation.
+  #
+  # We can't chown /workdir because Docker user-namespace remapping on
+  # this agent denies cross-namespace chown even for container root.
+  # Instead, redirect Playwright's output to /tmp (which node owns) and
+  # copy results back to /workdir as root afterwards so the Buildkite
+  # artifact uploader finds them under the configured artifact_paths.
+  rm -rf /tmp/test-results
+  mkdir -p /tmp/test-results
+  chown node:node /tmp/test-results
+
+  # TODO(rsm-2593): --max-failures=1 is a temporary debug aid so the suite
+  # bails on the first failing test instead of retrying through all of them
+  # (~40 min on a broken Electron launch). Remove before merging.
+  # Install only Chromium, not Firefox/Webkit. Our tests drive Electron via
+  # Playwright's `_electron` API, but `test()` from `@playwright/test` still
+  # auto-spins a Chromium-headless-shell for the default `page` fixture even
+  # when the test body never touches it — so a Chromium install is required.
+  # Skipping Firefox/Webkit avoids the noisy "missing dependencies"
+  # validation against libs (gstreamer/flite/gtk-4/libavif/etc.) we don't
+  # need. Run inside the `su node` block so the browser lands in the same
+  # `~/.cache/ms-playwright` that the test process reads from.
+  test_exit=0
+  su -s /bin/bash node -c '
+    set -euo pipefail
+    cd /workdir
+    echo "Installing Playwright Chromium..."
+    npx playwright install chromium
+    echo "Running Playwright tests..."
+    # Explicit screen size: xvfb-run defaults to 1280x1024, which can leave
+    # right-edge content (e.g. the preferences Save button) below the fold
+    # for the split-pane settings layout. 1920x1080 matches a typical
+    # desktop and avoids relying on scroll-into-view.
+    inner_exit=0
+    xvfb-run -a -s "-screen 0 1920x1080x24" \
+      npx playwright test --max-failures=1 --output=/tmp/test-results || inner_exit=$?
+    # On failure, collect daemon logs into /tmp/test-results (copied to the
+    # artifact dir below). $HOME here is the node user that ran the tests.
+    if [ "$inner_exit" -ne 0 ] && [ -d "$HOME/.studio/daemon/logs" ]; then
+      cp -r "$HOME/.studio/daemon/logs" /tmp/test-results/daemon-logs || true
+    fi
+    exit "$inner_exit"
+  ' || test_exit=$?
+
+  if [ -d /tmp/test-results ]; then
+    echo '--- :file_folder: Copy test results for artifact upload'
+    mkdir -p test-results
+    cp -r /tmp/test-results/. test-results/ || true
+  fi
+
+  exit "$test_exit"
+else
+  echo 'Installing Playwright browsers...'
+  npx playwright install
 
-echo 'Running Playwright tests...'
-npx playwright test
+  echo 'Running Playwright tests...'
+  # Capture the exit code so a failure doesn't trip `set -e` before we collect
+  # the daemon logs (~/.studio/daemon/logs) for artifact upload.
+  test_exit=0
+  npx playwright test || test_exit=$?
+
+  if [ "$test_exit" -ne 0 ] && [ -d "$HOME/.studio/daemon/logs" ]; then
+    mkdir -p test-results/daemon-logs
+    cp -r "$HOME/.studio/daemon/logs/." test-results/daemon-logs/ || true
+  fi
+
+  exit "$test_exit"
+fi

.buildkite/commands/run-fastlane-tests.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if .buildkite/commands/should-skip-job.sh --job-type fastlane; then
+  exit 0
+fi
+
+echo '--- :fastlane: Run fastlane Helper Tests'
+for test_file in fastlane/test/*_test.rb; do
+  ruby "$test_file"
+done

.buildkite/commands/run-unit-tests.sh

@@ -8,7 +8,14 @@ if .buildkite/commands/should-skip-job.sh --job-type validation; then
 fi
 
 echo '--- :package: Install deps'
-bash .buildkite/commands/install-node-dependencies.sh
+if [ "$MATRIX" = "linux" ]; then
+  # Linux runs inside a Docker container; the a8c-ci-toolkit cache helpers
+  # (hash_file, restore_cache) only exist on the host, so install-node-
+  # dependencies.sh can't run here. Run npm ci directly instead.
+  npm ci --unsafe-perm --no-audit --no-progress --maxsockets 1
+else
+  bash .buildkite/commands/install-node-dependencies.sh
+fi
 
 echo '--- :npm: Run Unit Tests'
 npm run test

.buildkite/commands/should-skip-job.sh

@@ -14,6 +14,8 @@ set -eu
 #              Since metrics measure app performance, test file changes don't affect them.
 #   - build: Skip if changes are limited to documentation and config files.
 #            Does NOT skip on localization changes since builds should include translation updates.
+#   - fastlane: Inverse of the others — only runs when fastlane/ or Ruby setup files change.
+#               Used for the standalone tests in fastlane/test/. App-only PRs skip it.
 #
 # Exit codes:
 #   0 - Job should be skipped
@@ -62,7 +64,7 @@ COMMON_NON_CODE_PATTERNS=(
 
 # Localization files - changes here don't affect runtime behavior or performance
 LOCALIZATION_PATTERNS=(
-  "tools/common/translations/**"
+  "packages/common/translations/**"
 )
 
 # Test files - changes here don't affect app performance (for metrics)
@@ -72,10 +74,24 @@ TEST_PATTERNS=(
   "apps/studio/src/**/*.test.ts"
   "apps/studio/src/**/*.test.tsx"
   "apps/cli/**/*.test.ts"
-  "tools/common/**/*.test.ts"
+  "packages/common/**/*.test.ts"
   "metrics/**"
 )
 
+# Fastlane / Ruby setup files - changes here affect the standalone fastlane
+# helper tests. Anything that the test runner reads (Fastfile, lib/, test/),
+# that defines the Ruby environment, or that implements this CI job's runner /
+# skip logic belongs here.
+FASTLANE_PATTERNS=(
+  "fastlane/**"
+  "Gemfile"
+  "Gemfile.lock"
+  ".ruby-version"
+  ".bundle/**"
+  ".buildkite/commands/run-fastlane-tests.sh"
+  ".buildkite/commands/should-skip-job.sh"
+)
+
 show_skip_message() {
   local job_type=$1
   local job_label="${BUILDKITE_LABEL:-$job_type}"
@@ -107,7 +123,7 @@ done
 
 if [[ -z "$job_type" ]]; then
   echo "Error: --job-type is required"
-  echo "Usage: should-skip-job.sh --job-type <validation|metrics|build>"
+  echo "Usage: should-skip-job.sh --job-type <validation|metrics|build|fastlane>"
   exit 1
 fi
 
@@ -147,9 +163,18 @@ case "$job_type" in
     fi
     ;;
 
+  "fastlane")
+    # Run only if at least one changed file is fastlane/ or Ruby-setup-related.
+    # Other job types treat fastlane changes as non-code; this one is the inverse.
+    if ! pr_changed_files --any-match "${FASTLANE_PATTERNS[@]}"; then
+      show_skip_message "$job_type"
+      exit 0
+    fi
+    ;;
+
   *)
     echo "Unknown job type: $job_type"
-    echo "Valid types: validation, metrics, build"
+    echo "Valid types: validation, metrics, build, fastlane"
     exit 1
     ;;
 esac