Revert "chore: move orginal github actions away"

This reverts commit 2db2123eed.

.github/workflows/backport.yml

@@ -0,0 +1,32 @@
+name: Backport
+on:
+    pull_request_target:
+        types:
+            - closed
+            - labeled
+        branches:
+            - develop
+
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+
+jobs:
+    backport:
+        name: Backport
+        runs-on: ubuntu-24.04
+        # Only react to merged PRs for security reasons.
+        # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
+        if: >
+            github.event.pull_request.merged
+            && (
+              github.event.action == 'closed'
+              || (
+                github.event.action == 'labeled'
+                && contains(github.event.label.name, 'backport')
+              )
+            )
+        steps:
+            - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2
+              with:
+                  labels_template: "<%= JSON.stringify([...labels, 'X-Release-Blocker']) %>"
+                  # We can't use GITHUB_TOKEN here or CI won't run on the new PR
+                  github_token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/build.yml

@@ -0,0 +1,73 @@
+name: Build
+on:
+    pull_request: {}
+    push:
+        branches: [develop, master]
+    merge_group:
+        types: [checks_requested]
+concurrency:
+    group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+# develop pushes and repository_dispatch handled in build_develop.yaml
+env:
+    # This must be set for fetchdep.sh to get the right branch
+    PR_NUMBER: ${{ github.event.pull_request.number }}
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: "Build on ${{ matrix.image }}"
+        # We build on all 3 platforms to ensure we don't have any OS-specific build incompatibilities
+        strategy:
+            fail-fast: false
+            matrix:
+                image:
+                    - ubuntu-24.04
+                    - windows-2022
+                    - macos-14
+                isDevelop:
+                    - ${{ github.event_name == 'push' && github.ref_name == 'develop' }}
+                isPullRequest:
+                    - ${{ github.event_name == 'pull_request' }}
+                # Skip the ubuntu-24.04 build for the develop branch as the dedicated CD build_develop workflow handles that
+                # Skip the non-linux builds for pull requests as Windows is awfully slow, so run in merge queue only
+                exclude:
+                    - isDevelop: true
+                      image: ubuntu-24.04
+                    - isPullRequest: true
+                      image: windows-2022
+                    - isPullRequest: true
+                      image: macos-14
+        runs-on: ${{ matrix.image }}
+        defaults:
+            run:
+                shell: bash
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  # Disable cache on Windows as it is slower than not caching
+                  # https://github.com/actions/setup-node/issues/975
+                  cache: ${{ runner.os != 'Windows' && 'yarn' || '' }}
+                  node-version: "lts/*"
+
+            # Workaround for yarn install timeouts, especially on Windows
+            - run: yarn config set network-timeout 300000
+
+            - name: Fetch layered build
+              run: ./scripts/layered.sh
+
+            - name: Copy config
+              run: cp element.io/develop/config.json config.json
+
+            - name: Build
+              env:
+                  CI_PACKAGE: true
+              run: VERSION=$(scripts/get-version-from-git.sh) yarn build
+
+            - name: Upload Artifact
+              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: webapp-${{ matrix.image }}
+                  path: webapp
+                  retention-days: 1

.github/workflows/build_debian.yaml

@@ -0,0 +1,79 @@
+name: Build Debian package
+on:
+    release:
+        types: [published]
+concurrency: ${{ github.workflow }}
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+jobs:
+    build:
+        name: Build package
+        environment: packages.element.io
+        runs-on: ubuntu-24.04
+        env:
+            R2_INCOMING_BUCKET: ${{ vars.R2_INCOMING_BUCKET }}
+            R2_URL: ${{ vars.CF_R2_S3_API }}
+            VERSION: ${{ github.ref_name }}
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - name: Download package
+              run: |
+                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz"
+                  wget "https://github.com/element-hq/element-web/releases/download/$VERSION/element-$VERSION.tar.gz.asc"
+
+            - name: Check GPG signature
+              run: |
+                  wget "https://packages.element.io/element-release-key.gpg"
+                  gpg --import element-release-key.gpg
+                  gpg --fingerprint "$FINGERPRINT"
+                  gpg --verify "element-$VERSION.tar.gz.asc" "element-$VERSION.tar.gz"
+              env:
+                  FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}
+
+            - name: Prepare
+              run: |
+                  mkdir -p debian/tmp/DEBIAN
+                  find debian -maxdepth 1 -type f -exec cp "{}" debian/tmp/DEBIAN/ \;
+                  mkdir -p debian/tmp/usr/share/element-web/ debian/tmp/etc/element-web/
+
+                  tar -xf "element-$VERSION.tar.gz" -C debian/tmp/usr/share/element-web --strip-components=1 --no-same-owner --no-same-permissions
+                  mv debian/tmp/usr/share/element-web/config.sample.json debian/tmp/etc/element-web/config.json
+                  ln -s /etc/element-web/config.json debian/tmp/usr/share/element-web/config.json
+
+            - name: Write changelog
+              run: |
+                  VERSION=$(cat package.json | jq -r .version)
+                  TIME=$(date -d "$PUBLISHED_AT" -R)
+                  {
+                      echo "element-web ($VERSION) default; urgency=medium"
+                      echo "$BODY" | sed 's/^##/\n  */g;s/^\*/  */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g'
+                      echo ""
+                      echo " -- $ACTOR <support@element.io>  $TIME"
+                  } > debian/tmp/DEBIAN/changelog
+              env:
+                  ACTOR: ${{ github.actor }}
+                  VERSION: ${{ github.event.release.tag_name }}
+                  BODY: ${{ github.event.release.body }}
+                  PUBLISHED_AT: ${{ github.event.release.published_at }}
+
+            - name: Build deb package
+              run: |
+                  VERSION=$(cat package.json | jq -r .version)
+                  dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
+                  dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb
+
+            - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: element-web.deb
+                  path: element-web.deb
+                  retention-days: 14
+
+            - name: Publish to packages.element.io
+              if: github.event.release.prerelease == false
+              uses: element-hq/packages.element.io@master
+              with:
+                  file: element-web.deb
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}

.github/workflows/build_develop.yml

@@ -0,0 +1,132 @@
+# Separate to the main build workflow for access to develop
+# environment secrets, largely similar to build.yaml.
+name: Build and Deploy develop
+on:
+    push:
+        branches: [develop]
+    repository_dispatch:
+        types: [element-web-notify]
+concurrency:
+    group: ${{ github.repository_owner }}-${{ github.workflow }}-${{ github.ref_name }}
+    cancel-in-progress: true
+permissions: {}
+jobs:
+    build:
+        name: "Build & Deploy develop.element.io"
+        # Only respect triggers from our develop branch, ignore that of forks
+        if: github.repository == 'element-hq/element-web'
+        runs-on: ubuntu-24.04
+        environment: develop
+        permissions:
+            checks: read
+            pages: write
+            deployments: write
+        env:
+            R2_BUCKET: "element-web-develop"
+            R2_URL: ${{ vars.CF_R2_S3_API }}
+            R2_PUBLIC_URL: "https://element-web-develop.element.io"
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            - name: Install Dependencies
+              run: "./scripts/layered.sh"
+
+            - name: Build, Package & Upload sourcemaps
+              run: "./scripts/ci_package.sh"
+              env:
+                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+                  SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+                  SENTRY_URL: ${{ secrets.SENTRY_URL }}
+                  SENTRY_ORG: element
+                  SENTRY_PROJECT: riot-web
+                  # We only deploy the latest bundles to Cloudflare Pages and use _redirects to fallback to R2 for
+                  # older ones. This redirect means that 'self' is insufficient in the CSP,
+                  # and we have to add the R2 URL.
+                  # Once Cloudflare redirects support proxying mode we will be able to ditch this.
+                  # See Proxying in support table at https://developers.cloudflare.com/pages/platform/redirects
+                  CSP_EXTRA_SOURCE: ${{ env.R2_PUBLIC_URL }}
+
+            - run: mv dist/element-*.tar.gz dist/develop.tar.gz
+
+            - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: webapp
+                  path: dist/develop.tar.gz
+                  retention-days: 1
+
+            - name: Extract webapp
+              run: |
+                  mkdir _deploy
+                  tar xf dist/develop.tar.gz -C _deploy --strip-components=1
+
+            - name: Copy config
+              run: cp element.io/develop/config.json _deploy/config.json
+
+            - name: Populate 404.html
+              run: echo "404 Not Found" > _deploy/404.html
+
+            - name: Populate _headers
+              run: cp .github/cfp_headers _deploy/_headers
+
+            # Redirect requests for the develop tarball and the historical bundles to R2
+            # We find the latest 100 bundle.css files and add their bundles to the redirects file
+            # S3 has no sane way to get the age of a directory as they don't really exist
+            - name: Populate _redirects
+              run: |
+                  {
+                      echo "/develop.tar.gz $R2_PUBLIC_URL/develop.tar.gz 301"
+                      aws s3api --region auto --endpoint-url $R2_URL list-objects-v2 --bucket $R2_BUCKET \
+                          --query "sort_by(Contents[?ends_with(Key, '/bundle.css')], &LastModified)[-100:].Key" \
+                          --prefix "bundles/" | jq -r '.[]' | grep -oE '[^\"].*\/\s*' | while read -r path ; do
+                          echo "/${path}* $R2_PUBLIC_URL/${path}:splat 301"
+                      done
+                  } | tee _deploy/_redirects
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+
+            # We may be trying to deploy the same webapp bundles again, we need to ensure that the live bundles
+            # are not present in the _redirects file and instead accessed directly from Cloudflare Pages.
+            - name: Trim _redirects
+              working-directory: _deploy
+              run: |
+                  find bundles -type d -mindepth 1 -maxdepth 1 -exec sed -i "\:{}:d" _redirects \;
+
+            - name: Wait for other steps to succeed
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: ${{ github.sha }}
+                  running-workflow-name: "Build & Deploy develop.element.io"
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages).)*$
+
+            # We keep the latest develop.tar.gz on R2 instead of relying on the github artifact uploaded earlier
+            # as the expires after 24h and requires auth to download.
+            # Element Desktop's fetch script uses this tarball to fetch latest develop to build Nightlies.
+            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
+            - name: Deploy to R2
+              run: |
+                  aws s3 cp dist/develop.tar.gz s3://$R2_BUCKET/develop.tar.gz --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
+                  aws s3 cp _deploy/ s3://$R2_BUCKET/ --recursive --endpoint-url $R2_URL --region=auto --checksum-algorithm CRC32
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+
+            - name: Deploy to Cloudflare Pages
+              id: cfp
+              uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
+              with:
+                  apiToken: ${{ secrets.CF_PAGES_TOKEN }}
+                  accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
+                  projectName: element-web-develop
+                  directory: _deploy
+                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}
+
+            - run: |
+                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/deploy.yml

@@ -0,0 +1,99 @@
+# Manual deploy workflow for deploying to app.element.io & staging.element.io
+# Runs automatically for staging.element.io when an RC or Release is published
+# Note: Does *NOT* run automatically for app.element.io so that it gets tested on staging.element.io beforehand
+name: Deploy release
+run-name: Deploy ${{ github.ref_name }} to ${{ inputs.site || 'staging.element.io' }}
+on:
+    release:
+        types: [published]
+    workflow_dispatch:
+        inputs:
+            site:
+                description: Which site to deploy to
+                required: true
+                default: staging.element.io
+                type: choice
+                options:
+                    - staging.element.io
+                    - app.element.io
+            skip-checks:
+                description: Skip CI on the tagged commit
+                required: true
+                default: false
+                type: boolean
+concurrency: ${{ inputs.site || 'staging.element.io' }}
+permissions: {}
+jobs:
+    deploy:
+        name: "Deploy to Cloudflare Pages"
+        runs-on: ubuntu-24.04
+        environment: ${{ inputs.site || 'staging.element.io' }}
+        permissions:
+            checks: read
+            deployments: write
+        env:
+            SITE: ${{ inputs.site || 'staging.element.io' }}
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - name: Load GPG key
+              run: |
+                  curl https://packages.element.io/element-release-key.gpg | gpg --import
+                  gpg -k "$GPG_FINGERPRINT"
+              env:
+                  GPG_FINGERPRINT: ${{ vars.GPG_FINGERPRINT }}
+
+            - name: Check current version on deployment
+              id: current_version
+              run: |
+                  version=$(curl -s https://$SITE/version)
+                  echo "version=${version#v}" >> $GITHUB_OUTPUT
+
+            # The current version bundle melding dance is skipped if the version we're deploying is the same
+            # as then we're just doing a re-deploy of the same version with potentially different configs.
+            - name: Download current version for its old bundles
+              id: current_download
+              if: steps.current_version.outputs.version != github.ref_name
+              uses: ./.github/actions/download-verify-element-tarball
+              with:
+                  tag: v${{ steps.current_version.outputs.version }}
+                  out-file-path: _current_version
+
+            - name: Download target version
+              uses: ./.github/actions/download-verify-element-tarball
+              with:
+                  tag: ${{ github.ref_name }}
+                  out-file-path: _deploy
+
+            - name: Merge current bundles into target
+              if: steps.current_download.outcome == 'success'
+              run: cp -vnpr _current_version/bundles/* _deploy/bundles/
+
+            - name: Copy config
+              run: cp element.io/app/config.json _deploy/config.json
+
+            - name: Populate 404.html
+              run: echo "404 Not Found" > _deploy/404.html
+
+            - name: Populate _headers
+              run: cp .github/cfp_headers _deploy/_headers
+
+            - name: Wait for other steps to succeed
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              if: inputs.skip-checks != true
+              with:
+                  ref: ${{ github.sha }}
+                  running-workflow-name: "Deploy to Cloudflare Pages"
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages).)*$
+
+            - name: Deploy to Cloudflare Pages
+              uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
+              with:
+                  apiToken: ${{ secrets.CF_PAGES_TOKEN }}
+                  accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
+                  projectName: ${{ env.SITE == 'staging.element.io' && 'element-web-staging' || 'element-web' }}
+                  directory: _deploy
+                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}
+                  branch: main

.github/workflows/docker.yaml

@@ -0,0 +1,154 @@
+name: Docker
+on:
+    workflow_dispatch: {}
+    push:
+        tags: [v*]
+    pull_request: {}
+    schedule:
+        # This job can take a while, and we have usage limits, so just publish develop only twice a day
+        - cron: "0 7/12 * * *"
+concurrency: ${{ github.workflow }}-${{ github.ref_name }}
+permissions: {}
+jobs:
+    buildx:
+        name: Docker Buildx
+        runs-on: ubuntu-24.04
+        environment: ${{ github.event_name != 'pull_request' && 'dockerhub' || '' }}
+        permissions:
+            id-token: write # needed for signing the images with GitHub OIDC Token
+            packages: write # needed for publishing packages to GHCR
+        env:
+            TEST_TAG: vectorim/element-web:test
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  fetch-depth: 0 # needed for docker-package to be able to calculate the version
+
+            - name: Install Cosign
+              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+              if: github.event_name != 'pull_request'
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+              with:
+                  install: true
+
+            - name: Login to Docker Hub
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+              if: github.event_name != 'pull_request'
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Build and load
+              id: test-build
+              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              with:
+                  context: .
+                  load: true
+
+            - name: Test the image
+              env:
+                  IMAGEID: ${{ steps.test-build.outputs.imageid }}
+              timeout-minutes: 2
+              run: |
+                  set -x
+
+                  # Make a fake module to test the image
+                  MODULE_PATH="modules/module_name/index.js"
+                  mkdir -p $(dirname $MODULE_PATH)
+                  echo 'alert("Testing");' > $MODULE_PATH
+
+                  # Spin up a container of the image
+                  ELEMENT_WEB_PORT=8181
+                  CONTAINER_ID=$(
+                      docker run \
+                          --rm \
+                          -e "ELEMENT_WEB_PORT=$ELEMENT_WEB_PORT" \
+                          -dp "$ELEMENT_WEB_PORT:$ELEMENT_WEB_PORT" \
+                          -v $(pwd)/modules:/modules \
+                          "$IMAGEID" \
+                  )
+
+                  # Run some smoke tests
+                  wget --retry-connrefused --tries=5 -q --wait=3 --spider "http://localhost:$ELEMENT_WEB_PORT/modules/module_name/index.js"
+                  MODULE_0=$(curl "http://localhost:$ELEMENT_WEB_PORT/config.json" | jq -r .modules[0])
+                  test "$MODULE_0" = "/${MODULE_PATH}"
+
+                  # Check healthcheck
+                  until test "$(docker inspect -f {{.State.Health.Status}} $CONTAINER_ID)" == "healthy"; do
+                      sleep 1
+                  done
+
+                  # Clean up
+                  docker stop "$CONTAINER_ID"
+
+            - name: Docker meta
+              id: meta
+              uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
+              if: github.event_name != 'pull_request'
+              with:
+                  images: |
+                      vectorim/element-web
+                      ghcr.io/element-hq/element-web
+                  tags: |
+                      type=ref,event=branch
+                      type=ref,event=tag
+                  flavor: |
+                      latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}
+
+            - name: Build and push
+              id: build-and-push
+              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              if: github.event_name != 'pull_request'
+              with:
+                  context: .
+                  push: true
+                  platforms: linux/amd64,linux/arm64
+                  tags: ${{ steps.meta.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
+
+            - name: Sign the images with GitHub OIDC Token
+              env:
+                  DIGEST: ${{ steps.build-and-push.outputs.digest }}
+                  TAGS: ${{ steps.meta.outputs.tags }}
+              if: github.event_name != 'pull_request'
+              run: |
+                  images=""
+                  for tag in ${TAGS}; do
+                      images+="${tag}@${DIGEST} "
+                  done
+                  cosign sign --yes ${images}
+
+            - name: Update repo description
+              uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5
+              if: github.event_name != 'pull_request'
+              continue-on-error: true
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+                  repository: vectorim/element-web
+
+            - name: Repository Dispatch
+              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
+              if: github.event_name != 'pull_request'
+              with:
+                  repository: element-hq/element-web-pro
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  event-type: image-built
+                  # Stable way to determine the :version
+                  client-payload: |-
+                      {
+                          "base-ref": "${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}"
+                      }

.github/workflows/docs.yml

@@ -0,0 +1,107 @@
+name: Deploy documentation
+
+on:
+    push:
+        branches: [develop]
+    workflow_dispatch: {}
+
+permissions: {}
+
+concurrency:
+    group: "pages"
+    cancel-in-progress: false
+
+jobs:
+    build:
+        name: GitHub Pages
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Fetch element-desktop
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  repository: element-hq/element-desktop
+                  path: element-desktop
+
+            - name: Fetch element-web
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  path: element-web
+
+            - name: Fetch matrix-js-sdk
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  repository: matrix-org/matrix-js-sdk
+                  path: matrix-js-sdk
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  cache-dependency-path: element-web/yarn.lock
+                  node-version: "lts/*"
+
+            - name: Generate automations docs
+              working-directory: element-web
+              run: |
+                  yarn install --frozen-lockfile
+                  yarn node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
+                  echo "-   [Automations](automations.md)" >> docs/SUMMARY.md
+
+            - name: Setup mdBook
+              uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2
+              with:
+                  mdbook-version: "0.5.1"
+
+            - name: Install mdbook extensions
+              run: cargo install mdbook-combiner mdbook-mermaid
+
+            - name: Prepare docs
+              run: |
+                  mkdir docs
+
+                  mv element-desktop/README.md element-desktop/docs/
+                  mv element-desktop/docs "docs/Element Desktop"
+
+                  mv element-web/README.md element-web/docs/
+                  mv element-web/docs/lib docs/
+                  mv element-web/docs "docs/Element Web"
+
+                  mv matrix-js-sdk/README.md matrix-js-sdk/docs/
+                  mv matrix-js-sdk/docs "docs/Matrix JS SDK"
+
+                  sed -i -e 's/\.\.\/README.md/README.md/' docs/**/SUMMARY.md
+
+                  mdbook-combiner -m docs
+                  sed -i -E 's/^\t# (.+)$/- [\1]()/gm;t' SUMMARY.md
+                  sed -i -E 's/^- \[(.+)]\(<>\)$/---\n# \1/gm;t' SUMMARY.md
+                  sed -i -E 's/\t- \[Introduction]/- [Introduction]/gm;t' SUMMARY.md
+
+                  cat <<EOF > docs/SUMMARY.md
+                  # Summary
+                  - [Introduction](<Element Web/README.md>)
+
+                  EOF
+                  cat SUMMARY.md >> docs/SUMMARY.md
+
+                  mv element-web/book.toml .
+
+            - name: Build docs
+              run: mdbook build
+
+            - name: Upload artifact
+              uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+              with:
+                  path: ./book
+
+    deploy:
+        environment:
+            name: github-pages
+            url: ${{ steps.deployment.outputs.page_url }}
+        runs-on: ubuntu-24.04
+        permissions:
+            pages: write
+            id-token: write
+        needs: build
+        steps:
+            - name: Deploy to GitHub Pages
+              id: deployment
+              uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/end-to-end-tests-netlify.yaml

@@ -0,0 +1,46 @@
+# Triggers after the playwright tests have finished,
+# taking the artifact and uploading it to Netlify for easier viewing
+name: Upload End to End Test report to Netlify
+on:
+    workflow_run:
+        workflows: ["End to End Tests"]
+        types:
+            - completed
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
+    cancel-in-progress: ${{ github.event.workflow_run.event == 'pull_request' }}
+
+permissions: {}
+
+jobs:
+    report:
+        if: github.event.workflow_run.conclusion != 'cancelled'
+        name: Report results
+        runs-on: ubuntu-24.04
+        environment: Netlify
+        permissions:
+            statuses: write
+            deployments: write
+            actions: read
+        steps:
+            - name: Download HTML report
+              uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  run-id: ${{ github.event.workflow_run.id }}
+                  name: html-report
+                  path: playwright-report
+
+            - name: 📤 Deploy to Netlify
+              uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
+              with:
+                  path: playwright-report
+                  owner: ${{ github.event.workflow_run.head_repository.owner.login }}
+                  branch: ${{ github.event.workflow_run.head_branch }}
+                  revision: ${{ github.event.workflow_run.head_sha }}
+                  token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+                  site_id: ${{ vars.NETLIFY_SITE_ID }}
+                  desc: Playwright Report
+                  deployment_env: EndToEndTests
+                  prefix: "e2e-"

.github/workflows/end-to-end-tests.yaml

@@ -0,0 +1,238 @@
+# Produce a build of element-web with this version of react-sdk
+# and any matching branches of element-web and js-sdk, output it
+# as an artifact and run end-to-end tests.
+name: End to End Tests
+on:
+    # CRON to run all Projects at 6am UTC
+    schedule:
+        - cron: "0 6 * * *"
+    pull_request: {}
+    merge_group:
+        types: [checks_requested]
+    push:
+        branches: [develop, master]
+    repository_dispatch:
+        types: [element-web-notify]
+
+    # support triggering from other workflows
+    workflow_call:
+        inputs:
+            skip:
+                type: boolean
+                required: false
+                default: false
+                description: "A boolean to skip the playwright check itself while still creating the passing check. Useful when only running in Merge Queues."
+
+            matrix-js-sdk-sha:
+                type: string
+                required: false
+                description: "The Git SHA of matrix-js-sdk to build against. By default, will use a matching branch name if it exists, or develop."
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+    cancel-in-progress: true
+
+env:
+    # fetchdep.sh needs to know our PR number
+    PR_NUMBER: ${{ github.event.pull_request.number }}
+    # Use 6 runners in the default case, but 4 when running on a schedule where we run all 5 projects (20 runners total)
+    NUM_RUNNERS: ${{ github.event_name == 'schedule' && 4 || 6 }}
+
+permissions: {} # No permissions required
+
+jobs:
+    build:
+        name: "Build Element-Web"
+        runs-on: ubuntu-24.04
+        if: inputs.skip != true
+        outputs:
+            num-runners: ${{ env.NUM_RUNNERS }}
+            runners-matrix: ${{ steps.runner-vars.outputs.matrix }}
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  repository: element-hq/element-web
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            - name: Fetch layered build
+              env:
+                  # tell layered.sh to check out the right sha of the JS-SDK & EW, if they were given one
+                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}
+              run: scripts/layered.sh
+
+            - name: Copy config
+              run: cp element.io/develop/config.json config.json
+
+            - name: Build
+              env:
+                  CI_PACKAGE: true
+              run: VERSION=$(scripts/get-version-from-git.sh) yarn build
+
+            - name: Upload Artifact
+              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: webapp
+                  path: webapp
+                  retention-days: 1
+
+            - name: Calculate runner variables
+              id: runner-vars
+              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              with:
+                  script: |
+                      const numRunners = parseInt(process.env.NUM_RUNNERS, 10);
+                      const matrix = Array.from({ length: numRunners }, (_, i) => i + 1);
+                      core.setOutput("matrix", JSON.stringify(matrix));
+
+    playwright:
+        name: "Run Tests [${{ matrix.project }}] ${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}"
+        needs: build
+        if: inputs.skip != true
+        runs-on: ubuntu-24.04
+        permissions:
+            actions: read
+            issues: read
+            pull-requests: read
+        strategy:
+            fail-fast: false
+            matrix:
+                # Run multiple instances in parallel to speed up the tests
+                runner: ${{ fromJSON(needs.build.outputs.runners-matrix) }}
+                project:
+                    - Chrome
+                    - Firefox
+                    - WebKit
+                    - Dendrite
+                    - Pinecone
+                runAllTests:
+                    - ${{ github.event_name == 'schedule' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests') }}
+                # Skip the Firefox & Safari runs unless this was a cron trigger or PR has X-Run-All-Tests label
+                exclude:
+                    - runAllTests: false
+                      project: Firefox
+                    - runAllTests: false
+                      project: WebKit
+                    - runAllTests: false
+                      project: Dendrite
+                    - runAllTests: false
+                      project: Pinecone
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  persist-credentials: false
+                  repository: element-hq/element-web
+
+            - name: 📥 Download artifact
+              uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+              with:
+                  name: webapp
+                  path: webapp
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  cache-dependency-path: yarn.lock
+                  node-version: "lts/*"
+
+            - name: Install dependencies
+              run: yarn install --frozen-lockfile
+
+            - name: Get installed Playwright version
+              id: playwright
+              run: echo "version=$(yarn list --pattern @playwright/test --depth=0 --json --non-interactive --no-progress | jq -r '.data.trees[].name')" >> $GITHUB_OUTPUT
+
+            - name: Cache playwright binaries
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              id: playwright-cache
+              with:
+                  path: ~/.cache/ms-playwright
+                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}
+
+            - name: Install Playwright browsers
+              if: steps.playwright-cache.outputs.cache-hit != 'true'
+              run: yarn playwright install --with-deps --no-shell
+
+            - name: Install system dependencies for WebKit
+              # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
+              if: matrix.project == 'WebKit' && steps.playwright-cache.outputs.cache-hit == 'true'
+              run: yarn playwright install-deps webkit
+
+            # We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
+            - name: Run Playwright tests
+              run: |
+                  yarn playwright test \
+                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                      --project="${{ matrix.project }}" \
+                      ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+
+            - name: Upload blob report to GitHub Actions Artifacts
+              if: always()
+              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: all-blob-reports-${{ matrix.project }}-${{ matrix.runner }}
+                  path: blob-report
+                  retention-days: 1
+
+    downstream-modules:
+        name: Downstream Playwright tests [element-modules]
+        needs: build
+        if: inputs.skip != true && github.event_name == 'merge_group'
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
+        with:
+            webapp-artifact: webapp
+
+    complete:
+        name: end-to-end-tests
+        needs:
+            - playwright
+            - downstream-modules
+        if: always()
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              if: inputs.skip != true
+              with:
+                  persist-credentials: false
+                  repository: element-hq/element-web
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              if: inputs.skip != true
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            - name: Install dependencies
+              if: inputs.skip != true
+              run: yarn install --frozen-lockfile
+
+            - name: Download blob reports from GitHub Actions Artifacts
+              if: inputs.skip != true
+              uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+              with:
+                  pattern: all-blob-reports-*
+                  path: all-blob-reports
+                  merge-multiple: true
+
+            - name: Merge into HTML Report
+              if: inputs.skip != true
+              run: yarn playwright merge-reports --reporter=html,./playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
+              env:
+                  # Only pass creds to the flaky-reporter on main branch runs
+                  GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
+
+            # Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
+            - name: Upload HTML report
+              if: always() && inputs.skip != true
+              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: html-report
+                  path: playwright-report
+                  retention-days: 14
+
+            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+              run: exit 1

.github/workflows/issue_closed.yml

@@ -0,0 +1,157 @@
+# For duplicate issues, ensure the close type is right (not planned), update it if not
+# For all closed (completed) issues, cascade the closure onto any referenced rageshakes
+# For all closed (not planned) issues, comment on rageshakes to move them into the canonical issue if one exists
+on:
+    issues:
+        types: [closed]
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+jobs:
+    tidy:
+        name: Tidy closed issues
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              id: main
+              with:
+                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  script: |
+                      const variables = {
+                        owner: context.repo.owner,
+                        name: context.repo.repo,
+                        number: context.issue.number,
+                      };
+
+                      const query = `query($owner:String!, $name:String!, $number:Int!) {
+                        repository(owner: $owner, name: $name) {
+                          issue(number: $number) {
+                            stateReason,
+                            timelineItems(first: 100, itemTypes: [MARKED_AS_DUPLICATE_EVENT, UNMARKED_AS_DUPLICATE_EVENT, CROSS_REFERENCED_EVENT]) {
+                              edges {
+                                node {
+                                  __typename
+                                  ... on MarkedAsDuplicateEvent {
+                                    canonical {
+                                      ... on Issue {
+                                        repository {
+                                          nameWithOwner
+                                        }
+                                        number
+                                      }
+                                      ... on PullRequest {
+                                        repository {
+                                          nameWithOwner
+                                        }
+                                        number
+                                      }
+                                    }
+                                  }
+                                  ... on UnmarkedAsDuplicateEvent {
+                                    canonical {
+                                      ... on Issue {
+                                        repository {
+                                          nameWithOwner
+                                        }
+                                        number
+                                      }
+                                      ... on PullRequest {
+                                        repository {
+                                          nameWithOwner
+                                        }
+                                        number
+                                      }
+                                    }
+                                  }
+                                  ... on CrossReferencedEvent {
+                                    source {
+                                      ... on Issue {
+                                        repository {
+                                          nameWithOwner
+                                        }
+                                        number
+                                      }
+                                      ... on PullRequest {
+                                        repository {
+                                          nameWithOwner
+                                        }
+                                        number
+                                      }
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }`;
+
+                      const result = await github.graphql(query, variables);
+                      const { stateReason, timelineItems: { edges } } = result.repository.issue;
+
+                      const RAGESHAKE_OWNER = "matrix-org";
+                      const RAGESHAKE_REPO = "element-web-rageshakes";
+                      const rageshakes = new Set();
+                      const duplicateOf = new Set();
+
+                      console.log("Edges: ", JSON.stringify(edges));
+
+                      for (const { node } of edges) {
+                        switch(node.__typename) {
+                          case "MarkedAsDuplicateEvent":
+                            duplicateOf.add(node.canonical.repository.nameWithOwner + "#" + node.canonical.number);
+                            break;
+                          case "UnmarkedAsDuplicateEvent":
+                            duplicateOf.remove(node.canonical.repository.nameWithOwner + "#" + node.canonical.number);
+                            break;
+                          case "CrossReferencedEvent":
+                            if (node.source.repository.nameWithOwner === (RAGESHAKE_OWNER + "/" + RAGESHAKE_REPO)) {
+                              rageshakes.add(node.source.number);
+                            }
+                            break;
+                        }
+                      }
+
+                      console.log("Duplicate of: ", duplicateOf);
+                      console.log("Found rageshakes: ", rageshakes);
+
+                      if (duplicateOf.size) {
+                        const body = Array.from(duplicateOf).join("\n");
+
+                        // Comment on all rageshakes to create relationship to the issue this was closed as duplicate of
+                        for (const rageshake of rageshakes) {
+                          github.rest.issues.createComment({
+                            owner: RAGESHAKE_OWNER,
+                            repo: RAGESHAKE_REPO,
+                            issue_number: rageshake,
+                            body,
+                          });
+                        }
+
+                        // Duplicate was closed with wrong reason, fix it
+                        if (stateReason === "COMPLETED") {
+                          core.setOutput("closeAsNotPlanned", "true");
+                        }
+                      } else {
+                        // This issue was closed, close all related rageshakes
+                        for (const rageshake of rageshakes) {
+                          github.rest.issues.update({
+                            owner: RAGESHAKE_OWNER,
+                            repo: RAGESHAKE_REPO,
+                            issue_number: rageshake,
+                            state: "closed",
+                          });
+                        }
+                      }
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              name: Close duplicate as Not Planned
+              if: steps.main.outputs.closeAsNotPlanned
+              with:
+                  # We do this step separately, and with the default token so as to not re-trigger this workflow when re-closing
+                  script: |
+                      await github.graphql(`mutation($id:ID!) {
+                        closeIssue(input: { issueId:$id, stateReason:NOT_PLANNED }) {
+                          clientMutationId
+                        }
+                      }`, {
+                        id: context.payload.issue.node_id,
+                      });

.github/workflows/localazy_download.yaml

@@ -0,0 +1,12 @@
+name: Localazy Download
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 6 * * 1,3,5" # Every Monday, Wednesday and Friday at 6am UTC
+permissions:
+    pull-requests: write # needed to auto-approve PRs
+jobs:
+    download:
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/localazy_upload.yaml

@@ -0,0 +1,12 @@
+name: Localazy Upload
+on:
+    push:
+        branches: [develop]
+        paths:
+            - "src/i18n/strings/en_EN.json"
+permissions: {} # No permissions needed
+jobs:
+    upload:
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        secrets:
+            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}

.github/workflows/netlify.yaml

@@ -0,0 +1,51 @@
+# Triggers after the layered build has finished, taking the artifact
+# and uploading it to netlify
+name: Upload Preview Build to Netlify
+on:
+    workflow_run:
+        workflows: ["Build"]
+        types:
+            - completed
+jobs:
+    deploy:
+        if: github.event.workflow_run.conclusion != 'cancelled' && github.event.workflow_run.event == 'pull_request'
+        runs-on: ubuntu-24.04
+        environment: Netlify
+        permissions:
+            actions: read
+            deployments: write
+        steps:
+            - name: 📝 Create Deployment
+              uses: bobheadxi/deployments@648679e8e4915b27893bd7dbc35cb504dc915bc8 # v1
+              id: deployment
+              with:
+                  step: start
+                  token: ${{ secrets.GITHUB_TOKEN }}
+                  env: Netlify
+                  ref: ${{ github.event.workflow_run.head_sha }}
+                  desc: |
+                      Do you trust the author of this PR? Maybe this build will steal your keys or give you malware.
+                      Exercise caution. Use test accounts.
+
+            - name: 📥 Download artifact
+              uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  run-id: ${{ github.event.workflow_run.id }}
+                  name: webapp-ubuntu-24.04
+                  path: webapp
+
+            - name: 📤 Deploy to Netlify
+              uses: matrix-org/netlify-pr-preview@9805cd123fc9a7e421e35340a05e1ebc5dee46b5 # v3
+              with:
+                  path: webapp
+                  owner: ${{ github.event.workflow_run.head_repository.owner.login }}
+                  branch: ${{ github.event.workflow_run.head_branch }}
+                  revision: ${{ github.event.workflow_run.head_sha }}
+                  token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+                  site_id: ${{ vars.NETLIFY_SITE_ID }}
+                  deployment_env: ${{ steps.deployment.outputs.env }}
+                  deployment_id: ${{ steps.deployment.outputs.deployment_id }}
+                  desc: |
+                      Do you trust the author of this PR? Maybe this build will steal your keys or give you malware.
+                      Exercise caution. Use test accounts.

.github/workflows/pending-reviews.yaml

@@ -0,0 +1,92 @@
+name: Pending reviews automation
+on:
+    # The bot exceeded its API rate limit. Disabling for now (adding workflow dispatch so the workflow file stays valid & we can test to see if it starts working again)
+    workflow_dispatch: {}
+    # We run it on a schedule instead of on pull_request_* events to not create confusing messaging in the PR
+    #schedule:
+    #    - cron: "*/10 * * * *"
+concurrency: ${{ github.workflow }}
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+jobs:
+    bot:
+        name: Pending reviews bot
+        runs-on: ubuntu-24.04
+        environment: Matrix
+        env:
+            URL: "https://github.com/pulls?q=is%3Apr+is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+review-requested%3A%40me+sort%3Aupdated-desc+"
+            RELEASE_BLOCKERS_URL: "https://github.com/pulls?q=is%3Aopen+repo%3Amatrix-org%2Fmatrix-js-sdk+repo%3Amatrix-org%2Fmatrix-react-sdk+repo%3Aelement-hq%2Felement-web+repo%3Aelement-hq%2Felement-desktop+sort%3Aupdated-desc+label%3AX-Release-Blocker+"
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              env:
+                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
+                  ROOM_ID: ${{ secrets.ROOM_ID }}
+                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
+              with:
+                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  script: |
+                      const { HS_URL, ROOM_ID, TOKEN, URL, RELEASE_BLOCKERS_URL } = process.env;
+
+                      async function updateCounter(counter, link, severity, title, value, clearOnZero) {
+                          const apiUrl = `${HS_URL}/_matrix/client/v3/rooms/${ROOM_ID}/state/re.jki.counter/${counter}`;
+                          const headers = {
+                              "Content-Type": "application/json",
+                              "Authorization": `Bearer ${TOKEN}`,
+                          };
+                          const res = await fetch(apiUrl, {
+                              method: "GET",
+                              headers,
+                          });
+
+                          const data = await res.json();
+
+                          if (data.value === issueCount) {
+                              console.log("Pending review count already correct");
+                              return;
+                          }
+
+                          let body = {};
+                          if (issueCount || !clearOnZero) {
+                              body = JSON.stringify({
+                                  link,
+                                  severity,
+                                  title,
+                                  value,
+                              });
+                          }
+
+                          await fetch(apiUrl, {
+                              method: "PUT",
+                              body,
+                              headers,
+                          });
+                      }
+
+                      const repos = [
+                          "element-hq/element-desktop",
+                          "element-hq/element-web",
+                          "matrix-org/matrix-js-sdk",
+                      ];
+                      const teams = [
+                          "matrix-org/element-web-team",
+                          "matrix-org/element-web-reviewers",
+                          "element-hq/element-web-team",
+                          "element-hq/element-web-reviewers",
+                      ];
+
+                      let issueCount = 0;
+                      for (const team of teams) {
+                          const org = team.split("/", 2)[0];
+                          const reposInOrg = repos.filter(repo => repo.startsWith(org + "/"));
+                          const { data } = await github.rest.search.issuesAndPullRequests({
+                              q: `is:pr is:open review:required ${reposInOrg.map(r => `repo:${r}`).join(" ")} team-review-requested:${team}`,
+                          });
+                          issueCount += data.total_count;
+                      }
+                      await updateCounter("gh_reviews", URL, "warning", "Pending reviews", issueCount);
+
+                      const { data } = await github.rest.search.issuesAndPullRequests({
+                          q: `is:open ${repos.map(repo => `repo:${repo}`).join(" ")} label:X-Release-Blocker`,
+                      });
+                      const blockerCount = data.total_count;
+                      await updateCounter("release_blockers", RELEASE_BLOCKERS_URL, "alert", "Release Blockers", blockerCount, true);

.github/workflows/playwright-image-updates.yaml

@@ -0,0 +1,57 @@
+name: Update Playwright docker images
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 6 * * *" # Every day at 6am UTC
+permissions: {}
+jobs:
+    update:
+        runs-on: ubuntu-24.04
+        permissions:
+            pull-requests: write
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - name: Update synapse image
+              run: |
+                  docker pull "$IMAGE"
+                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
+                  DIGEST=${INSPECT#*@}
+                  sed -i "s/const TAG.*/const TAG = \"develop@$DIGEST\";/" playwright/testcontainers/synapse.ts
+              env:
+                  IMAGE: ghcr.io/element-hq/synapse:develop
+
+            - name: Update MAS image
+              run: |
+                  docker pull "$IMAGE"
+                  INSPECT=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
+                  DIGEST=${INSPECT#*@}
+                  sed -i "s/const TAG.*/const TAG = \"main@$DIGEST\";/" playwright/testcontainers/mas.ts
+              env:
+                  IMAGE: ghcr.io/element-hq/matrix-authentication-service:main
+
+            - name: Create Pull Request
+              id: cpr
+              uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7
+              with:
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  branch: actions/playwright-image-updates
+                  delete-branch: true
+                  title: Playwright Docker image updates
+                  labels: |
+                      T-Task
+
+            - name: Enable automerge
+              run: gh pr merge --merge --auto "$PR_NUMBER"
+              if: steps.cpr.outputs.pull-request-operation == 'created'
+              env:
+                  GH_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+
+            - name: Enable autoapprove
+              run: |
+                  gh pr review --approve "$PR_NUMBER"
+              if: steps.cpr.outputs.pull-request-operation == 'created'
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}

.github/workflows/pull_request.yaml

@@ -0,0 +1,14 @@
+name: Pull Request
+on:
+    pull_request_target:
+        types: [opened, edited, labeled, unlabeled, synchronize]
+    merge_group:
+        types: [checks_requested]
+permissions: {}
+jobs:
+    action:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        permissions:
+            pull-requests: write
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/pull_request_base_branch.yaml

@@ -0,0 +1,17 @@
+name: Pull Request Base Branch
+on:
+    pull_request:
+        types: [opened, edited, synchronize]
+permissions: {} # No permissions required
+jobs:
+    check_base_branch:
+        name: Check PR base branch
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              with:
+                  script: |
+                      const baseBranch = context.payload.pull_request.base.ref;
+                      if (!['develop', 'staging'].includes(baseBranch) && !baseBranch.startsWith('feat/')) {
+                          core.setFailed(`Invalid base branch: ${baseBranch}`);
+                      }

.github/workflows/release-drafter.yml

@@ -0,0 +1,12 @@
+name: Release Drafter
+on:
+    push:
+        branches: [staging]
+    workflow_dispatch: {}
+concurrency: ${{ github.workflow }}
+permissions: {}
+jobs:
+    draft:
+        permissions:
+            contents: write
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop

.github/workflows/release-gitflow.yml

@@ -0,0 +1,15 @@
+# Gitflow merge-back master->develop
+name: Merge master -> develop
+on:
+    push:
+        branches: [master]
+concurrency: ${{ github.repository }}-${{ github.workflow }}
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+jobs:
+    merge:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+        with:
+            dependencies: |
+                matrix-js-sdk

.github/workflows/release.yml

@@ -0,0 +1,70 @@
+name: Release Process
+on:
+    workflow_dispatch:
+        inputs:
+            mode:
+                description: What type of release
+                required: true
+                default: rc
+                type: choice
+                options:
+                    - rc
+                    - final
+concurrency: ${{ github.workflow }}
+permissions: {}
+jobs:
+    release:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        permissions:
+            contents: write
+            issues: write
+            pull-requests: read
+            id-token: write
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+            GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        with:
+            final: ${{ inputs.mode == 'final' }}
+            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
+            asset-path: dist/*.tar.gz
+            expected-asset-count: 3
+
+    notify-downstream:
+        name: Trigger release drafter downstream
+        needs: release
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Notify element-desktop repo that element-web release has completed to re-trigger release-drafter
+              uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1
+              with:
+                  workflow: release-drafter.yml
+                  repo: element-hq/element-desktop
+                  ref: staging
+                  # Required when using the `repo` option. Either a PAT or a token generated from the GitHub app or CLI
+                  token: "${{ secrets.ELEMENT_BOT_TOKEN }}"
+
+    check:
+        name: Post release checks
+        needs: release
+        runs-on: ubuntu-24.04
+        permissions:
+            checks: read
+        steps:
+            - name: Wait for docker build
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: master
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-name: "Docker Buildx"
+                  allowed-conclusions: success
+
+            - name: Wait for debian package
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: master
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-name: Build package
+                  allowed-conclusions: success

.github/workflows/release_prepare.yml

@@ -0,0 +1,126 @@
+name: Cut branches
+on:
+    workflow_dispatch:
+        inputs:
+            element-desktop:
+                description: Prepare element-desktop
+                required: true
+                type: boolean
+                default: true
+            element-web:
+                description: Prepare element-web
+                required: true
+                type: boolean
+                default: true
+            matrix-js-sdk:
+                description: Prepare matrix-js-sdk
+                required: true
+                type: boolean
+                default: true
+permissions: {} # Uses ELEMENT_BOT_TOKEN instead
+jobs:
+    checks:
+        name: Sanity checks
+        strategy:
+            matrix:
+                repo:
+                    - matrix-org/matrix-js-sdk
+                    - element-hq/element-web
+                    - element-hq/element-desktop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+        with:
+            repository: ${{ matrix.repo }}
+
+    prepare:
+        runs-on: ubuntu-24.04
+        needs: checks
+        env:
+            # The order is specified bottom-up to avoid any races for allchange
+            REPOS: matrix-js-sdk element-web element-desktop
+        steps:
+            - name: Checkout Element Desktop
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              if: inputs.element-desktop
+              with:
+                  repository: element-hq/element-desktop
+                  path: element-desktop
+                  ref: staging
+                  fetch-depth: 0
+                  fetch-tags: true
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            - name: Checkout Element Web
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              if: inputs.element-web
+              with:
+                  repository: element-hq/element-web
+                  path: element-web
+                  ref: staging
+                  fetch-depth: 0
+                  fetch-tags: true
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            - name: Checkout Matrix JS SDK
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              if: inputs.matrix-js-sdk
+              with:
+                  repository: matrix-org/matrix-js-sdk
+                  path: matrix-js-sdk
+                  ref: staging
+                  fetch-depth: 0
+                  fetch-tags: true
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+            - name: Prepare Git
+              run: |
+                  git config --global user.email "releases@riot.im"
+                  git config --global user.name "RiotRobot"
+
+            - name: Merge Element Desktop
+              if: inputs.element-desktop
+              run: |
+                  git -C "element-desktop" merge origin/develop
+            - name: Merge Element Web
+              if: inputs.element-web
+              run: |
+                  git -C "element-web" merge origin/develop
+            - name: Merge JS SDK
+              if: inputs.matrix-js-sdk
+              run: |
+                  git -C "matrix-js-sdk" merge origin/develop
+
+            - name: Push staging
+              run: for REPO in $REPOS; do [ -d "$REPO" ] && git -C "$REPO" push origin staging; done
+
+            - name: Wait for matrix-js-sdk draft
+              if: inputs.matrix-js-sdk
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: staging
+                  repo: matrix-org/matrix-js-sdk
+                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  wait-interval: 10
+                  check-name: "draft / draft"
+                  allowed-conclusions: success
+
+            - name: Wait for element-web draft
+              if: inputs.element-web
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: staging
+                  repo: element-hq/element-web
+                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  wait-interval: 10
+                  check-name: "draft / draft"
+                  allowed-conclusions: success
+
+            - name: Wait for element-desktop draft
+              if: inputs.element-desktop
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: staging
+                  repo: element-hq/element-desktop
+                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  wait-interval: 10
+                  check-name: "draft / draft"
+                  allowed-conclusions: success

.github/workflows/sonarqube.yml

@@ -0,0 +1,24 @@
+name: SonarQube
+on:
+    workflow_run:
+        workflows: ["Tests"]
+        types:
+            - completed
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
+    cancel-in-progress: true
+permissions: {}
+jobs:
+    sonarqube:
+        name: 🩻 SonarQube
+        if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        permissions:
+            actions: read
+            statuses: write
+            id-token: write # sonar
+        secrets:
+            SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+        with:
+            sharded: true

.github/workflows/static_analysis.yaml

@@ -0,0 +1,147 @@
+name: Static Analysis
+on:
+    pull_request: {}
+    push:
+        branches: [develop, master]
+    merge_group:
+        types: [checks_requested]
+    repository_dispatch:
+        types: [element-web-notify]
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+    cancel-in-progress: true
+
+env:
+    # This must be set for fetchdep.sh to get the right branch
+    PR_NUMBER: ${{ github.event.pull_request.number }}
+
+permissions: {} # No permissions required
+
+jobs:
+    ts_lint:
+        name: "Typescript Syntax Check"
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            - name: Install Dependencies
+              run: "./scripts/layered.sh"
+
+            - name: Typecheck
+              run: "yarn run lint:types"
+
+            - name: Install Shared Component Dependencies
+              run: "yarn --cwd packages/shared-components install"
+
+            - name: Typecheck Shared Components
+              run: "yarn --cwd packages/shared-components run lint:types"
+
+    i18n_lint:
+        name: "i18n Check"
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        permissions:
+            pull-requests: read
+        with:
+            hardcoded-words: "Element"
+            allowed-hardcoded-keys: |
+                console_dev_note
+                labs|element_call_video_rooms
+                labs|feature_disable_call_per_sender_encryption
+                voip|element_call
+                error|invalid_json
+                error|misconfigured
+                welcome_to_element
+                devtools|settings|elementCallUrl
+                labs|sliding_sync_description
+
+    rethemendex_lint:
+        name: "Rethemendex Check"
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - run: ./res/css/rethemendex.sh
+
+            - run: git diff --exit-code
+
+    js_lint:
+        name: "ESLint"
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run Linter
+              run: "yarn run lint:js"
+
+            - name: Install Shared Component Deps
+              run: "yarn --cwd packages/shared-components install --frozen-lockfile"
+
+            - name: Run Linter
+              run: "yarn --cwd packages/shared-components run lint:js"
+
+    style_lint:
+        name: "Style Lint"
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install"
+
+            - name: Run Linter
+              run: "yarn run lint:style"
+
+    workflow_lint:
+        name: "Workflow Lint"
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run Linter
+              run: "yarn lint:workflows"
+
+    analyse_dead_code:
+        name: "Analyse Dead Code"
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run linter
+              run: "yarn run lint:knip"

.github/workflows/sync-labels.yml

@@ -0,0 +1,24 @@
+name: Sync labels
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 1 * * *" # 1am every day
+    push:
+        branches:
+            - develop
+        paths:
+            - .github/labels.yml
+
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+
+jobs:
+    sync-labels:
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        with:
+            LABELS: |
+                element-hq/element-meta
+                .github/labels.yml
+            DELETE: true
+            WET: true
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/tests.yml

@@ -0,0 +1,167 @@
+name: Tests
+on:
+    pull_request: {}
+    merge_group:
+        types: [checks_requested]
+    push:
+        branches: [develop, master]
+    repository_dispatch:
+        types: [element-web-notify]
+    workflow_call:
+        inputs:
+            disable_coverage:
+                type: boolean
+                required: false
+                description: "Specify true to skip generating and uploading coverage for tests"
+            matrix-js-sdk-sha:
+                type: string
+                required: false
+                description: "The matrix-js-sdk SHA to use"
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+    cancel-in-progress: true
+
+env:
+    ENABLE_COVERAGE: ${{ github.event_name != 'merge_group' && inputs.disable_coverage != 'true' }}
+    # fetchdep.sh needs to know our PR number
+    PR_NUMBER: ${{ github.event.pull_request.number }}
+
+permissions: {}
+
+jobs:
+    jest_ew:
+        name: Jest (Element Web)
+        runs-on: ubuntu-24.04
+        strategy:
+            fail-fast: false
+            matrix:
+                # Run multiple instances in parallel to speed up the tests
+                runner: [1, 2]
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+
+            - name: Yarn cache
+              uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  node-version: "lts/*"
+                  cache: "yarn"
+
+            - name: Install Deps
+              run: "./scripts/layered.sh"
+              env:
+                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}
+
+            - name: Jest Cache
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              with:
+                  path: /tmp/jest_cache
+                  key: ${{ hashFiles('**/yarn.lock') }}
+
+            - name: Get number of CPU cores
+              id: cpu-cores
+              uses: SimenB/github-actions-cpu-cores@97ba232459a8e02ff6121db9362b09661c875ab8 # v2
+
+            - name: Run tests
+              run: |
+                  yarn test \
+                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                      --ci \
+                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
+                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --cacheDirectory /tmp/jest_cache
+              env:
+                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true
+
+                  # tell jest to use coloured output
+                  FORCE_COLOR: true
+
+            - name: Move coverage files into place
+              if: env.ENABLE_COVERAGE == 'true'
+              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+
+            - name: Upload Artifact
+              if: env.ENABLE_COVERAGE == 'true'
+              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: coverage-${{ matrix.runner }}
+                  path: |
+                      coverage
+                      !coverage/lcov-report
+
+    complete:
+        name: jest-tests
+        needs: jest_ew
+        if: always()
+        runs-on: ubuntu-24.04
+        permissions:
+            statuses: write
+        steps:
+            - if: needs.jest_ew.result != 'skipped' && needs.jest_ew.result != 'success'
+              run: exit 1
+
+            - name: Skip SonarCloud in merge queue
+              if: github.event_name == 'merge_group' || inputs.disable_coverage == 'true'
+              uses: guibranco/github-status-action-v2@5530c593759f489bba08272e96986ffc571c1ea1
+              with:
+                  authToken: ${{ secrets.GITHUB_TOKEN }}
+                  state: success
+                  description: SonarCloud skipped
+                  context: SonarCloud Code Analysis
+                  sha: ${{ github.sha }}
+                  target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+    jest_sc:
+        name: Jest (Shared Components)
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+              with:
+                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+
+            - name: Yarn cache
+              uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  node-version: "lts/*"
+                  cache: "yarn"
+
+            - name: Install EW Deps
+              run: "yarn install"
+
+            - name: Install Shared Component Deps
+              working-directory: "packages/shared-components"
+              run: "yarn install"
+
+            - name: Jest Cache
+              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              with:
+                  path: /tmp/jest_cache
+                  key: ${{ hashFiles('**/yarn.lock') }}
+
+            - name: Get number of CPU cores
+              id: cpu-cores
+              uses: SimenB/github-actions-cpu-cores@97ba232459a8e02ff6121db9362b09661c875ab8 # v2
+
+            - name: Run tests
+              working-directory: "packages/shared-components"
+              run: |
+                  yarn test \
+                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                      --ci \
+                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
+                      --cacheDirectory /tmp/jest_cache
+              env:
+                  # tell jest to use coloured output
+                  FORCE_COLOR: true
+
+            - name: Upload Artifact
+              if: env.ENABLE_COVERAGE == 'true'
+              uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+              with:
+                  name: coverage-sharedcomponents
+                  path: |
+                      packages/shared-components/coverage
+                      !packages/shared-components/coverage/lcov-report

.github/workflows/triage-assigned.yml

@@ -0,0 +1,21 @@
+name: Move issued assigned to specific team members to their boards
+
+on:
+    issues:
+        types: [assigned]
+
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+
+jobs:
+    web-app-team:
+        runs-on: ubuntu-24.04
+        if: |
+            contains(github.event.issue.assignees.*.login, 't3chguy') ||
+            contains(github.event.issue.assignees.*.login, 'florianduros') ||
+            contains(github.event.issue.assignees.*.login, 'dbkr') ||
+            contains(github.event.issue.assignees.*.login, 'MidhunSureshR')
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/67
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-incoming.yml

@@ -0,0 +1,16 @@
+name: Move new issues into Issue triage board
+
+on:
+    issues:
+        types: [opened]
+
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+
+jobs:
+    automate-project-columns:
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/120
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-labelled.yml

@@ -0,0 +1,178 @@
+name: Move labelled issues to correct projects
+
+on:
+    issues:
+        types: [labeled]
+    workflow_call:
+        secrets:
+            ELEMENT_BOT_TOKEN:
+                required: true
+
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+
+jobs:
+    apply_Z-Labs_label:
+        name: Add Z-Labs label for features behind labs flags
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'A-Maths') ||
+            contains(github.event.issue.labels.*.name, 'A-Location-Sharing') ||
+            contains(github.event.issue.labels.*.name, 'Z-IA') ||
+            contains(github.event.issue.labels.*.name, 'A-Jump-To-Date ') ||
+            contains(github.event.issue.labels.*.name, 'A-Themes-Custom') ||
+            contains(github.event.issue.labels.*.name, 'A-E2EE-Dehydration') ||
+            contains(github.event.issue.labels.*.name, 'A-Tags') ||
+            contains(github.event.issue.labels.*.name, 'A-Video-Rooms') ||
+            contains(github.event.issue.labels.*.name, 'A-Message-Starring') ||
+            contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor') ||
+            contains(github.event.issue.labels.*.name, 'A-Element-Call')
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              with:
+                  script: |
+                      github.rest.issues.addLabels({
+                        issue_number: context.issue.number,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        labels: ['Z-Labs']
+                      })
+
+    apply_Help-Wanted_label:
+        name: Add "Help Wanted" label to all "good first issue" and Hacktoberfest
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'good first issue') ||
+            contains(github.event.issue.labels.*.name, 'Hacktoberfest')
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              with:
+                  script: |
+                      github.rest.issues.addLabels({
+                        issue_number: context.issue.number,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        labels: ['Help Wanted']
+                      })
+
+    move_needs_info_issues:
+        name: X-Needs-Info issues to Need info column on triage board
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'X-Needs-Info')
+        steps:
+            - id: add_to_project
+              uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: ${{ env.PROJECT_URL }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+            - id: set_fields
+              uses: titoportas/update-project-fields@421a54430b3cdc9eefd8f14f9ce0142ab7678751 # v0.1.0
+              with:
+                  project-url: ${{ env.PROJECT_URL }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  item-id: ${{ steps.add_to_project.outputs.itemId }} # Use the item-id output of the previous step
+                  field-keys: Status
+                  field-values: "Needs info"
+        env:
+            PROJECT_URL: https://github.com/orgs/element-hq/projects/120
+
+    move_flakey_test_issues:
+        name: Z-Flaky-Test issues to Sized for maintainer column on triage board
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'Z-Flaky-Test')
+        steps:
+            - id: add_to_project
+              uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: ${{ env.PROJECT_URL }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+            - id: set_fields
+              uses: titoportas/update-project-fields@421a54430b3cdc9eefd8f14f9ce0142ab7678751 # v0.1.0
+              with:
+                  project-url: ${{ env.PROJECT_URL }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  item-id: ${{ steps.add_to_project.outputs.itemId }} # Use the item-id output of the previous step
+                  field-keys: Status
+                  field-values: "Sized for maintainer"
+        env:
+            PROJECT_URL: https://github.com/orgs/element-hq/projects/120
+
+    add_priority_design_issues_to_project:
+        name: P1 X-Needs-Design to Design project board
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'X-Needs-Design') &&
+            (contains(github.event.issue.labels.*.name, 'S-Critical') &&
+             (contains(github.event.issue.labels.*.name, 'O-Frequent') ||
+              contains(github.event.issue.labels.*.name, 'O-Occasional')) ||
+             contains(github.event.issue.labels.*.name, 'S-Major') &&
+             contains(github.event.issue.labels.*.name, 'O-Frequent') ||
+             contains(github.event.issue.labels.*.name, 'A11y'))
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/18
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+    add_product_issues:
+        name: X-Needs-Product to product project board
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'X-Needs-Product')
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/28
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+    Search_issues_to_board:
+        name: Search issues to project board
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'A-New-Search-Experience')
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/48
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+    voip:
+        name: Add labelled issues to VoIP project board
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'Team: VoIP')
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/41
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+    crypto:
+        name: Add labelled issues to Crypto project
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'Team: Crypto')
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/76
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+    tech_debt:
+        name: Add labelled issues to tech debt project
+        runs-on: ubuntu-24.04
+        if: >
+            contains(github.event.issue.labels.*.name, 'A-Developer-Experience') ||
+            contains(github.event.issue.labels.*.name, 'A-Documentation') ||
+            contains(github.event.issue.labels.*.name, 'A-Packaging') ||
+            contains(github.event.issue.labels.*.name, 'A-Technical-Debt') ||
+            contains(github.event.issue.labels.*.name, 'A-Testing') ||
+            contains(github.event.issue.labels.*.name, 'Z-Flaky-Test')
+        steps:
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/101
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-move-review-requests.yml

@@ -0,0 +1,140 @@
+name: Move pull requests asking for review to the relevant project
+on:
+    pull_request_target:
+        types: [review_requested]
+
+permissions: {} # Uses ELEMENT_BOT_TOKEN instead
+jobs:
+    add_design_pr_to_project:
+        name: Move PRs asking for design review to the design board
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: octokit/graphql-action@abaeca7ba4f0325d63b8de7ef943c2418d161b93 # v3.0.0
+              id: find_team_members
+              with:
+                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
+                  query: |
+                      query find_team_members($team: String!) {
+                        organization(login: "element-hq") {
+                          team(slug: $team) {
+                            members {
+                              nodes {
+                                login
+                              }
+                            }
+                          }
+                        }
+                      }
+                  team: ${{ env.TEAM }}
+              env:
+                  TEAM: "design"
+                  GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            - id: any_matching_reviewers
+              run: |
+                  # Fetch requested reviewers, and people who are on the team
+                  echo '${{ tojson(fromjson(steps.find_team_members.outputs.data).organization.team.members.nodes[*].login) }}' | tee /tmp/team_members.json
+                  echo '${{ tojson(github.event.pull_request.requested_reviewers[*].login) }}' | tee /tmp/reviewers.json
+                  jq --raw-output .[] < /tmp/team_members.json | sort | tee /tmp/team_members.txt
+                  jq --raw-output .[] < /tmp/reviewers.json | sort | tee /tmp/reviewers.txt
+
+                  # Fetch requested team reviewers, and the name of the team
+                  echo '${{ tojson(github.event.pull_request.requested_teams[*].slug) }}' | tee /tmp/team_reviewers.json
+                  jq --raw-output .[] < /tmp/team_reviewers.json | sort | tee /tmp/team_reviewers.txt
+                  echo '${{ env.TEAM }}' | tee /tmp/team.txt
+
+                  # If either a reviewer matches a team member, or a team matches our team, say "true"
+                  if [ $(join /tmp/team_members.txt /tmp/reviewers.txt | wc -l) != 0 ]; then
+                    echo "match=true" >> $GITHUB_OUTPUT
+                  elif [ $(join /tmp/team.txt /tmp/team_reviewers.txt | wc -l) != 0 ]; then
+                    echo "match=true" >> $GITHUB_OUTPUT
+                  else
+                    echo "match=false" >> $GITHUB_OUTPUT
+                  fi
+              env:
+                  TEAM: "design"
+            - uses: octokit/graphql-action@abaeca7ba4f0325d63b8de7ef943c2418d161b93 # v3.0.0
+              id: add_to_project
+              if: steps.any_matching_reviewers.outputs.match == 'true'
+              with:
+                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
+                  query: |
+                      mutation add_to_project($projectid:ID!, $contentid:ID!) {
+                        addProjectV2ItemById(input: {projectId: $projectid contentId: $contentid}) {
+                          item {
+                            id
+                          }
+                        }
+                      }
+                  projectid: ${{ env.PROJECT_ID }}
+                  contentid: ${{ github.event.pull_request.node_id }}
+              env:
+                  PROJECT_ID: "PVT_kwDOAM0swc0sUA"
+                  TEAM: "design"
+                  GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+
+    add_product_pr_to_project:
+        name: Move PRs asking for design review to the design board
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: octokit/graphql-action@abaeca7ba4f0325d63b8de7ef943c2418d161b93 # v3.0.0
+              id: find_team_members
+              with:
+                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
+                  query: |
+                      query find_team_members($team: String!) {
+                        organization(login: "element-hq") {
+                          team(slug: $team) {
+                            members {
+                              nodes {
+                                login
+                              }
+                            }
+                          }
+                        }
+                      }
+                  team: ${{ env.TEAM }}
+              env:
+                  TEAM: "product"
+                  GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            - id: any_matching_reviewers
+              run: |
+                  # Fetch requested reviewers, and people who are on the team
+                  echo '${{ tojson(fromjson(steps.find_team_members.outputs.data).organization.team.members.nodes[*].login) }}' | tee /tmp/team_members.json
+                  echo '${{ tojson(github.event.pull_request.requested_reviewers[*].login) }}' | tee /tmp/reviewers.json
+                  jq --raw-output .[] < /tmp/team_members.json | sort | tee /tmp/team_members.txt
+                  jq --raw-output .[] < /tmp/reviewers.json | sort | tee /tmp/reviewers.txt
+
+                  # Fetch requested team reviewers, and the name of the team
+                  echo '${{ tojson(github.event.pull_request.requested_teams[*].slug) }}' | tee /tmp/team_reviewers.json
+                  jq --raw-output .[] < /tmp/team_reviewers.json | sort | tee /tmp/team_reviewers.txt
+                  echo '${{ env.TEAM }}' | tee /tmp/team.txt
+
+                  # If either a reviewer matches a team member, or a team matches our team, say "true"
+                  if [ $(join /tmp/team_members.txt /tmp/reviewers.txt | wc -l) != 0 ]; then
+                    echo "match=true" >> $GITHUB_OUTPUT
+                  elif [ $(join /tmp/team.txt /tmp/team_reviewers.txt | wc -l) != 0 ]; then
+                    echo "match=true" >> $GITHUB_OUTPUT
+                  else
+                    echo "match=false" >> $GITHUB_OUTPUT
+                  fi
+              env:
+                  TEAM: "product"
+            - uses: octokit/graphql-action@abaeca7ba4f0325d63b8de7ef943c2418d161b93 # v3.0.0
+              id: add_to_project
+              if: steps.any_matching_reviewers.outputs.match == 'true'
+              with:
+                  headers: '{"GraphQL-Features": "projects_next_graphql"}'
+                  query: |
+                      mutation add_to_project($projectid:ID!, $contentid:ID!) {
+                        addProjectV2ItemById(input: {projectId: $projectid contentId: $contentid}) {
+                          item {
+                            id
+                          }
+                        }
+                      }
+                  projectid: ${{ env.PROJECT_ID }}
+                  contentid: ${{ github.event.pull_request.node_id }}
+              env:
+                  PROJECT_ID: "PVT_kwDOAM0swc4AAg6N"
+                  TEAM: "product"
+                  GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-stale.yml

@@ -0,0 +1,29 @@
+name: Close stale issues & PRs
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "30 1 * * *"
+permissions: {}
+jobs:
+    close:
+        runs-on: ubuntu-24.04
+        permissions:
+            actions: write
+            issues: write
+            pull-requests: write
+        steps:
+            - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10
+              with:
+                  operations-per-run: 100
+
+                  # Flaky test issue closing
+                  any-of-issue-labels: "Z-Flaky-Test-Chrome,Z-Flaky-Test-Firefox,Z-Flaky-Test-Webkit"
+                  days-before-issue-stale: 14
+                  days-before-issue-close: 0
+                  close-issue-message: "This flaky test issue has not been updated in 14 days. It is being closed as presumed resolved."
+                  exempt-issue-labels: "Z-Flaky-Test-Disabled"
+
+                  # Stale PR closing
+                  days-before-pr-stale: 180
+                  days-before-pr-close: 0
+                  close-pr-message: "This PR has been automatically closed because it has been stale for 180 days. If you wish to continue working on this PR, please ping a maintainer to reopen it."

.github/workflows/triage-unlabelled.yml

@@ -0,0 +1,54 @@
+name: Move unlabelled from needs info columns to triaged
+
+on:
+    issues:
+        types: [unlabeled]
+permissions: {}
+jobs:
+    move_no_longer_needs_info_issues:
+        name: Move no longer X-Needs-Info issues to Triaged
+        runs-on: ubuntu-24.04
+        if: >
+            !contains(github.event.issue.labels.*.name, 'X-Needs-Info')
+        steps:
+            - id: set_fields
+              uses: nipe0324/update-project-v2-item-field@c4af58452d1c5a788c1ea4f20e073fa722ec4a6b #v2.0.2
+              with:
+                  project-url: ${{ env.PROJECT_URL }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  skip-update-script: |
+                      const isIssue = item.type === 'ISSUE'
+                      const status = item.fieldValues['Status']
+                      return !isIssue || status !== 'Needs info'
+                  field-name: Status
+                  field-value: "Triaged"
+        env:
+            PROJECT_URL: https://github.com/orgs/element-hq/projects/120
+
+    remove_Z-Labs_label:
+        name: Remove Z-Labs label when features behind labs flags are removed
+        runs-on: ubuntu-24.04
+        if: >
+            !(contains(github.event.issue.labels.*.name, 'A-Maths') ||
+            contains(github.event.issue.labels.*.name, 'A-Message-Pinning') ||
+            contains(github.event.issue.labels.*.name, 'A-Location-Sharing') ||
+            contains(github.event.issue.labels.*.name, 'Z-IA') ||
+            contains(github.event.issue.labels.*.name, 'A-Jump-To-Date') ||
+            contains(github.event.issue.labels.*.name, 'A-Themes-Custom') ||
+            contains(github.event.issue.labels.*.name, 'A-E2EE-Dehydration') ||
+            contains(github.event.issue.labels.*.name, 'A-Tags') ||
+            contains(github.event.issue.labels.*.name, 'A-Video-Rooms') ||
+            contains(github.event.issue.labels.*.name, 'A-Message-Starring') ||
+            contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor') ||
+            contains(github.event.issue.labels.*.name, 'A-Element-Call')) &&
+            contains(github.event.issue.labels.*.name, 'Z-Labs')
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              with:
+                  script: |
+                      github.rest.issues.removeLabel({
+                        issue_number: context.issue.number,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        name: ['Z-Labs']
+                      })

.github/workflows/update-jitsi.yml

@@ -0,0 +1,33 @@
+# Re-fetches the Jitsi SDK and opens a PR to update it if it's different from what's in the repository
+name: Update Jitsi
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 3 * * 0" # 3am every Sunday
+permissions: {} # We use ELEMENT_BOT_TOKEN instead
+jobs:
+    update:
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+              with:
+                  cache: "yarn"
+                  node-version: "lts/*"
+
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Fetch Jitsi
+              run: "yarn update:jitsi"
+
+            - name: Create Pull Request
+              uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7
+              with:
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  branch: actions/jitsi-update
+                  delete-branch: true
+                  title: Jitsi Update
+                  labels: |
+                      T-Task

.github/workflows/update-topics.yaml

@@ -0,0 +1,119 @@
+name: Update release topics
+on:
+    workflow_dispatch:
+        inputs:
+            expected_status:
+                description: What type of release is the next expected release
+                required: true
+                default: RC
+                type: choice
+                options:
+                    - RC
+                    - Release
+            expected_date:
+                description: Expected release date e.g. July 11th
+                required: true
+                type: string
+concurrency: ${{ github.workflow }}
+permissions: {} # No permissions required
+jobs:
+    bot:
+        name: Release topic update
+        runs-on: ubuntu-24.04
+        environment: Matrix
+        steps:
+            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              env:
+                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
+                  LOBBY_ROOM_ID: ${{ secrets.ROOM_ID }}
+                  PUBLIC_DISCUSSION_ROOM_ID: "!xUW4PpAe1CmThA3r2wI8IrgwwsK006-zqWdJCljpd10"
+                  ANNOUNCEMENT_ROOM_ID: "!ars5ndgI6IIYZXECiJ-u8YljHNzShJn3nHdB-3rYI2M"
+                  TOKEN: ${{ secrets.BETABOT_ACCESS_TOKEN }}
+                  RELEASE_STATUS: "Release status: ${{ inputs.expected_status }} expected ${{ inputs.expected_date }}"
+              with:
+                  script: |
+                      const { HS_URL, TOKEN, RELEASE_STATUS, LOBBY_ROOM_ID, PUBLIC_DISCUSSION_ROOM_ID, ANNOUNCEMENT_ROOM_ID } = process.env;
+
+                      const repo = context.repo;
+                      const { data } = await github.rest.repos.getLatestRelease({
+                          owner: repo.owner,
+                          repo: repo.repo,
+                      });
+                      console.log("Found latest version: " + data.tag_name);
+
+                      const releaseTopic = `Stable: ${data.tag_name} | ${RELEASE_STATUS}`;
+                      console.log("Release topic: " + releaseTopic);
+
+                      const regex = /Stable: v(.+) \| Release status: (\w+) expected (\w+ \d+\w\w)/gm;
+
+                      async function updateReleaseInTopic(roomId) {
+                          const apiUrl = `${HS_URL}/_matrix/client/v3/rooms/${roomId}/state/m.room.topic/`;
+                          const headers = {
+                              "Content-Type": "application/json",
+                              "Authorization": `Bearer ${TOKEN}`,
+                          };
+                          await fetch(`${HS_URL}/_matrix/client/v3/rooms/${roomId}/join`, {
+                              method: "POST",
+                              headers,
+                              body: "{}",
+                          });
+
+                          let res = await fetch(apiUrl, {
+                              method: "GET",
+                              headers,
+                          });
+
+                          if (!res.ok) {
+                              console.log(roomId, "failed to fetch", await res.text());
+                              return;
+                          }
+
+                          const data = await res.json();
+                          console.log(roomId, "got event", data);
+
+                          if (!regex.test(data.topic)) {
+                              core.setFailed("Topic format is incorrect for room " + roomId);
+                              return;
+                          }
+
+                          const topic = data.topic.replace(regex, releaseTopic);
+                          if (topic === data.topic) {
+                              console.log(roomId, "nothing to do");
+                              return;
+                          }
+                          if (data["org.matrix.msc3765.topic"]) {
+                              data["org.matrix.msc3765.topic"]?.["m.text"].forEach(d => {
+                                  d.body = d.body.replace(regex, releaseTopic);
+                              });
+                          }
+                          if (data["m.topic"]) {
+                              data["m.topic"]?.["m.text"].forEach(d => {
+                                  d.body = d.body.replace(regex, releaseTopic);
+                              });
+                          }
+
+                          res = await fetch(apiUrl, {
+                              method: "PUT",
+                              body: JSON.stringify({
+                                  ...data,
+                                  topic,
+                              }),
+                              headers,
+                          });
+
+                          if (res.ok) {
+                              const resJson = res.json();
+                              if (resJson.errcode) {
+                                  core.setFailed(`Error updating ${roomId}: ${resJson.error}`);
+                              } else {
+                                  console.log(roomId, "topic updated:", topic);
+                              }
+                          } else {
+                              const errText = await res.text();
+                              core.setFailed(`Error updating ${roomId}: ${errText}`);
+                          }
+                      }
+
+                      await updateReleaseInTopic(LOBBY_ROOM_ID);
+                      await updateReleaseInTopic(PUBLIC_DISCUSSION_ROOM_ID);
+                      await updateReleaseInTopic(ANNOUNCEMENT_ROOM_ID);