put back patch

This reverts commit 12427135f1.

.autofix.markdownlint-cli2.jsonc

@@ -0,0 +1,8 @@
+{
+  "config": {
+    "default": false,
+    "no-trailing-spaces": {
+      "br_spaces": 0
+    }
+  }
+}

.circleci/fix-known-hosts.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-
-mkdir -p ~/.ssh
-echo "|1|B3r+7aO0/x90IdefihIjxIoJrrk=|OJddGDfhbuLFc1bUyy84hhIw57M= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
-|1|rGlEvW55DtzNZp+pzw9gvyOyKi4=|LLWr+7qlkAlw3YGGVfLHHxB/kR0= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" >> ~/.ssh/known_hosts

.clang-tidy

@@ -0,0 +1,4 @@
+---
+Checks: '-modernize-use-nullptr'
+InheritParentConfig: true
+...

.claude/.gitignore

@@ -0,0 +1 @@
+settings.local.json

.claude/settings.json

@@ -0,0 +1,24 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(e sync)",
+      "Bash(e patches --list-targets:*)",
+      "Bash(git add:*)",
+      "Bash(git am:*)",
+      "Bash(git commit:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(e patches:*)",
+      "Bash(e sync:*)",
+      "Skill(electron-chromium-upgrade)",
+      "Read(*)",
+      "Bash(echo:*)",
+      "Bash(e build:*)",
+      "Bash(tee:*)",
+      "Bash(git diff:*)",
+      "Bash(git rev-parse:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}

.claude/skills/electron-chromium-upgrade/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: electron-chromium-upgrade
+description: Guide for performing Chromium version upgrades in the Electron project. Use when working on the roller/chromium/main branch to fix patch conflicts during `e sync --3`. Covers the patch application workflow, conflict resolution, analyzing upstream Chromium changes, and proper commit formatting for patch fixes.
+---
+
+# Electron Chromium Upgrade: Phase One
+
+## Summary
+
+Run `e sync --3` repeatedly, fixing patch conflicts as they arise, until it succeeds. Then run `e patches all` and commit changes atomically.
+
+## Success Criteria
+
+Phase One is complete when:
+- `e sync --3` exits with code 0 (no patch failures)
+- `e patches all` has been run to export all changes
+- All changes are committed per the commit guidelines below
+
+Do not stop until these criteria are met.
+
+**CRITICAL** Do not delete or skip patches unless 100% certain the patch is no longer needed. Complicated conflicts or hard to resolve issues should be presented to the user after you have exhausted all other options. Do not delete the patch just because you can't solve it.
+
+## Context
+
+The `roller/chromium/main` branch is created by automation to update Electron's Chromium dependency SHA. No work has been done to handle breaking changes between the old and new versions.
+
+**Key directories:**
+- Current directory: Electron repo (always run `e` commands here)
+- `..` (parent): Chromium repo (where most patches apply)
+- `patches/`: Patch files organized by target
+- `docs/development/patches.md`: Patch system documentation
+
+## Workflow
+
+1. Delete the `.git/rr-cache` in both the `electron` and `..` folder to ensure no accidental rerere replays occur from before this upgrade phase attempt started
+2. Run `e sync --3` (the `--3` flag enables 3-way merge, always required)
+3. If succeeds → skip to step 6
+4. If patch fails:
+   - Identify target repo and patch from error output
+   - Analyze failure (see references/patch-analysis.md)
+   - Fix conflict in target repo's working directory
+   - Run `git am --continue` in affected repo
+   - Repeat until all patches for that repo apply
+   - IMPORTANT: Once `git am --continue` succeeds you MUST run `e patches {target}` to export fixes
+   - Return to step 1
+5. When `e sync --3` succeeds, run `e patches all`
+6. **Read `references/phase-one-commit-guidelines.md` NOW**, then commit changes following those instructions exactly.
+
+Before committing any Phase One changes, you MUST read `references/phase-one-commit-guidelines.md` and follow its instructions exactly.
+
+## Commands Reference
+
+| Command | Purpose |
+|---------|---------|
+| `e sync --3` | Clone deps and apply patches with 3-way merge |
+| `git am --continue` | Continue after resolving conflict (run in target repo) |
+| `e patches {target}` | Export commits from target repo to patch files |
+| `e patches all` | Export all patches from all targets |
+| `e patches --list-targets` | List targets and config paths |
+
+## Patch System Mental Model
+
+```
+patches/{target}/*.patch  →  [e sync --3]  →  target repo commits
+                          ←  [e patches]   ←
+```
+
+## When to Edit Patches
+
+| Situation | Action |
+|-----------|--------|
+| During active `git am` conflict | Fix in target repo, then `git am --continue` |
+| Modifying patch outside conflict | Edit `.patch` file directly |
+| Creating new patch (rare, avoid) | Commit in target repo, then `e patches {target}` |
+
+Fix existing patches 99% of the time rather than creating new ones.
+
+## Patch Fixing Rules
+
+1. **Preserve authorship**: Keep original author in TODO comments (from patch `From:` field)
+2. **Never change TODO assignees**: `TODO(name)` must retain original name
+3. **Update descriptions**: If upstream changed (e.g., `DCHECK` → `CHECK_IS_TEST`), update patch commit message to reflect current state
+
+## Final Deliverable
+
+After Phase One, write a summary of every change: what was fixed, why, reasoning, and Chromium CL links.
+
+# Electron Chromium Upgrade: Phase Two
+
+## Summary
+
+Run `e build -k 999` repeatedly, fixing build issues as they arise, until it succeeds. Then run `e start --version` to validate Electron launches and commit changes atomically.
+
+Run Phase Two immediately after Phase One is complete.
+
+## Success Criteria
+
+Phase Two is complete when:
+- `e build -k 999` exits with code 0 (no build failures)
+- `e start --version` has been run to check Electron launches
+- All changes are committed per the commit guidelines below
+
+Do not stop until these criteria are met. Do not delete code or features, never comment out code in order to take short cut. Make all existing code, logic and intention work.
+
+## Context
+
+The `roller/chromium/main` branch is created by automation to update Electron's Chromium dependency SHA. No work has been done to handle breaking changes between the old and new versions. Chromium APIs frequently are renamed or refactored. In every case the code in Electron must be updated to account for the change in Chromium, strongly avoid making changes to the code in chromium to fix Electrons build.
+
+**Key directories:**
+- Current directory: Electron repo (always run `e` commands here)
+- `..` (parent): Chromium repo (do not touch this code to fix build issues, just read it to obtain context)
+
+## Workflow
+
+1. Run `e build -k 999` (the `-k 999` flag is a flag to ninja to say "do not stop until you find that many errors" it is an attempt to get as much error
+  context as possible for each time we run build)
+2. If succeeds → skip to step 6
+3. If build fails:
+    - Identify underlying file in "electron" from the compilation error message
+    - Analyze failure
+    - Fix build issue by adapting Electron's code for the change in Chromium
+    - Run `e build -t {target_that_failed}.o` to build just the failed target we were specifically fixing
+        - You can identify the target_that_failed from the failure line in the build log. E.g. `FAILED: 2e506007-8d5d-4f38-bdd1-b5cd77999a77 "./obj/electron/chromium_src/chrome/process_singleton_posix.o" CXX obj/electron/chromium_src/chrome/process_singleton_posix.o` the target name is `obj/electron/chromium_src/chrome/process_singleton_posix.o`
+    - **Read `references/phase-two-commit-guidelines.md` NOW**, then commit changes following those instructions exactly.
+    - Return to step 1
+4. **CRITICAL**: After ANY commit (especially patch commits), immediately run `git status` in the electron repo
+    - Look for other modified `.patch` files that only have index/hunk header changes
+    - These are dependent patches affected by your fix
+    - Commit them immediately with: `git commit -am "chore: update patch hunk headers"`
+    - This prevents losing track of necessary updates
+5. Return to step 1
+6. When `e build` succeeds, run `e start --version`
+7. Check if you have any pending changes in the Chromium repo by running `git status`
+    - If you have changes follow the instructions below in "A. Patch Fixes" to correctly commit those modifications into the appropriate patch file
+
+Before committing any Phase Two changes, you MUST read `references/phase-two-commit-guidelines.md` and follow its instructions exactly.
+
+## Build Error Detection
+
+When monitoring `e build -k 999` output, filter for errors using this regex pattern:
+error:|FAILED:|fatal:|subcommand failed|build finished
+
+The build output is extremely verbose. Filtering is essential to catch errors quickly.
+
+## Commands Reference
+
+| Command | Purpose |
+|---------|---------|
+| `e build -k 999` | Builds Electron and won't stop until either all targets attempted or 999 errors found |
+| `e build -t {target}.o` | Build just one specific target to verify a fix |
+| `e start --version` | Validate Electron launches after successful build |
+
+## Two Types of Build Fixes
+
+### A. Patch Fixes (for files in chromium_src or patched Chromium files)
+
+When the error is in a file that Electron patches (check with `grep -l "filename" patches/chromium/*.patch`):
+
+1. Edit the file in the Chromium source tree (e.g., `/src/chrome/browser/...`)
+2. Create a fixup commit targeting the original patch commit:
+    ```bash
+    cd ..  # to chromium repo
+    git add <modified-file>
+    git commit --fixup=<original-patch-commit-hash>
+    GIT_SEQUENCE_EDITOR=: git rebase --autosquash --autostash -i <commit>^
+3. Export the updated patch: e patches chromium
+4. Commit the updated patch file in the electron repo following the `references/phase-one-commit-guidelines.md`, then commit changes following those instructions exactly. **READ THESE GUIDELINES BEFORE COMMITTING THESE CHANGES**
+
+To find the original patch commit to fixup: `git log --oneline | grep -i "keyword from patch name"`
+
+The base commit for rebase is the Chromium commit before patches were applied. Find it by checking the `refs/patches/upstream-head` ref.
+
+B. Electron Code Fixes (for files in shell/, electron/, etc.)
+
+When the error is in Electron's own source code:
+
+1. Edit files directly in the electron repo
+2. Commit directly (no patch export needed)
+
+Dependent Patch Updates
+
+IMPORTANT: When you modify a patch, other patches that apply to the same file may have their hunk headers invalidated. After committing a patch fix:
+
+1. Run git status in the electron repo
+2. Look for other modified .patch files with just index/hunk header changes
+3. Commit these with: git commit -m "chore: update patch hunk headers"
+
+# Critical: Read Before Committing
+
+- Before ANY Phase One commits: Read `references/phase-one-commit-guidelines.md`
+- Before ANY Phase Two commits: Read `references/phase-two-commit-guidelines.md`
+
+# Skill Directory Structure
+This skill has additional reference files in `references/`:
+- patch-analysis.md - How to analyze patch failures
+- phase-one-commit-guidelines.md - Commit format for Phase One
+- phase-two-commit-guidelines.md - Commit format for Phase Two
+
+Read these when referenced in the workflow steps.

.claude/skills/electron-chromium-upgrade/references/patch-analysis.md

@@ -0,0 +1,69 @@
+# Analyzing Patch Failures
+
+## Investigation Steps
+
+1. **Read the patch file** at `patches/{target}/{patch_name}.patch`
+
+2. **Examine current state** of the file in Chromium at mentioned line numbers
+
+3. **Check recent upstream changes:**
+   ```bash
+   cd ..  # or relevant target repo
+   git log --oneline -10 -- {file}
+   ```
+
+4. **Find Chromium CL** in commit messages:
+   ```
+   Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/{CL_NUMBER}
+   ```
+
+## Common Failure Patterns
+
+| Pattern | Cause | Solution |
+|---------|-------|----------|
+| Context lines don't match | Surrounding code changed | Update context in patch |
+| File not found | File renamed/moved | Update patch target path |
+| Function not found | Refactored upstream | Find new function name |
+| `DCHECK` → `CHECK_IS_TEST` | Macro change | Update to new macro |
+| Deleted code | Feature removed | Verify patch still needed |
+
+## Using Git Blame
+
+To find the CL that changed specific lines:
+
+```bash
+cd ..
+git blame -L {start},{end} -- {file}
+git log -1 {commit_sha}  # Look for Reviewed-on: line
+```
+
+## Verifying Patch Necessity
+
+Before deleting a patch, verify:
+1. The patched functionality was intentionally removed upstream
+2. Electron doesn't need the patch for other reasons
+3. No other code depends on the patched behavior
+
+When in doubt, keep the patch and adapt it.
+
+## Phase Two: Build-Time Patch Issues
+
+Sometimes patches that applied successfully in Phase One cause build errors in Phase Two. This can happen when:
+
+1. **Incomplete types**: A patch disables a header include, but new upstream code uses the type
+2. **Missing members**: A patch modifies a class, but upstream added new code referencing the original
+
+### Finding Which Patch Affects a File
+
+```bash
+grep -l "filename.cc" patches/chromium/*.patch
+```
+
+Matching Existing Patch Patterns
+
+When fixing build errors in patched files, examine the existing patch to understand its style:
+- Does it use #if 0 / #endif guards?
+- Does it use #if BUILDFLAG(...) conditionals?
+- What's the pattern for disabled functionality?
+
+Apply fixes consistent with the existing patch style.

.claude/skills/electron-chromium-upgrade/references/phase-one-commit-guidelines.md

@@ -0,0 +1,52 @@
+# Phase One Commit Guidelines
+
+Only follow these instructions if there are uncommitted changes to `patches/` after Phase One succeeds.
+
+Ignore other instructions about making commit messages, our guidelines are CRITICALLY IMPORTANT and must be followed.
+
+## Atomic Commits
+
+For each fix made to a patch, create a separate commit:
+
+```
+fix(patch-conflict): {concise title}
+
+{Brief explanation, 1-2 paragraphs max}
+
+Ref: {Chromium CL link}
+```
+
+IMPORTANT: Ensure that any changes made to patch content as a result of a change in Chromium is committed individually. Each change should have it's own commit message and it's own REF.
+
+IMPORTANT: Try really hard to find the CL reference per the instructions below. Each change you made should in theory have been in response to a change made in Chromium that you identified or can identify. Try for a while to identify and include the ref in the commit message. Do not give up easily.
+
+## Finding CL References
+
+Use `git log` or `git blame` on Chromium source files. Look for:
+
+```
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/XXXXXXX
+```
+
+If no CL found after searching: `Ref: Unable to locate CL`
+
+## Final Cleanup
+
+After all fix commits, stage remaining changes:
+
+```bash
+git add patches
+git commit -m "chore: update patch hunk headers"
+```
+
+## Example Commit
+
+```
+fix(patch-conflict): update web_contents_impl.cc context for navigation refactor
+
+The upstream navigation code was refactored to use NavigationRequest directly
+instead of going through NavigationController. Updated surrounding context
+to match new code structure.
+
+Ref: https://chromium-review.googlesource.com/c/chromium/src/+/1234567
+```

.claude/skills/electron-chromium-upgrade/references/phase-two-commit-guidelines.md

@@ -0,0 +1,82 @@
+# Phase Two Commit Guidelines
+
+Only follow these instructions if there are uncommitted changes in the Electron repo after any fixes are made during Phase Two that result a target that was failing, successfully building.
+
+Ignore other instructions about making commit messages, our guidelines are CRITICALLY IMPORTANT and must be followed.
+
+## Two Commit Types
+
+### For Electron Source Changes (shell/, electron/, etc.)
+
+```
+{CL-Number}: {concise description of API change}
+
+{Brief explanation of what upstream changed and how Electron was adapted}
+
+Ref: {Chromium CL link}
+```
+
+IMPORTANT: Ensure that any change made to electron as a result of a change in Chromium is committed individually. Each change should have it's own commit message and it's own REF. Logically grouped into commits that make sense rather than one giant commit.
+
+IMPORTANT: Try really hard to find the CL reference per the instructions below. Each change you made should in theory have been in response to a change made in Chromium that you identified or can identify. Try for a while to identify and include the ref in the commit message. Do not give up easily.
+
+You may include multiple "Ref" links if required.
+
+For a CL link in the format `https://chromium-review.googlesource.com/c/chromium/src/+/2958369` the "CL-Number" is `2958369`
+
+### For Patch Updates (patches/chromium/*.patch)
+
+Use the same fixup workflow as Phase One:
+1. Fix in Chromium source tree
+2. Fixup commit + rebase
+3. Export with `e patches chromium`
+4. Commit the patch file:
+
+```
+fix(patch-update): {concise description}
+
+{Brief explanation}
+
+Ref: {Chromium CL link}
+```
+
+## Dependent Patch Header Updates
+
+After any patch modification, check for other affected patches:
+
+```bash
+git status
+# If other .patch files show as modified with only hunk header changes:
+git add patches/
+git commit -m "chore: update patch hunk headers"
+```
+
+## Finding CL References
+
+Use git log or git blame on Chromium source files. Look for:
+
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/XXXXXXX
+
+If no CL found after searching: Ref: Unable to locate CL
+
+## Example Commits
+
+### Electron Source Fix
+
+fix: update GetPlugins to GetPluginsAsync for API change
+
+The upstream Chromium API changed:
+- Old: GetPlugins(callback) - took a callback
+- New: GetPluginsAsync(callback) - async version takes a callback
+
+Ref: https://chromium-review.googlesource.com/c/chromium/src/+/1234567
+
+### Patch Fix
+
+fix(patch-conflict): update picture-in-picture for gesture handling refactor
+
+Upstream added new gesture handling code that accesses live caption dialog.
+The live caption functionality is disabled in Electron's patch, so wrapped
+the new code in #if 0 guards to match existing pattern.
+
+Ref: https://chromium-review.googlesource.com/c/chromium/src/+/7654321

.devcontainer/README.md

@@ -0,0 +1,68 @@
+# Electron Dev on Codespaces
+
+Welcome to the Codespaces Electron Developer Environment.
+
+## Quick Start
+
+Upon creation of your codespace you should have [build tools](https://github.com/electron/build-tools) installed and an initialized gclient checkout of Electron.  In order to build electron you'll need to run the following command.
+
+```bash
+e build
+```
+
+The initial build will take ~8 minutes.  Incremental builds are substantially quicker.  If you pull changes from upstream that touch either the `patches` folder or the `DEPS` folder you will have to run `e sync` in order to keep your checkout up to date.
+
+## Directory Structure
+
+Codespaces doesn't lean very well into gclient based checkouts, the directory structure is slightly strange.  There are two locations for the `electron` checkout that both map to the same files under the hood.
+
+```graphql
+# Primary gclient checkout container
+/workspaces/gclient/*
+  └─ src/* - # Chromium checkout
+     └─ electron - # Electron checkout
+# Symlinked Electron checkout (identical to the above)
+/workspaces/electron
+```
+
+## Reclient
+
+If you are a maintainer [with Reclient access](../docs/development/reclient.md) you'll need to ensure you're authenticated when you spin up a new codespaces instance.  You can validate this by checking `e d rbe info` - your build-tools configuration should have `Access` type `Cache & Execute`:
+
+```console
+Authentication Status: Authenticated
+Since:     2024-05-28 10:29:33 +0200 CEST
+Expires:   2024-08-26 10:29:33 +0200 CEST
+...
+Access:    Cache & Execute
+```
+
+To authenticate if you're not logged in, run `e d rbe login` and follow the link to authenticate.
+
+## Running Electron
+
+You can run Electron in a few ways.  If you just want to see if it launches:
+
+```bash
+# Enter an interactive JS prompt headlessly
+xvfb-run e start -i
+```
+
+But if you want to actually see Electron you will need to use the built-in VNC capability.  If you click "Ports" in codespaces and then open the `VNC web client` forwarded port you should see a web based VNC portal in your browser.  When you are asked for a password use `builduser`.
+
+Once in the VNC UI you can open `Applications -> System -> XTerm` which will open a VNC based terminal app and then you can run `e start` like normal and Electron will open in your VNC session.
+
+## Running Tests
+
+You run tests via build-tools and `xvfb`.
+
+```bash
+# Run all tests
+xvfb-run e test
+
+# Run the main process tests
+xvfb-run e test --runners=main
+
+# Run the old remote tests
+xvfb-run e test --runners=remote
+```

.devcontainer/devcontainer.json

@@ -0,0 +1,51 @@
+{
+	"name": "Electron Core Development Environment",
+	"dockerComposeFile": "docker-compose.yml",
+	"service": "buildtools",
+	"onCreateCommand": ".devcontainer/on-create-command.sh",
+	"updateContentCommand": ".devcontainer/update-content-command.sh",
+	"workspaceFolder": "/workspaces/gclient/src/electron",
+	"forwardPorts": [6080, 5901],
+	"portsAttributes": {
+		"6080": {
+			"label": "VNC web client (noVNC)",
+			"onAutoForward": "silent"
+		},
+		"5901": {
+			"label": "VNC TCP port",
+			"onAutoForward": "silent"
+		}
+	},
+	"hostRequirements": {
+		"storage": "128gb",
+		"cpus": 16
+	},
+	"remoteUser": "builduser",
+	"customizations": {
+		"codespaces": {
+			"openFiles": [
+				".devcontainer/README.md"
+			]
+		},
+		"vscode": {
+			"extensions": [
+				"joeleinbinder.mojom-language",
+				"rafaelmaiolla.diff",
+				"surajbarkale.ninja",
+				"ms-vscode.cpptools",
+				"mutantdino.resourcemonitor",
+				"dsanders11.vscode-electron-build-tools",
+				"dbaeumer.vscode-eslint",
+				"shakram02.bash-beautify",
+				"marshallofsound.gnls-electron"
+			],
+			"settings": {
+				"editor.tabSize": 2,
+				"bashBeautify.tabSize": 2,
+				"typescript.tsdk": "node_modules/typescript/lib",
+				"javascript.preferences.quoteStyle": "single",
+				"typescript.preferences.quoteStyle": "single"
+			}
+		}
+	}
+}

.devcontainer/docker-compose.yml

@@ -0,0 +1,19 @@
+version: '3'
+
+services:
+  buildtools:
+    image: ghcr.io/electron/devcontainer:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
+
+    volumes:
+      - ..:/workspaces/gclient/src/electron:cached
+
+      - /var/run/docker.sock:/var/run/docker.sock
+
+    command: /bin/sh -c "while sleep 1000; do :; done"
+
+    user: builduser
+
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - seccomp:unconfined

.devcontainer/on-create-command.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+
+set -eo pipefail
+
+buildtools=$HOME/.electron_build_tools
+gclient_root=/workspaces/gclient
+buildtools_configs=/workspaces/buildtools-configs
+
+export PATH="$PATH:$buildtools/src"
+
+# Create the persisted buildtools config folder
+mkdir -p $buildtools_configs
+mkdir -p $gclient_root/.git-cache
+rm -f $buildtools/configs
+ln -s $buildtools_configs $buildtools/configs
+
+# Write the gclient config if it does not already exist
+if [ ! -f $gclient_root/.gclient ]; then
+  echo "Creating gclient config"
+
+  echo "solutions = [
+      { \"name\"        : \"src/electron\",
+          \"url\"         : \"https://github.com/electron/electron\",
+          \"deps_file\"   : \"DEPS\",
+          \"managed\"     : False,
+          \"custom_deps\" : {
+          },
+          \"custom_vars\": {},
+      },
+    ]
+  " >$gclient_root/.gclient
+fi
+
+# Write the default buildtools config file if it does
+# not already exist
+if [ ! -f $buildtools/configs/evm.testing.json ]; then
+  echo "Creating build-tools testing config"
+
+  write_config() {
+    echo "
+        {
+            \"root\": \"/workspaces/gclient\",
+            \"remotes\": {
+                \"electron\": {
+                    \"origin\": \"https://github.com/electron/electron.git\"
+                }
+            },
+            \"gen\": {
+                \"args\": [
+                    \"import(\\\"//electron/build/args/testing.gn\\\")\",
+                    \"use_remoteexec = true\",
+                    \"use_siso=true\"
+                ],
+                \"out\": \"Testing\"
+            },
+            \"env\": {
+                \"CHROMIUM_BUILDTOOLS_PATH\": \"/workspaces/gclient/src/buildtools\",
+                \"GIT_CACHE_PATH\": \"/workspaces/gclient/.git-cache\"
+            },
+            \"\$schema\": \"file:///home/builduser/.electron_build_tools/evm-config.schema.json\",
+            \"configValidationLevel\": \"strict\",
+            \"remoteBuild\": \"siso\",
+            \"preserveSDK\": 5
+        }
+    " >$buildtools/configs/evm.testing.json
+  }
+
+  write_config
+
+  e use testing 
+else
+  echo "build-tools testing config already exists"
+fi

.devcontainer/update-content-command.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -eo pipefail
+
+buildtools=$HOME/.electron_build_tools
+
+export PATH="$PATH:$buildtools/src"
+
+# Sync latest
+e d gclient sync --with_branch_heads --with_tags

.dockerignore

@@ -1,4 +1,2 @@
 *
 !tools/xvfb-init.sh
-!tools/run-electron.sh
-!build/install-build-deps.sh

.env.example

@@ -1,7 +1,4 @@
 # These env vars are only necessary for creating Electron releases.
 # See docs/development/releasing.md
 
-APPVEYOR_CLOUD_TOKEN=
-CIRCLE_TOKEN=
 ELECTRON_GITHUB_TOKEN=
-VSTS_TOKEN=

.eslintrc.json

@@ -1,4 +1,5 @@
 {
+  "root": true,
   "extends": "standard",
   "parser": "@typescript-eslint/parser",
   "plugins": ["@typescript-eslint"],
@@ -6,18 +7,52 @@
     "browser": true
   },
   "rules": {
+    "semi": ["error", "always"],
     "no-var": "error",
-    "no-unused-vars": 0,
-    "no-global-assign": 0,
+    "no-unused-vars": "off",
+    "guard-for-in": "error",
     "@typescript-eslint/no-unused-vars": ["error", {
       "vars": "all",
       "args": "after-used",
-      "ignoreRestSiblings": false
+      "ignoreRestSiblings": true
     }],
     "prefer-const": ["error", {
       "destructuring": "all"
     }],
-    "node/no-deprecated-api": 0
+    "n/no-callback-literal": "off",
+    "import/newline-after-import": "error",
+    "import/order": ["error", {
+      "alphabetize": {
+        "order": "asc"
+      },
+      "newlines-between": "always",
+      "pathGroups": [
+        {
+          "pattern": "@electron/internal/**",
+          "group": "external",
+          "position": "before"
+        },
+        {
+          "pattern": "@electron/**",
+          "group": "external",
+          "position": "before"
+        },
+        {
+          "pattern": "{electron,electron/**}",
+          "group": "external",
+          "position": "before"
+        }
+      ],
+      "pathGroupsExcludedImportTypes": [],
+      "distinctGroup": true,
+      "groups": [
+        "external",
+        "builtin",
+        ["sibling", "parent"],
+        "index",
+        "type"
+      ]
+    }]
   },
   "parserOptions": {
     "ecmaVersion": 6,
@@ -25,9 +60,19 @@
   },
   "overrides": [
     {
-      "files": "*.js",
+      "files": "*.ts",
       "rules": {
-          "@typescript-eslint/no-unused-vars": "off"
+        "no-undef": "off",
+        "no-redeclare": "off",
+        "@typescript-eslint/no-redeclare": ["error"],
+        "no-use-before-define": "off"
+      }
+    },
+    {
+      "files": "*.d.ts",
+      "rules": {
+        "no-useless-constructor": "off",
+        "@typescript-eslint/no-unused-vars": "off"
       }
     }
   ]

.git-blame-ignore-revs

@@ -0,0 +1,5 @@
+# Atom --> Electron rename
+d9321f4df751fa32813fab1b6387bbd61bd681d0
+34c4c8d5088fa183f56baea28809de6f2a427e02
+# Enable JS Semicolons
+5d657dece4102e5e5304d42e8004b6ad64c0fcda

.gitattributes

@@ -1,3 +1,34 @@
 # `git apply` and friends don't understand CRLF, even on windows. Force those
 # files to be checked out with LF endings even if core.autocrlf is true.
 *.patch text eol=lf
+DEPS text eol=lf
+yarn.lock text eol=lf
+script/zip_manifests/*.manifest text eol=lf
+patches/**/.patches merge=union
+
+# Source code and markdown files should always use LF as line ending.
+*.c text eol=lf
+*.cc text eol=lf
+*.cpp text eol=lf
+*.csv text eol=lf
+*.grd   text eol=lf
+*.grdp   text eol=lf
+*.gn text eol=lf
+*.gni text eol=lf
+*.h text eol=lf
+*.html   text eol=lf
+*.idl text eol=lf
+*.in   text eol=lf
+*.js   text eol=lf
+*.json   text eol=lf
+*.json5 text eol=lf
+*.md text eol=lf
+*.mm text eol=lf
+*.mojom text eol=lf
+*.patches text eol=lf
+*.proto text eol=lf
+*.py text eol=lf
+*.ps1 text eol=lf
+*.sh text eol=lf
+*.ts text eol=lf
+*.txt   text eol=lf

.github/CODEOWNERS

@@ -3,20 +3,23 @@
 # https://help.github.com/articles/about-codeowners
 # https://git-scm.com/docs/gitignore
 
-# Most stuff in here is owned by the Community & Safety WG...
-/.github/*                              @electron/wg-community
-
-# ...except the Admin WG maintains this file.
-/.github/CODEOWNERS                     @electron/wg-admin
-
 # Upgrades WG
-/patches/                               @electron/wg-upgrades
+/patches/                               @electron/patch-owners
 DEPS                                    @electron/wg-upgrades
 
-
-# Docs & Tooling WG
-/default_app/                           @electron/wg-docs-tools
-/docs/                                  @electron/wg-docs-tools
-
 # Releases WG
+/docs/breaking-changes.md               @electron/wg-releases
 /npm/                                   @electron/wg-releases
+/script/release                         @electron/wg-releases
+
+# Security WG
+/lib/browser/devtools.ts                @electron/wg-security
+/lib/browser/guest-view-manager.ts      @electron/wg-security
+/lib/browser/rpc-server.ts              @electron/wg-security
+/lib/renderer/security-warnings.ts      @electron/wg-security
+
+# Infra WG
+/.github/actions/                       @electron/wg-infra
+/.github/workflows/*-publish.yml        @electron/wg-infra
+/.github/workflows/build.yml            @electron/wg-infra
+/.github/workflows/pipeline-*.yml       @electron/wg-infra

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -1,54 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve Electron
-
----
-
-<!--  As an open source project with a dedicated but small maintainer team, it can sometimes take a long time for issues to be addressed so please be patient and we will get back to you as soon as we can.
--->
-
-### Preflight Checklist
-<!-- Please ensure you've completed the following steps by replacing [ ] with [x]-->
-
-* [ ] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/master/CONTRIBUTING.md) for this project.
-* [ ] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md) that this project adheres to.
-* [ ] I have searched the issue tracker for an issue that matches the one I want to file, without success.
-
-### Issue Details
-
-* **Electron Version:**
-  * <!-- (output of `node_modules/.bin/electron --version`) e.g. 4.0.3 -->
-* **Operating System:**
-  * <!-- (Platform and Version) e.g. macOS 10.13.6 / Windows 10 (1803) / Ubuntu 18.04 x64 -->
-* **Last Known Working Electron version:**:
-  * <!-- (if applicable) e.g. 3.1.0 -->
-
-### Expected Behavior
-<!-- A clear and concise description of what you expected to happen. -->
-
-### Actual Behavior
-<!-- A clear and concise description of what actually happened. -->
-
-### To Reproduce
-<!--
-Your best chance of getting this bug looked at quickly is to provide a REPOSITORY that can be cloned and run.
--->
-
-<!--
-You can fork electron-quick-start (https://github.com/electron/electron-quick-start) and include a link to the branch with your changes.
--->
-
-<!--
-If you provide a URL, please list the commands required to clone/setup/run your repo e.g.
-```sh
-$ git clone $YOUR_URL -b $BRANCH
-$ npm install
-$ npm start || electron .
-```
--->
-
-### Screenshots
-<!-- If applicable, add screenshots to help explain your problem. -->
-
-### Additional Information
-<!-- Add any other context about the problem here. -->

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -1,27 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for Electron
-
----
-
-<!--  As an open source project with a dedicated but small maintainer team, it can sometimes take a long time for issues to be addressed so please be patient and we will get back to you as soon as we can.
--->
-
-### Preflight Checklist
-<!-- Please ensure you've completed the following steps by replacing [ ] with [x]-->
-
-* [ ] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/master/CONTRIBUTING.md) for this project.
-* [ ] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md) that this project adheres to.
-* [ ] I have searched the issue tracker for a feature request that matches the one I want to file, without success.
-
-### Problem Description
-<!-- Is your feature request related to a problem? Please add a clear and concise description of what the problem is. -->
-
-### Proposed Solution
-<!-- Describe the solution you'd like in a clear and concise manner -->
-
-### Alternatives Considered
-<!-- A clear and concise description of any alternative solutions or features you've considered. -->
-
-### Additional Information
-<!-- Add any other context about the problem here. -->

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,91 @@
+name: Bug Report
+description: Report a bug in Electron
+type: 'bug'
+labels: "bug :beetle:"
+body:
+- type: checkboxes
+  attributes:
+    label: Preflight Checklist
+    description: Please ensure you've completed all of the following.
+    options:
+      - label: I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/main/CONTRIBUTING.md) for this project.
+        required: true
+      - label: I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project adheres to.
+        required: true
+      - label: I have searched the [issue tracker](https://www.github.com/electron/electron/issues) for a bug report that matches the one I want to file, without success.
+        required: true
+- type: input
+  attributes:
+    label: Electron Version
+    description: |
+      What version of Electron are you using?
+
+      Note: Please only report issues for [currently supported versions of Electron](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline).
+    placeholder: 32.0.0
+  validations:
+    required: true
+- type: dropdown
+  attributes:
+    label: What operating system(s) are you using?
+    multiple: true
+    options:
+      - Windows
+      - macOS
+      - Ubuntu
+      - Other Linux
+      - Other (specify below)
+  validations:
+    required: true
+- type: input
+  attributes:
+    label: Operating System Version
+    description: What operating system version are you using? On Windows, click Start button > Settings > System > About. On macOS, click the Apple Menu > About This Mac. On Linux, use lsb_release or uname -a.
+    placeholder: "e.g. Windows 10 version 1909, macOS Catalina 10.15.7, or Ubuntu 20.04"
+  validations:
+    required: true
+- type: dropdown
+  attributes:
+    label: What arch are you using?
+    options:
+      - x64
+      - ia32
+      - arm64 (including Apple Silicon)
+      - Other (specify below)
+  validations:
+    required: true
+- type: input
+  attributes:
+    label: Last Known Working Electron version
+    description: What is the last version of Electron this worked in, if applicable?
+    placeholder: 16.0.0
+- type: dropdown
+  attributes:
+    label: Does the issue also appear in Chromium / Google Chrome?
+    description: If it does, please report the issue in the [Chromium issue tracker](https://issues.chromium.org/issues), not against Electron. Electron will inherit the fix once Chromium resolves the issue.
+    options:
+      - I don't know how to test
+      - "Yes"
+      - "No"
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Expected Behavior
+    description: A clear and concise description of what you expected to happen.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Actual Behavior
+    description: A clear description of what actually happens.
+  validations:
+    required: true
+- type: input
+  attributes:
+    label: Testcase Gist URL
+    description: Electron maintainers need a standalone test case to reproduce and fix your issue. Please use [Electron Fiddle](https://github.com/electron/fiddle) to create one and to publish it as a [GitHub gist](https://gist.github.com). Then put the gist URL here. Issues without testcase gists receive less attention and might be closed without a maintainer taking a closer look. To maximize how much attention your issue receives, please include a testcase gist right from the start.
+    placeholder: https://gist.github.com/...
+- type: textarea
+  attributes:
+    label: Additional Information
+    description: If your problem needs further explanation, or if the issue you're seeing cannot be reproduced in a gist, please add more information here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord Chat
+    url: https://discord.gg/APGC3k5yaH
+    about: Have questions? Try asking on our Discord - this issue tracker is for reporting bugs or feature requests only
+  - name: Open Collective
+    url: https://opencollective.com/electron
+    about: Help support Electron by contributing to our Open Collective

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,40 @@
+name: Feature Request
+description: Suggest an idea for Electron
+type: 'enhancement'
+labels: "enhancement :sparkles:"
+body:
+- type: checkboxes
+  attributes:
+    label: Preflight Checklist
+    description: Please ensure you've completed all of the following.
+    options:
+      - label: I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/main/CONTRIBUTING.md) for this project.
+        required: true
+      - label: I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project adheres to.
+        required: true
+      - label: I have searched the [issue tracker](https://www.github.com/electron/electron/issues) for a feature request that matches the one I want to file, without success.
+        required: true
+- type: textarea
+  attributes:
+    label: Problem Description
+    description: Please add a clear and concise description of the problem you are seeking to solve with this feature request.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Proposed Solution
+    description: Describe the solution you'd like in a clear and concise manner.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Alternatives Considered
+    description: A clear and concise description of any alternative solutions or features you've considered.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Additional Information
+    description: Add any other context about the problem here.
+  validations:
+    required: false

.github/ISSUE_TEMPLATE/mac_app_store_private_api_rejection.md

@@ -1,25 +0,0 @@
----
-name: Mac App Store Private API Rejection
-about: Your app was rejected from the Mac App Store for using private API's
-
----
-
-<!--  As an open source project with a dedicated but small maintainer team, it can sometimes take a long time for issues to be addressed so please be patient and we will get back to you as soon as we can.
--->
-
-### Preflight Checklist
-<!-- Please ensure you've completed the following steps by replacing [ ] with [x]-->
-
-* [ ] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/master/CONTRIBUTING.md) for this project.
-* [ ] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md) that this project adheres to.
-
-### Issue Details
-
-* **Electron Version:** 
-  * <!-- (output of `node_modules/.bin/electron --version`) e.g. 4.0.3 -->
-
-### Rejection Email
-<!-- Paste the contents of your rejection email here, censoring any private information such as app names.-->
-
-### Additional Information
-<!-- Add any other context about the problem here. -->

.github/ISSUE_TEMPLATE/mac_app_store_private_api_rejection.yml

@@ -0,0 +1,30 @@
+name: Report Mac App Store Private API Rejection
+description: Your app was rejected from the Mac App Store for using private API's
+title: "[MAS Rejection]: "
+body:
+- type: checkboxes
+  attributes:
+    label: Preflight Checklist
+    description: Please ensure you've completed all of the following.
+    options:
+      - label: I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/main/CONTRIBUTING.md) for this project.
+        required: true
+      - label: I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project adheres to.
+        required: true
+- type: input
+  attributes:
+    label: Electron Version
+    description: What version of Electron are you using?
+    placeholder: 12.0.0
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Rejection Email
+    description: Paste the contents of your rejection email here, censoring any private information such as app names.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Additional Information
+    description: Add any other context about the problem here.

.github/ISSUE_TEMPLATE/maintainer_issue.yml

@@ -0,0 +1,14 @@
+name: Maintainer Issue (not for public use)
+description: Only to be created by Electron maintainers
+body:
+- type: checkboxes
+  attributes:
+    label: Confirmation
+    options:
+      - label: I am a [maintainer](https://github.com/orgs/electron/people) of the Electron project. (If not, please create a [different issue type](https://github.com/electron/electron/issues/new/).)
+        required: true
+- type: textarea
+  attributes:
+    label: Description
+  validations:
+    required: true

.github/ISSUE_TEMPLATE/security_report.md

@@ -1,10 +0,0 @@
----
-name: Security report
-about: Do not create an issue for security reports, send an email to security@electronjs.org
-
----
-
-### Notice 
-
-**DO NOT** create an issue for security reports.
-Send an email to: **security@electronjs.org**.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,21 +1,21 @@
 #### Description of Change
+
 <!--
 Thank you for your Pull Request. Please provide a description above and review
 the requirements below.
 
-Contributors guide: https://github.com/electron/electron/blob/master/CONTRIBUTING.md
+Contributors guide: https://github.com/electron/electron/blob/main/CONTRIBUTING.md
 -->
 
 #### Checklist
 <!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->
 
-- [ ] PR description included and stakeholders cc'd
+- [ ] PR description included
 - [ ] `npm test` passes
-- [ ] tests are [changed or added](https://github.com/electron/electron/blob/master/docs/development/testing.md)
-- [ ] relevant documentation is changed or added
-- [ ] PR title follows semantic [commit guidelines](https://github.com/electron/electron/blob/master/docs/development/pull-requests.md#commit-message-guidelines)
-- [ ] [PR release notes](https://github.com/electron/clerk/blob/master/README.md) describe the change in a way relevant to app developers, and are [capitalized, punctuated, and past tense](https://github.com/electron/clerk/blob/master/README.md#examples).
+- [ ] tests are [changed or added](https://github.com/electron/electron/blob/main/docs/development/testing.md)
+- [ ] relevant API documentation, tutorials, and examples are updated and follow the [documentation style guide](https://github.com/electron/electron/blob/main/docs/development/style-guide.md)
+- [ ] [PR release notes](https://github.com/electron/clerk/blob/main/README.md) describe the change in a way relevant to app developers, and are [capitalized, punctuated, and past tense](https://github.com/electron/clerk/blob/main/README.md#examples).
 
 #### Release Notes
 
-Notes: <!-- Please add a one-line description for app developers to read in the release notes, or `no-notes` if no notes relevant to app developers. Examples and help on special cases: https://github.com/electron/clerk/blob/master/README.md#examples -->
+Notes: <!-- Please add a one-line description for app developers to read in the release notes, or 'none' if no notes relevant to app developers. Examples and help on special cases: https://github.com/electron/clerk/blob/main/README.md#examples -->

.github/actions/build-electron/action.yml

@@ -0,0 +1,227 @@
+name: 'Build Electron'
+description: 'Builds Electron & Friends'
+inputs:
+  target-arch:
+    description: 'Target arch'
+    required: true
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'
+    required: true
+  artifact-platform:
+    description: 'Artifact platform, should be linux, win, darwin or mas'
+    required: true
+  step-suffix:
+    description: 'Suffix for build steps'
+    required: false
+    default: ''
+  is-release:
+    description: 'Is release build'
+    required: true
+  generate-symbols:
+    description: 'Generate symbols'
+    required: true
+  upload-to-storage:
+    description: 'Upload to storage'
+    required: true
+  is-asan:
+    description: 'The ASan Linux build'
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Set GN_EXTRA_ARGS for MacOS x64 Builds
+      shell: bash
+      if: ${{ inputs.target-arch == 'x64' && inputs.target-platform == 'macos' }}
+      run: |
+        GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"x64\" v8_snapshot_toolchain=\"//build/toolchain/mac:clang_x64\""
+        echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
+    - name: Set GN_EXTRA_ARGS for Windows
+      shell: bash
+      if: ${{ inputs.target-platform == 'win' }}
+      run: |
+        GN_APPENDED_ARGS="$GN_EXTRA_ARGS target_cpu=\"${{ inputs.target-arch }}\" use_v8_context_snapshot=true target_os=\"win\""
+        echo "GN_EXTRA_ARGS=$GN_APPENDED_ARGS" >> $GITHUB_ENV
+    - name: Add Clang problem matcher
+      shell: bash
+      run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
+    - name: Build Electron ${{ inputs.step-suffix }}
+      shell: bash
+      run: |
+        rm -rf "src/out/Default/Electron Framework.framework"
+        rm -rf src/out/Default/Electron*.app
+
+        cd src/electron
+        # TODO(codebytere): remove this once we figure out why .git/packed-refs is initially missing
+        git pack-refs
+        cd ..
+
+        if [ "`uname`" = "Darwin" ]; then
+          ulimit -n 10000
+          sudo launchctl limit maxfiles 65536 200000
+        fi
+
+        if [ "${{ inputs.is-release }}" = "true" ]; then
+          NINJA_SUMMARIZE_BUILD=1 e build --target electron:release_build
+        else
+          NINJA_SUMMARIZE_BUILD=1 e build --target electron:testing_build
+        fi
+        cp out/Default/.ninja_log out/electron_ninja_log
+        node electron/script/check-symlinks.js
+
+        # Upload build stats to Datadog
+        if ! [ -z $DD_API_KEY ]; then
+          if [ "$TARGET_PLATFORM" = "win" ]; then
+            npx node electron/script/build-stats.mjs out/Default/siso.exe.INFO --upload-stats || true
+          else
+            npx node electron/script/build-stats.mjs out/Default/siso.INFO --upload-stats || true
+          fi
+        else
+          echo "Skipping build-stats.mjs upload because DD_API_KEY is not set"
+        fi
+    - name: Verify dist.zip ${{ inputs.step-suffix }}
+      shell: bash
+      run: |
+        cd src        
+        if [ "${{ inputs.is-asan }}" != "true" ]; then
+          target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
+          if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
+            target_os="${target_os}_mas"
+          fi
+          electron/script/zip_manifests/check-zip-manifest.py out/Default/dist.zip electron/script/zip_manifests/dist_zip.$target_os.${{ inputs.target-arch }}.manifest
+        fi
+    - name: Fixup Mksnapshot ${{ inputs.step-suffix }}
+      shell: bash
+      run: |
+        cd src
+        ELECTRON_DEPOT_TOOLS_DISABLE_LOG=1 e d gn desc out/Default v8:run_mksnapshot_default args > out/Default/mksnapshot_args
+        # Remove unused args from mksnapshot_args
+        SEDOPTION="-i"
+        if [ "`uname`" = "Darwin" ]; then
+          SEDOPTION="-i ''"
+        fi
+        sed $SEDOPTION '/.*builtins-pgo/d' out/Default/mksnapshot_args
+        sed $SEDOPTION '/--turbo-profiling-input/d' out/Default/mksnapshot_args
+
+        (cd out/Default; zip mksnapshot.zip mksnapshot_args gen/v8/embedded.S)        
+    - name: Generate Cross-Arch Snapshot (arm/arm64)  ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ (inputs.target-arch == 'arm' || inputs.target-arch == 'arm64') && inputs.target-platform == 'linux' }}
+      run: |
+        cd src
+        if [ "${{ inputs.target-arch }}" = "arm" ]; then
+          MKSNAPSHOT_PATH="clang_x86_v8_arm"
+        elif [ "${{ inputs.target-arch }}" = "arm64" ]; then
+          MKSNAPSHOT_PATH="clang_x64_v8_arm64"
+        fi
+
+        cp "out/Default/$MKSNAPSHOT_PATH/mksnapshot" out/Default
+        cp "out/Default/$MKSNAPSHOT_PATH/v8_context_snapshot_generator" out/Default
+        cp "out/Default/$MKSNAPSHOT_PATH/libffmpeg.so" out/Default
+
+        python3 electron/script/verify-mksnapshot.py --source-root "$PWD" --build-dir out/Default --create-snapshot-only
+        mkdir cross-arch-snapshots
+        cp out/Default-mksnapshot-test/*.bin cross-arch-snapshots
+        # Clean up so that ninja does not get confused
+        rm -f out/Default/libffmpeg.so
+    - name: Build Chromedriver ${{ inputs.step-suffix }}
+      shell: bash
+      run: |
+        cd src
+        e build --target electron:electron_chromedriver_zip
+
+        if [ "${{ inputs.is-asan }}" != "true" ]; then
+          target_os=${{ inputs.target-platform == 'macos' && 'mac' || inputs.target-platform }}
+          if [ "${{ inputs.artifact-platform }}" = "mas" ]; then
+            target_os="${target_os}_mas"
+          fi
+          electron/script/zip_manifests/check-zip-manifest.py out/Default/chromedriver.zip electron/script/zip_manifests/chromedriver_zip.$target_os.${{ inputs.target-arch }}.manifest
+        fi
+    - name: Profile Windows Toolchain ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        cd src
+        python3 electron/build/profile_toolchain.py --output-json=out/Default/windows_toolchain_profile.json
+    - name: Add msdia140.dll to Path ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' && inputs.target-platform == 'win' }}
+      run: |
+        # Needed for msdia140.dll on 64-bit windows
+        cd src
+        export PATH="$PATH:$(pwd)/third_party/llvm-build/Release+Asserts/bin"
+    - name: Zip Symbols ${{ inputs.step-suffix }}
+      shell: bash
+      run: |
+        cd src
+        export BUILD_PATH="$(pwd)/out/Default"
+        if [ "${{ inputs.is-release }}" = "true" ]; then
+          DELETE_DSYMS_AFTER_ZIP=1 electron/script/zip-symbols.py -b $BUILD_PATH
+        else
+          electron/script/zip-symbols.py -b $BUILD_PATH
+        fi
+    - name: Generate FFMpeg ${{ inputs.step-suffix }}
+      shell: bash
+      if: ${{ inputs.is-release == 'true' }}
+      run: |
+        cd src
+        gn gen out/ffmpeg --args="import(\"//electron/build/args/ffmpeg.gn\") use_remoteexec=true use_siso=true $GN_EXTRA_ARGS"
+        e build --target electron:electron_ffmpeg_zip -C ../../out/ffmpeg
+    - name: Remove Clang problem matcher
+      shell: bash
+      run: echo "::remove-matcher owner=clang::"
+    - name: Generate TypeScript Definitions ${{ inputs.step-suffix }}
+      if: ${{ inputs.is-release == 'true' }}
+      shell: bash
+      run: |
+        cd src/electron
+        node script/yarn.js create-typescript-definitions
+    - name: Publish Electron Dist ${{ inputs.step-suffix }}
+      if: ${{ inputs.is-release == 'true' }}
+      shell: bash
+      run: |
+        rm -rf src/out/Default/obj
+        cd src/electron
+        if [ "${{ inputs.upload-to-storage }}" = "1" ]; then
+          echo 'Uploading Electron release distribution to Azure'
+          script/release/uploaders/upload.py --verbose --upload_to_storage
+        else
+          echo 'Uploading Electron release distribution to GitHub releases'
+          script/release/uploaders/upload.py --verbose
+        fi
+    - name: Generate siso report
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: |
+        cd src
+        e d siso report -C out/Default > siso_report.txt
+        SISO_REPORT_PATH=$(grep -o '/.*siso-report-[^ ]*' siso_report.txt)
+        echo "SISO_REPORT_PATH=$SISO_REPORT_PATH" >> $GITHUB_ENV
+        cat siso_report.txt
+        echo "SISO REPORT AT $SISO_REPORT_PATH"
+    - name: Generate Artifact Key
+      if: always() && !cancelled()
+      shell: bash
+      run: |
+        if [ "${{ inputs.is-asan }}" = "true" ]; then 
+          ARTIFACT_KEY=${{ inputs.artifact-platform }}_${{ inputs.target-arch }}_asan
+        else
+          ARTIFACT_KEY=${{ inputs.artifact-platform }}_${{ inputs.target-arch }}
+        fi
+        echo "ARTIFACT_KEY=$ARTIFACT_KEY" >> $GITHUB_ENV
+    # The current generated_artifacts_<< artifact.key >> name was taken from CircleCI
+    # to ensure we don't break anything, but we may be able to improve that.
+    - name: Move all Generated Artifacts to Upload Folder ${{ inputs.step-suffix }}
+      if: always() && !cancelled()
+      shell: bash
+      run: ./src/electron/script/actions/move-artifacts.sh
+    - name: Upload Generated Artifacts ${{ inputs.step-suffix }}
+      if: always() && !cancelled()
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+      with:
+        name: generated_artifacts_${{ env.ARTIFACT_KEY }}
+        path: ./generated_artifacts_${{ inputs.artifact-platform }}_${{ inputs.target-arch }}
+    - name: Upload Src Artifacts ${{ inputs.step-suffix }}
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+      with:
+        name: src_artifacts_${{ env.ARTIFACT_KEY }}
+        path: ./src_artifacts_${{ inputs.artifact-platform }}_${{ inputs.target-arch }}

.github/actions/build-git-cache/action.yml

@@ -0,0 +1,83 @@
+name: 'Build Git Cache'
+description: 'Runs a gclient sync to build the git cache for Electron'
+inputs:
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'    
+runs:
+  using: "composite"
+  steps:
+  - name: Set GIT_CACHE_PATH to make gclient to use the cache
+    shell: bash
+    run: |
+      echo "GIT_CACHE_PATH=$(pwd)/git-cache" >> $GITHUB_ENV
+  - name: Set Chromium Git Cookie
+    uses: ./src/electron/.github/actions/set-chromium-cookie
+  - name: Install Build Tools
+    uses: ./src/electron/.github/actions/install-build-tools
+  - name: Set up cache drive
+    shell: bash
+    run: |
+      if [ "${{ inputs.target-platform }}" = "win" ]; then
+        echo "CACHE_DRIVE=/mnt/win-cache" >> $GITHUB_ENV
+      else
+        echo "CACHE_DRIVE=/mnt/cross-instance-cache" >> $GITHUB_ENV
+      fi
+  - name: Check cross instance cache disk space
+    shell: bash
+    run: |    
+      # if there is less than 35 GB free space then creating the cache might fail so exit early
+      freespace=`df -m $CACHE_DRIVE | grep -w $CACHE_DRIVE | awk '{print $4}'`
+      freespace_human=`df -h $CACHE_DRIVE | grep -w $CACHE_DRIVE | awk '{print $4}'`
+      if [ $freespace -le 35000 ]; then
+        echo "The cross mount cache has $freespace_human free space which is not enough - exiting"
+        exit 1
+      else
+        echo "The cross mount cache has $freespace_human free space - continuing"
+      fi
+  - name: Restore gitcache
+    shell: bash
+    run: |
+      GIT_CACHE_TAR="$CACHE_DRIVE/gitcache.tar"
+      if [ ! -f "$GIT_CACHE_TAR" ]; then
+        echo "Git cache tar file does not exist, skipping restore"
+        exit 0
+      fi
+      echo "Restoring git cache from $GIT_CACHE_TAR to $GIT_CACHE_PATH"
+      mkdir -p $GIT_CACHE_PATH
+      tar -xf $GIT_CACHE_TAR -C $GIT_CACHE_PATH
+  - name: Gclient Sync
+    shell: bash
+    run: |
+      e d gclient config \
+        --name "src/electron" \
+        --unmanaged \
+        ${GCLIENT_EXTRA_ARGS} \
+        "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
+
+      if [ "$TARGET_OS" != "" ]; then
+        echo "target_os=['$TARGET_OS']" >> ./.gclient
+      fi
+
+      ELECTRON_USE_THREE_WAY_MERGE_FOR_PATCHES=1 e d gclient sync --with_branch_heads --with_tags --nohooks -vv 
+  - name: Compress Git Cache Directory
+    shell: bash
+    run: |
+      echo "Uncompressed gitcache size: $(du -sh $GIT_CACHE_PATH | cut -f1 -d' ')"
+      cd $GIT_CACHE_PATH
+      tar -cf ../gitcache.tar .
+      cd ..
+      echo "Compressed gitcache to $(du -sh gitcache.tar | cut -f1 -d' ')"
+      # remove the old cache file if it exists 
+      if [ -f $CACHE_DRIVE/gitcache.tar ]; then
+        echo "Removing old gitcache.tar from $CACHE_DRIVE"
+        rm $CACHE_DRIVE/gitcache.tar
+      fi      
+      cp ./gitcache.tar $CACHE_DRIVE/
+  - name: Wait for active SSH sessions
+    shell: bash
+    if: always() && !cancelled()
+    run: |
+      while [ -f /var/.ssh-lock ]
+      do
+        sleep 60
+      done

.github/actions/checkout/action.yml

@@ -0,0 +1,213 @@
+name: 'Checkout'
+description: 'Checks out Electron and stores it in the AKS Cache'
+inputs:
+  generate-sas-token:
+    description: 'Whether to generate and persist a SAS token for the item in the cache'
+    required: false
+    default: 'false'
+  use-cache:
+    description: 'Whether to persist the cache to the shared drive'
+    required: false
+    default: 'true'
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'    
+runs:
+  using: "composite"
+  steps:
+  - name: Set GIT_CACHE_PATH to make gclient to use the cache
+    shell: bash
+    run: |
+      echo "GIT_CACHE_PATH=$(pwd)/git-cache" >> $GITHUB_ENV
+  - name: Install Dependencies
+    uses: ./src/electron/.github/actions/install-dependencies
+  - name: Set Chromium Git Cookie
+    uses: ./src/electron/.github/actions/set-chromium-cookie
+  - name: Install Build Tools
+    uses: ./src/electron/.github/actions/install-build-tools
+  - name: Generate DEPS Hash
+    shell: bash
+    run: |
+      node src/electron/script/generate-deps-hash.js
+      DEPSHASH="v1-src-cache-$(cat src/electron/.depshash)"
+      echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
+      echo "CACHE_FILE=$DEPSHASH.tar" >> $GITHUB_ENV
+      if [ "${{ inputs.target-platform }}" = "win" ]; then
+        echo "CACHE_DRIVE=/mnt/win-cache" >> $GITHUB_ENV
+      else
+        echo "CACHE_DRIVE=/mnt/cross-instance-cache" >> $GITHUB_ENV
+      fi
+  - name: Generate SAS Key
+    if: ${{ inputs.generate-sas-token == 'true' }}
+    shell: bash
+    run: |
+      curl --unix-socket /var/run/sas/sas.sock --fail "http://foo/$CACHE_FILE?platform=${{ inputs.target-platform }}&getAccountName=true" > sas-token
+  - name: Save SAS Key
+    if: ${{ inputs.generate-sas-token == 'true' }}
+    uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    with:
+      path: sas-token
+      key: sas-key-${{ inputs.target-platform }}-${{ github.run_number }}-${{ github.run_attempt }}
+      enableCrossOsArchive: true
+  - name: Check If Cache Exists
+    id: check-cache
+    shell: bash
+    run: |
+      if [[ "${{ inputs.use-cache }}" == "false" ]]; then
+        echo "Not using cache this time..."
+        echo "cache_exists=false" >> $GITHUB_OUTPUT
+      else
+        cache_path=$CACHE_DRIVE/$CACHE_FILE
+        echo "Using cache key: $DEPSHASH"
+        echo "Checking for cache in: $cache_path"
+        if [ ! -f "$cache_path" ] || [ `du $cache_path | cut -f1` = "0" ]; then
+          echo "cache_exists=false" >> $GITHUB_OUTPUT
+          echo "Cache Does Not Exist for $DEPSHASH"
+        else
+          echo "cache_exists=true" >> $GITHUB_OUTPUT
+          echo "Cache Already Exists for $DEPSHASH, Skipping.."
+        fi
+      fi
+  - name: Check cross instance cache disk space
+    if: steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache  == 'true'
+    shell: bash
+    run: |    
+      # if there is less than 35 GB free space then creating the cache might fail so exit early
+      freespace=`df -m $CACHE_DRIVE | grep -w $CACHE_DRIVE | awk '{print $4}'`
+      freespace_human=`df -h $CACHE_DRIVE | grep -w $CACHE_DRIVE | awk '{print $4}'`
+      if [ $freespace -le 35000 ]; then
+        echo "The cross mount cache has $freespace_human free space which is not enough - exiting"
+        exit 1
+      else
+        echo "The cross mount cache has $freespace_human free space - continuing"
+      fi
+  - name: Add patch conflict problem matcher
+    shell: bash
+    run: echo "::add-matcher::src/electron/.github/problem-matchers/patch-conflict.json"
+  - name: Restore gitcache
+    if: steps.check-cache.outputs.cache_exists == 'false'
+    shell: bash
+    run: |
+      GIT_CACHE_TAR="$CACHE_DRIVE/gitcache.tar"
+      if [ ! -f "$GIT_CACHE_TAR" ]; then
+        echo "Git cache tar file does not exist, skipping restore"
+        exit 0
+      fi
+      echo "Restoring git cache from $GIT_CACHE_TAR to $GIT_CACHE_PATH"
+      mkdir -p $GIT_CACHE_PATH
+      tar -xf $GIT_CACHE_TAR -C $GIT_CACHE_PATH
+  - name: Gclient Sync
+    if: steps.check-cache.outputs.cache_exists == 'false'
+    shell: bash
+    run: |
+      e d gclient config \
+        --name "src/electron" \
+        --unmanaged \
+        ${GCLIENT_EXTRA_ARGS} \
+        "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
+
+      if [ "$TARGET_OS" != "" ]; then
+        echo "target_os=['$TARGET_OS']" >> ./.gclient
+      fi
+
+      ELECTRON_USE_THREE_WAY_MERGE_FOR_PATCHES=1 e d gclient sync --with_branch_heads --with_tags -vv
+      if [[ "${{ inputs.is-release }}" != "true" ]]; then
+        # Re-export all the patches to check if there were changes.
+        python3 src/electron/script/export_all_patches.py src/electron/patches/config.json
+        cd src/electron
+        git update-index --refresh || true
+        if ! git diff-index --quiet HEAD --; then
+          # There are changes to the patches. Make a git commit with the updated patches
+          if node ./script/patch-up.js; then
+            echo
+            echo "======================================================================"
+            echo "Changes to the patches when applying, we have auto-pushed the diff to the current branch"
+            echo "A new CI job will kick off shortly"
+            echo "======================================================================"
+            exit 1
+          else
+            git add patches
+            GIT_COMMITTER_NAME="PatchUp" GIT_COMMITTER_EMAIL="73610968+patchup[bot]@users.noreply.github.com" git commit -m "chore: update patches" --author="PatchUp <73610968+patchup[bot]@users.noreply.github.com>"
+            # Export it
+            mkdir -p ../../patches
+            git format-patch -1 --stdout --keep-subject --no-stat --full-index > ../../patches/update-patches.patch
+            echo
+            echo "======================================================================"
+            echo "There were changes to the patches when applying."
+            echo "Check the CI artifacts for a patch you can apply to fix it."
+            echo "======================================================================"
+            echo
+            cat ../../patches/update-patches.patch
+            exit 1
+          fi
+        else
+          echo "No changes to patches detected"
+        fi
+      fi
+  - name: Remove patch conflict problem matchers
+    shell: bash
+    run: |
+      echo "::remove-matcher owner=merge-conflict::"
+      echo "::remove-matcher owner=patch-conflict::"
+      echo "::remove-matcher owner=patch-needs-update::"
+  - name: Upload patches stats
+    if: ${{ inputs.target-platform == 'linux' && github.ref == 'refs/heads/main' }}
+    shell: bash
+    run: |
+      node src/electron/script/patches-stats.mjs --upload-stats || true
+  # delete all .git directories under src/ except for
+  # third_party/angle/ and third_party/dawn/ because of build time generation of files
+  # gen/angle/commit.h depends on third_party/angle/.git/HEAD
+  # https://chromium-review.googlesource.com/c/angle/angle/+/2074924
+  # and dawn/common/Version_autogen.h depends on  third_party/dawn/.git/HEAD
+  # https://dawn-review.googlesource.com/c/dawn/+/83901
+  # TODO: maybe better to always leave out */.git/HEAD file for all targets ?
+  - name: Delete .git directories under src to free space
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
+    shell: bash
+    run: |
+      cd src
+      ( find . -type d -name ".git" -not -path "./third_party/angle/*" -not -path "./third_party/dawn/*" -not -path "./electron/*" ) | xargs rm -rf
+  - name: Minimize Cache Size for Upload
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
+    shell: bash
+    run: |
+      rm -rf src/android_webview
+      rm -rf src/ios/chrome
+      rm -rf src/third_party/blink/perf_tests
+      rm -rf src/chrome/test/data/xr/webvr_info
+      rm -rf src/third_party/angle/third_party/VK-GL-CTS/src
+      rm -rf src/third_party/swift-toolchain
+      rm -rf src/third_party/swiftshader/tests/regres/testlists
+      cp src/electron/.github/actions/checkout/action.yml ./
+      rm -rf src/electron
+      mkdir -p src/electron/.github/actions/checkout
+      mv action.yml src/electron/.github/actions/checkout
+  - name: Compress Src Directory
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
+    shell: bash
+    run: |
+      echo "Uncompressed src size: $(du -sh src | cut -f1 -d' ')"
+      tar -cf $CACHE_FILE src
+      echo "Compressed src to $(du -sh $CACHE_FILE | cut -f1 -d' ')"
+      cp ./$CACHE_FILE $CACHE_DRIVE/
+  - name: Persist Src Cache
+    if: ${{ steps.check-cache.outputs.cache_exists == 'false' && inputs.use-cache == 'true' }}
+    shell: bash
+    run: |
+      final_cache_path=$CACHE_DRIVE/$CACHE_FILE
+      echo "Using cache key: $DEPSHASH"
+      echo "Checking path: $final_cache_path"
+      if [ ! -f "$final_cache_path" ]; then
+        echo "Cache key not found"
+        exit 1
+      else
+        echo "Cache key persisted in $final_cache_path"
+      fi
+  - name: Wait for active SSH sessions
+    shell: bash
+    if: always() && !cancelled()
+    run: |
+      while [ -f /var/.ssh-lock ]
+      do
+        sleep 60
+      done

.github/actions/cipd-install/action.yml

@@ -0,0 +1,51 @@
+name: 'CIPD install'
+description: 'Installs the specified CIPD package'
+inputs:
+  cipd-root-prefix-path:
+    description: 'Path to prepend to installation directory'
+    default: ''
+  dependency:
+    description: 'Name of dependency to install'
+  deps-file:
+    description: 'Location of DEPS file that defines the dependency'
+  installation-dir:
+    description: 'Location to install dependency'
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'
+  package:
+    description: 'Package to install'
+  dependency-version:
+    description: 'Version of the dependency to install'
+    default: ''
+runs:
+  using: "composite"
+  steps:
+    - name: Delete wrong ${{ inputs.dependency }}
+      shell: bash
+      run : |
+        rm -rf ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }}
+    - name: Create ensure file for ${{ inputs.dependency }}
+      if: ${{ inputs.dependency-version == '' }}
+      shell: bash
+      run: |
+        echo '${{ inputs.package }}' `e d gclient getdep --deps-file=${{ inputs.deps-file }} -r '${{ inputs.installation-dir }}:${{ inputs.package }}'` > ${{ inputs.dependency }}_ensure_file
+        cat ${{ inputs.dependency }}_ensure_file
+
+    - name: Create ensure file for ${{ inputs.dependency }} from dependency-version
+      if: ${{ inputs.dependency-version != '' }}
+      shell: bash
+      run: |
+        echo '${{ inputs.package }} ${{ inputs.dependency-version }}'  > ${{ inputs.dependency }}_ensure_file
+        cat ${{ inputs.dependency }}_ensure_file
+    - name: CIPD installation of ${{ inputs.dependency }} (macOS)
+      if: ${{ inputs.target-platform != 'win' }}
+      shell: bash
+      run: |
+        echo "ensuring ${{ inputs.dependency }}"
+        e d cipd ensure --root ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }} -ensure-file ${{ inputs.dependency }}_ensure_file
+    - name: CIPD installation of ${{ inputs.dependency }} (Windows)
+      if: ${{ inputs.target-platform == 'win' }}
+      shell: powershell
+      run: |
+        echo "ensuring ${{ inputs.dependency }} on Windows"
+        e d cipd ensure --root ${{ inputs.cipd-root-prefix-path }}${{ inputs.installation-dir }} -ensure-file ${{ inputs.dependency }}_ensure_file

.github/actions/fix-sync/action.yml

@@ -0,0 +1,154 @@
+name: 'Fix Sync'
+description: 'Ensures proper binaries are in place'
+# This action is required to correct for differences between "gclient sync"
+# on Linux and the expected state on macOS/windows. This requires:
+# 1. Fixing Clang Install (wrong binary)
+# 2. Fixing esbuild (wrong binary)
+# 3. Fixing rustc (wrong binary)
+# 4. Fixing gn (wrong binary)
+# 5. Fix reclient (wrong binary)
+# 6. Fixing dsymutil (wrong binary)
+# 7. Ensuring we are using the correct ninja and adding it to PATH
+# 8. Fixing angle (wrong remote)
+# 9. Install windows toolchain on Windows
+# 10. Fix node binary on Windows
+# 11. Fix rc binary on Windows
+inputs:
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'
+runs:
+  using: "composite"
+  steps:
+    - name: Fix llvm toolchain
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        rm -rf src/third_party/llvm-build
+        python3 src/tools/clang/scripts/update.py
+        # Refs https://chromium-review.googlesource.com/c/chromium/src/+/6667681
+        python3 src/tools/clang/scripts/update.py --package objdump
+    - name: Fix esbuild
+      if: ${{ inputs.target-platform != 'linux' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        cipd-root-prefix-path: src/third_party/devtools-frontend/src/
+        dependency: esbuild
+        deps-file: src/third_party/devtools-frontend/src/DEPS
+        installation-dir: third_party/esbuild
+        target-platform: ${{ inputs.target-platform }}
+        package: infra/3pp/tools/esbuild/${platform}
+    - name: Fix rollup
+      if: ${{ inputs.target-platform != 'linux' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        cipd-root-prefix-path: src/third_party/devtools-frontend/src/
+        dependency: rollup_libs
+        deps-file: src/third_party/devtools-frontend/src/DEPS
+        installation-dir: third_party/rollup_libs
+        target-platform: ${{ inputs.target-platform }}
+        package: infra/3pp/tools/rollup_libs/${platform}
+    - name: Sync native rollup libs
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        cd src/third_party/devtools-frontend/src
+        python3 scripts/deps/sync_rollup_libs.py
+    - name: Fix rustc
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        rm -rf src/third_party/rust-toolchain
+        python3 src/tools/rust/update_rust.py
+    - name: Fix gn (macOS)
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        dependency: gn
+        deps-file: src/DEPS
+        installation-dir: src/buildtools/mac
+        target-platform: ${{ inputs.target-platform }}
+        package: gn/gn/mac-${arch}
+    - name: Fix gn (Windows)
+      if: ${{ inputs.target-platform == 'win' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        dependency: gn
+        deps-file: src/DEPS
+        installation-dir: src/buildtools/win 
+        target-platform: ${{ inputs.target-platform }}
+        package: gn/gn/windows-amd64
+    - name: Fix reclient
+      if: ${{ inputs.target-platform != 'linux' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        dependency: reclient
+        deps-file: src/DEPS
+        installation-dir: src/buildtools/reclient
+        target-platform: ${{ inputs.target-platform }}
+        package: infra/rbe/client/${platform}
+    - name: Configure reclient configs
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        python3 src/buildtools/reclient_cfgs/configure_reclient_cfgs.py --rbe_instance "projects/rbe-chrome-untrusted/instances/default_instance" --reproxy_cfg_template reproxy.cfg.template --rewrapper_cfg_project "" --skip_remoteexec_cfg_fetch
+    - name: Fix dsymutil (macOS)
+      if: ${{ inputs.target-platform == 'macos' }}
+      shell: bash
+      run : |
+        # Fix dsymutil
+        if [ "${{ inputs.target-platform }}" = "macos" ]; then
+          if  [ "${{ env.TARGET_ARCH }}" == "arm64" ]; then
+            DSYM_SHA_FILE=src/tools/clang/dsymutil/bin/dsymutil.arm64.sha1
+          else
+            DSYM_SHA_FILE=src/tools/clang/dsymutil/bin/dsymutil.x64.sha1
+          fi
+          python3 src/third_party/depot_tools/download_from_google_storage.py --no_resume --no_auth --bucket chromium-browser-clang -s $DSYM_SHA_FILE -o src/tools/clang/dsymutil/bin/dsymutil
+        fi
+    - name: Fix ninja
+      if: ${{ inputs.target-platform != 'linux' }}
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        dependency: ninja
+        deps-file: src/DEPS
+        installation-dir: src/third_party/ninja
+        target-platform: ${{ inputs.target-platform }}
+        package: infra/3pp/tools/ninja/${platform}
+    - name: Set ninja in path
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        echo "$(pwd)/src/third_party/ninja" >> $GITHUB_PATH
+    - name: Fix siso
+      uses: ./src/electron/.github/actions/cipd-install
+      with:
+        dependency: siso
+        deps-file: src/DEPS
+        installation-dir: src/third_party/siso/cipd
+        target-platform: ${{ inputs.target-platform }}
+        package: build/siso/${platform}
+    - name: Fixup angle git
+      if: ${{ inputs.target-platform != 'linux' }}
+      shell: bash
+      run : |
+        cd src/third_party/angle
+        rm -f .git/objects/info/alternates
+        git remote set-url origin https://chromium.googlesource.com/angle/angle.git
+        cp .git/config .git/config.backup
+        git remote remove origin
+        mv .git/config.backup .git/config
+        git fetch
+    - name: Get Windows toolchain
+      if: ${{ inputs.target-platform == 'win' }}
+      shell: powershell
+      run: e d vpython3 src\build\vs_toolchain.py update --force
+    - name: Download nodejs
+      if: ${{ inputs.target-platform == 'win' }}
+      shell: powershell
+      run: |
+        $nodedeps = e d gclient getdep --deps-file=src/DEPS -r src/third_party/node/win | ConvertFrom-JSON
+        python3 src\third_party\depot_tools\download_from_google_storage.py --no_resume --no_auth --bucket chromium-nodejs -o src\third_party\node\win\node.exe $nodedeps.object_name
+    - name: Install rc
+      if: ${{ inputs.target-platform == 'win' }}
+      shell: bash
+      run: |
+        python3 src/third_party/depot_tools/download_from_google_storage.py --no_resume --no_auth --bucket chromium-browser-clang/rc -s src/build/toolchain/win/rc/win/rc.exe.sha1

.github/actions/free-space-macos/action.yml

@@ -0,0 +1,91 @@
+name: 'Free Space macOS'
+description: 'Checks out Electron and stores it in the AKS Cache'
+runs:
+  using: "composite"
+  steps:
+    - name: Free Space on MacOS
+      shell: bash
+      run: |
+        echo "Disk usage before cleanup:"
+        df -h
+        sudo mkdir -p $TMPDIR/del-target
+
+        tmpify() {
+          if [ -d "$1" ]; then
+            sudo mv "$1" $TMPDIR/del-target/$(echo $1|shasum -a 256|head -n1|cut -d " " -f1)
+          fi
+        }
+
+        strip_universal_deep() {
+          if [ -d "$1" ]; then
+            opwd=$(pwd)
+            cd $1
+            f=$(find . -perm +111 -type f)
+            for fp in $f
+            do
+              if [[ $(file "$fp") == *"universal binary"* ]]; then
+                if [ "`arch`" == "arm64" ]; then
+                  if [[ $(file "$fp") == *"x86_64"* ]]; then
+                    sudo lipo -remove x86_64 "$fp" -o "$fp" || true
+                  fi
+                else
+                  if [[ $(file "$fp") == *"arm64e)"* ]]; then
+                    sudo lipo -remove arm64e "$fp" -o "$fp" || true
+                  fi
+                  if [[ $(file "$fp") == *"arm64)"* ]]; then
+                    sudo lipo -remove arm64 "$fp" -o "$fp" || true
+                  fi
+                fi
+              fi
+            done
+
+            cd $opwd
+          fi
+        }
+
+        tmpify /Library/Developer/CoreSimulator
+        tmpify ~/Library/Developer/CoreSimulator
+        tmpify $(xcode-select -p)/Platforms/AppleTVOS.platform
+        tmpify $(xcode-select -p)/Platforms/iPhoneOS.platform
+        tmpify $(xcode-select -p)/Platforms/WatchOS.platform
+        tmpify $(xcode-select -p)/Platforms/WatchSimulator.platform
+        tmpify $(xcode-select -p)/Platforms/AppleTVSimulator.platform
+        tmpify $(xcode-select -p)/Platforms/iPhoneSimulator.platform
+        tmpify $(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/metal/ios
+        tmpify $(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift
+        tmpify $(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift-5.0
+        tmpify ~/.rubies
+        tmpify ~/Library/Caches/Homebrew
+        tmpify /usr/local/Homebrew
+
+        sudo rm -rf $TMPDIR/del-target
+
+        sudo rm -rf /Applications/Safari.app
+        sudo rm -rf /Applications/Xcode_16.1.app
+        sudo rm -rf /Applications/Xcode_16.2.app
+        sudo rm -rf /Applications/Xcode_16.3.app
+        sudo rm -rf /Applications/Xcode_26*
+        sudo rm -rf /Applications/Google Chrome.app
+        sudo rm -rf /Applications/Google Chrome for Testing.app
+        sudo rm -rf /Applications/Firefox.app
+        sudo rm -rf /Applications/Microsoft Edge.app
+        sudo rm -rf ~/project/src/third_party/catapult/tracing/test_data
+        sudo rm -rf ~/project/src/third_party/angle/third_party/VK-GL-CTS
+        sudo rm -rf /Users/runner/Library/Android
+        sudo rm -rf $JAVA_HOME_11_arm64
+        sudo rm -rf $JAVA_HOME_17_arm64
+        sudo rm -rf $JAVA_HOME_21_arm64
+        sudo rm -rf $JAVA_HOME_25_arm64
+        sudo rm -rf /Users/runner/.dotnet/
+        sudo rm -rf /Users/runner/.rustup
+
+        # remove homebrew packages we don't need
+        if command -v brew &> /dev/null; then
+          brew uninstall -f --zap aws-sam-cli session-manager-plugin gcc gcc@13 gcc@14 llvm@18 gradle maven ant azure-cli
+          brew autoremove
+        fi
+
+        # lipo off some huge binaries arm64 versions to save space
+        strip_universal_deep $(xcode-select -p)/../SharedFrameworks
+        # strip_arm_deep /System/Volumes/Data/Library/Developer/CommandLineTools/usr
+        sudo mdutil -a -i off

.github/actions/generate-types/action.yml

@@ -0,0 +1,28 @@
+name: 'Generate Types for Archaeologist Dig'
+description: 'Generate Types for Archaeologist Dig'
+inputs:
+  sha-file:
+    description: 'File containing sha'
+    required: true
+  filename:
+    description: 'Filename to write types to'
+    required: true
+runs:
+  using: "composite"
+  steps:
+  - name: Generating Types for SHA in ${{ inputs.sha-file }}
+    shell: bash
+    run: |
+      export ELECTRON_DIR=$(pwd)
+      if [ "${{ inputs.sha-file }}" == ".dig-old" ]; then
+        cd /tmp
+        git clone https://github.com/electron/electron.git
+        cd electron
+      fi
+      git checkout $(cat $ELECTRON_DIR/${{ inputs.sha-file }})
+      node script/yarn.js install --immutable
+      echo "#!/usr/bin/env node\nglobal.x=1" > node_modules/typescript/bin/tsc
+      node node_modules/.bin/electron-docs-parser --dir=./ --outDir=./ --moduleVersion=0.0.0-development
+      node node_modules/.bin/electron-typescript-definitions --api=electron-api.json --outDir=artifacts
+      mv artifacts/electron.d.ts $ELECTRON_DIR/artifacts/${{ inputs.filename }}
+    working-directory: ./electron

.github/actions/install-build-tools/action.yml

@@ -0,0 +1,32 @@
+name: 'Install Build Tools'
+description: 'Installs an exact SHA of build tools'
+runs:
+  using: "composite"
+  steps:
+  - name: Install Build Tools
+    shell: bash
+    run: |
+      if [ "$(expr substr $(uname -s) 1 10)" == "MSYS_NT-10" ]; then
+        git config --global core.filemode false
+        git config --global core.autocrlf false
+        git config --global branch.autosetuprebase always
+        git config --global core.fscache true
+        git config --global core.longpaths true
+        git config --global core.preloadindex true
+        git config --global core.longpaths true
+      fi
+      export BUILD_TOOLS_SHA=4430e4a505e0f4fa2a41b707a10a36f780bbdd26
+      npm i -g @electron/build-tools
+      # Update depot_tools to ensure python
+      e d update_depot_tools
+      e auto-update disable
+      # Disable further updates of depot_tools
+      e d auto-update disable
+      if [ "$(expr substr $(uname -s) 1 10)" == "MSYS_NT-10" ]; then
+        e d cipd.bat --version
+        cp "C:\Python311\python.exe" "C:\Python311\python3.exe"
+        echo "C:\Users\ContainerAdministrator\.electron_build_tools\third_party\depot_tools" >> $GITHUB_PATH
+      else
+        echo "$HOME/.electron_build_tools/third_party/depot_tools" >> $GITHUB_PATH
+        echo "$HOME/.electron_build_tools/third_party/depot_tools/python-bin" >> $GITHUB_PATH
+      fi

.github/actions/install-dependencies/action.yml

@@ -0,0 +1,31 @@
+name: 'Install Dependencies'
+description: 'Installs yarn depdencies using cache when available'
+runs:
+  using: "composite"
+  steps:
+  - name: Get yarn cache directory path
+    shell: bash
+    id: yarn-cache-dir-path
+    run: echo "dir=$(node src/electron/script/yarn.js config get cacheFolder)" >> $GITHUB_OUTPUT
+  - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    id: yarn-cache
+    with:
+      path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+      key: ${{ runner.os }}-yarn-${{ hashFiles('src/electron/yarn.lock') }}
+      restore-keys: |
+        ${{ runner.os }}-yarn-
+  - name: Install Dependencies
+    shell: bash
+    run: |
+      cd src/electron
+      if [ "$TARGET_ARCH" = "x86" ]; then
+        export npm_config_arch="ia32"
+      fi
+      # if running on linux arm skip yarn Builds
+      ARCH=$(uname -m)
+      if [ "$ARCH" = "armv7l" ]; then
+        echo "Skipping yarn build on linux arm"
+        node script/yarn.js install --immutable --mode=skip-build
+      else
+        node script/yarn.js install --immutable
+      fi

.github/actions/restore-cache-aks/action.yml

@@ -0,0 +1,49 @@
+name: 'Restore Cache AKS'
+description: 'Restores Electron src cache via AKS'
+inputs:
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'
+runs:
+  using: "composite"
+  steps:
+  - name: Restore and Ensure Src Cache
+    shell: bash
+    run: |
+      if [ "${{ inputs.target-platform }}" = "win" ]; then
+        cache_path=/mnt/win-cache/$DEPSHASH.tar
+      else
+        cache_path=/mnt/cross-instance-cache/$DEPSHASH.tar
+      fi
+
+      echo "Using cache key: $DEPSHASH"
+      echo "Checking for cache in: $cache_path"
+      if [ ! -f "$cache_path" ]; then
+        echo "Cache Does Not Exist for $DEPSHASH - exiting"
+        exit 1
+      else
+        echo "Found Cache for $DEPSHASH at $cache_path"
+      fi
+
+      echo "Persisted cache is $(du -sh $cache_path | cut -f1)"
+      if [ `du  $cache_path | cut -f1` = "0" ]; then
+        echo "Cache is empty - exiting"
+        exit 1
+      fi
+
+      mkdir temp-cache
+      tar -xf $cache_path -C temp-cache
+      echo "Unzipped cache is $(du -sh temp-cache/src | cut -f1)"
+
+      if [ -d "temp-cache/src" ]; then
+        echo "Relocating Cache"
+        rm -rf src
+        mv temp-cache/src src
+      fi
+
+      if [ ! -d "src/third_party/blink" ]; then
+        echo "Cache was not correctly restored - exiting"
+        exit 1
+      fi
+
+      echo "Wiping Electron Directory"
+      rm -rf src/electron

.github/actions/restore-cache-azcopy/action.yml

@@ -0,0 +1,125 @@
+name: 'Restore Cache AZCopy'
+description: 'Restores Electron src cache via AZCopy'
+inputs:
+  target-platform:
+    description: 'Target platform, should be linux, win, macos'
+runs:
+  using: "composite"
+  steps:
+  - name: Obtain SAS Key
+    continue-on-error: true
+    uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    with:
+      path: sas-token
+      key: sas-key-${{ inputs.target-platform }}-${{ github.run_number }}-1
+      enableCrossOsArchive: true
+  - name: Obtain SAS Key
+    continue-on-error: true
+    uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    with:
+      path: sas-token
+      key: sas-key-${{ inputs.target-platform }}-${{ github.run_number }}-${{ github.run_attempt }}
+      enableCrossOsArchive: true
+  - name: Download Src Cache from AKS
+    # The cache will always exist here as a result of the checkout job
+    # Either it was uploaded to Azure in the checkout job for this commit
+    # or it was uploaded in the checkout job for a previous commit.
+    uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+    with:
+      timeout_minutes: 30
+      max_attempts: 3
+      retry_on: error
+      shell: bash
+      command: |
+        sas_token=$(cat sas-token)
+        if [ -z "$sas_token" ]; then
+          echo "SAS Token not found; exiting src cache download early..."
+          exit 1
+        else
+          sas_token=$(jq -r '.sasToken' sas-token)
+          account_name=$(jq -r '.accountName' sas-token)
+          if [ "${{ inputs.target-platform }}" = "win" ]; then
+            azcopy copy --log-level=ERROR \
+            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_WIN_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+          else
+            azcopy copy --log-level=ERROR \
+            "https://$account_name.file.core.windows.net/${{ env.AZURE_AKS_CACHE_SHARE_NAME }}/${{ env.CACHE_PATH }}?$sas_token" $DEPSHASH.tar
+          fi            
+        fi
+    env:
+      AZURE_AKS_CACHE_SHARE_NAME: linux-cache
+      AZURE_AKS_WIN_CACHE_SHARE_NAME: windows-cache
+  - name: Clean SAS Key
+    shell: bash
+    run: rm -f sas-token
+  - name: Unzip and Ensure Src Cache
+    if: ${{ inputs.target-platform == 'macos' }}
+    shell: bash
+    run: |
+      echo "Downloaded cache is $(du -sh $DEPSHASH.tar | cut -f1)"
+      if [ `du $DEPSHASH.tar | cut -f1` = "0" ]; then
+        echo "Cache is empty - exiting"
+        exit 1
+      fi
+      
+      mkdir temp-cache
+      tar -xf $DEPSHASH.tar -C temp-cache
+      echo "Unzipped cache is $(du -sh temp-cache/src | cut -f1)"
+
+      if [ -d "temp-cache/src" ]; then
+        echo "Relocating Cache"
+        rm -rf src
+        mv temp-cache/src src
+
+        echo "Deleting zip file"
+        rm -rf $DEPSHASH.tar
+      fi
+
+      if [ ! -d "src/third_party/blink" ]; then
+        echo "Cache was not correctly restored - exiting"
+        exit 1
+      fi
+
+      echo "Wiping Electron Directory"
+      rm -rf src/electron
+
+  - name: Unzip and Ensure Src Cache (Windows)
+    if: ${{ inputs.target-platform == 'win' }}
+    shell: powershell
+    run: |
+      $src_cache = "$env:DEPSHASH.tar"
+      $cache_size = $(Get-Item $src_cache).length
+      Write-Host "Downloaded cache is $cache_size"
+      if ($cache_size -eq 0) {
+        Write-Host "Cache is empty - exiting"
+        exit 1
+      }
+
+      $TEMP_DIR=New-Item -ItemType Directory -Path temp-cache
+      $TEMP_DIR_PATH = $TEMP_DIR.FullName
+      C:\ProgramData\Chocolatey\bin\7z.exe -y -snld20 x $src_cache -o"$TEMP_DIR_PATH"
+
+  - name: Move Src Cache (Windows)
+    if: ${{ inputs.target-platform == 'win' }}
+    uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+    with:
+      timeout_minutes: 30
+      max_attempts: 3
+      retry_on: error
+      shell: powershell  
+      command: |
+        if (Test-Path "temp-cache\src") {
+          Write-Host "Relocating Cache"
+          Remove-Item -Recurse -Force src
+          Move-Item temp-cache\src src
+
+          Write-Host "Deleting zip file"
+          Remove-Item -Force $src_cache
+        }
+        if (-Not (Test-Path "src\third_party\blink")) {
+          Write-Host "Cache was not correctly restored - exiting"
+          exit 1
+        }
+
+        Write-Host "Wiping Electron Directory"
+        Remove-Item -Recurse -Force src\electron

.github/actions/set-chromium-cookie/action.yml

@@ -0,0 +1,58 @@
+name: 'Set Chromium Git Cookie'
+description: 'Sets an authenticated cookie from Chromium to allow for a higher request limit'
+runs:
+  using: "composite"
+  steps:
+  - name: Set the git cookie from chromium.googlesource.com (Unix)
+    if: ${{ runner.os != 'Windows' }}
+    shell: bash
+    run: |
+      if [[ -z "${{ env.CHROMIUM_GIT_COOKIE }}" ]]; then
+        echo "CHROMIUM_GIT_COOKIE is not set - cannot authenticate."
+        exit 0
+      fi
+
+      eval 'set +o history' 2>/dev/null || setopt HIST_IGNORE_SPACE 2>/dev/null
+      touch ~/.gitcookies
+      chmod 0600 ~/.gitcookies
+
+      git config --global http.cookiefile ~/.gitcookies
+
+      tr , \\t <<\__END__ >>~/.gitcookies
+      ${{ env.CHROMIUM_GIT_COOKIE }}
+      __END__
+      eval 'set -o history' 2>/dev/null || unsetopt HIST_IGNORE_SPACE 2>/dev/null
+
+      RESPONSE=$(curl -s -b ~/.gitcookies https://chromium-review.googlesource.com/a/accounts/self)
+      if [[ $RESPONSE == ")]}'"* ]]; then
+        # Extract account email for verification
+        EMAIL=$(echo "$RESPONSE" | tail -c +5 | jq -r '.email // "No email found"')
+        echo "Cookie authentication successful - authenticated as: $EMAIL"
+      else
+        echo "Cookie authentication failed - ensure CHROMIUM_GIT_COOKIE is set correctly"
+        echo $RESPONSE
+      fi
+  - name: Set the git cookie from chromium.googlesource.com (Windows)
+    if: ${{ runner.os == 'Windows' }}
+    shell: cmd
+    run: |
+      if "%CHROMIUM_GIT_COOKIE_WINDOWS_STRING%"=="" (
+        echo CHROMIUM_GIT_COOKIE_WINDOWS_STRING is not set - cannot authenticate.
+        exit /b 0
+      )
+
+      git config --global http.cookiefile "%USERPROFILE%\.gitcookies"
+      powershell -noprofile -nologo -command Write-Output "${{ env.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}" >>"%USERPROFILE%\.gitcookies"
+
+      curl -s -b "%USERPROFILE%\.gitcookies" https://chromium-review.googlesource.com/a/accounts/self > response.txt
+
+      findstr /B /C:")]}'" response.txt > nul
+      if %ERRORLEVEL% EQU 0 (
+        echo Cookie authentication successful
+        powershell -NoProfile -Command "& {$content = Get-Content -Raw response.txt; $content = $content.Substring(4); try { $json = ConvertFrom-Json $content; if($json.email) { Write-Host 'Authenticated as:' $json.email } else { Write-Host 'No email found in response' } } catch { Write-Host 'Error parsing JSON:' $_ }}"
+      ) else (
+        echo Cookie authentication failed - ensure CHROMIUM_GIT_COOKIE_WINDOWS_STRING is set correctly
+        type response.txt
+      )
+
+      del response.txt

.github/actions/ssh-debug/action.yml

@@ -0,0 +1,20 @@
+name: Debug via SSH
+description: Setup a SSH server with a tunnel to access it to debug via SSH.
+inputs:
+  tunnel:
+    description: 'Enable SSH tunneling via cloudflared'
+    required: true
+    default: 'false'
+  timeout:
+    description: 'SSH session timeout in seconds'
+    required: false
+    type: number
+    default: 3600
+runs:
+  using: composite
+  steps:
+    - run: $GITHUB_ACTION_PATH/setup-ssh.sh
+      shell: bash
+      env:
+        TUNNEL: ${{ inputs.tunnel }}
+        TIMEOUT: ${{ inputs.timeout }}

.github/actions/ssh-debug/bashrc

@@ -0,0 +1,4 @@
+# If we're in an interactive SSH session and we're not already in tmux and there's no explicit SSH command, auto attach tmux
+if [ -n "$SSH_TTY" ] && [ -z "$TMUX" ] && [ -z "$SSH_ORIGINAL_COMMAND" ]; then
+    exec tmux attach || exec tmux
+fi

.github/actions/ssh-debug/setup-ssh.sh

@@ -0,0 +1,146 @@
+#!/bin/bash -e
+
+if [ "${TUNNEL}" != "true" ]; then
+    echo "SSH tunneling is disabled. Set enable-tunnel: true to enable remote access."
+    echo "Local SSH server would be available on localhost:2222 if this were a local environment."
+    exit 0
+fi
+
+echo ::group::Configuring Tunnel
+
+echo "SSH tunneling enabled. Setting up remote access..."
+
+EXTERNAL_DEPS="curl jq ssh-keygen"
+
+for dep in $EXTERNAL_DEPS; do
+    if ! command -v "${dep}" > /dev/null 2>&1; then
+       echo "Command ${dep} not installed on the system!" >&2
+       exit 1
+    fi
+done
+
+cd "$GITHUB_ACTION_PATH"
+
+bashrc_path=$(pwd)/bashrc
+
+# Source `bashrc` to auto start tmux on SSH login.
+if ! grep -q "${bashrc_path}" ~/.bash_profile; then
+    echo >> ~/.bash_profile # On macOS runner there's no newline at the end of the file
+    echo "source \"${bashrc_path}\"" >> ~/.bash_profile
+fi
+
+OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+ARCH=$(uname -m)
+
+if [ "${ARCH}" = "x86_64" ]; then
+    ARCH="amd64"
+elif [ "${ARCH}" = "aarch64" ]; then
+    ARCH="arm64"
+fi
+
+if [ "${OS}" = "darwin" ] && ! command -v tmux > /dev/null 2>&1; then
+    echo "Installing tmux..."
+    brew install tmux
+fi
+
+if [ "$OS" = "darwin" ]; then
+    cloudflared_url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${OS}-${ARCH}.tgz"
+    echo "Downloading \`cloudflared\` from <$cloudflared_url>..."
+    curl --location --silent --output cloudflared.tgz "${cloudflared_url}"
+    tar xf cloudflared.tgz
+    rm cloudflared.tgz
+fi
+
+chmod +x cloudflared
+
+echo 'Creating SSH server key...'
+ssh-keygen -q -f ssh_host_rsa_key -N ''
+
+echo 'Creating SSH server config...'
+sed "s,\$PWD,${PWD},;s,\$USER,${USER}," sshd_config.template > sshd_config
+
+echo 'Starting SSH server...'
+sudo /usr/sbin/sshd -f sshd_config -D &
+sshd_pid=$!
+
+echo "SSH server started successfully (PID: ${sshd_pid})"
+
+echo 'Starting tmux session...'
+(cd "${GITHUB_WORKSPACE}" && tmux new-session -d -s debug)
+
+mkdir ~/.cloudflared
+CLEAN_TUNNEL_CERT=$(printf '%s\n' "${CLOUDFLARE_TUNNEL_CERT}" | tr -d '\r' | sed '/^[[:space:]]*$/d')
+
+echo "${CLEAN_TUNNEL_CERT}" > ~/.cloudflared/cert.pem
+
+CLEAN_USER_CA_CERT=$(printf '%s\n' "${CLOUDFLARE_USER_CA_CERT}" | tr -d '\r' | sed '/^[[:space:]]*$/d')
+
+echo "${CLEAN_USER_CA_CERT}" | sudo tee /etc/ssh/ca.pub > /dev/null
+sudo chmod 644 /etc/ssh/ca.pub
+
+random_suffix=$(openssl rand -hex 5 | cut -c1-10)
+tunnel_name="${GITHUB_SHA}-${GITHUB_RUN_ID}-${random_suffix}"
+tunnel_url="${tunnel_name}.${CLOUDFLARE_TUNNEL_HOSTNAME}"
+
+if ./cloudflared tunnel list | grep -q "${tunnel_name}"; then
+    echo "Deleting existing tunnel: ${tunnel_name}"
+    ./cloudflared tunnel delete ${tunnel_name}
+fi
+
+echo "Creating new cloudflare tunnel: ${tunnel_name}"
+./cloudflared tunnel create ${tunnel_name}
+
+credentials_file=$(find ~/.cloudflared -name "*.json" | head -n 1)
+if [ -z "${credentials_file}" ]; then
+    echo "Error: Could not find tunnel credentials file"
+    exit 1
+fi
+
+echo "Found credentials file: ${credentials_file}"
+
+echo 'Creating tunnel configuration...'
+cat > tunnel_config.yml << EOF
+tunnel: ${tunnel_name}
+credentials-file: ${credentials_file}
+
+ingress:
+  - hostname: ${tunnel_url}
+    service: ssh://localhost:2222
+  - service: http_status:404
+EOF
+
+echo 'Setting up DNS routing for tunnel...'
+./cloudflared tunnel route dns ${tunnel_name} ${tunnel_url}
+
+echo 'Running cloudflare tunnel...'
+./cloudflared tunnel --no-autoupdate --config tunnel_config.yml run 2>&1 | tee cloudflared.log | sed -u 's/^/cloudflared: /' &
+cloudflared_pid=$!
+
+echo ::endgroup::
+
+echo ::notice title=SSH Debug Session Ready::ssh ${tunnel_url}
+
+
+(
+    echo '    '
+    echo '    '
+    echo '🔗 SSH Debug Session Ready!'
+    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+    echo '    '
+    echo '📋 Infra WG can copy and run this command to connect:'
+    echo '    '
+    echo "ssh ${tunnel_url}"
+    echo '    '
+    echo "⏰ Session expires automatically in ${TIMEOUT} seconds"
+    echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+    echo '    '
+    echo '    '
+) | cat
+
+echo ::group::Starting Background Session
+echo 'Starting SSH session in background...'
+./ssh-session.sh "${sshd_pid}" "${cloudflared_pid}" "${TIMEOUT}" "${tunnel_name}" &
+
+echo 'SSH session is running in background. GitHub Action will continue.'
+echo 'Session will auto-cleanup after timeout or when processes end.'
+echo ::endgroup::

.github/actions/ssh-debug/ssh-session.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+SSHD_PID=$1
+CLOUDFLARED_PID=$2
+SESSION_TIMEOUT=${3:-10000}
+TUNNEL_NAME=$4
+
+cleanup() {
+    # Kill processes.
+    for pid in "$SLEEP_PID" "$SSHD_PID" "$CLOUDFLARED_PID"; do
+        if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+            kill "$pid" 2>/dev/null || true
+        fi
+    done
+
+    # Clean up tunnel.
+    if [ -n "$TUNNEL_NAME" ]; then
+        cd "$GITHUB_ACTION_PATH"
+        ./cloudflared tunnel delete "$TUNNEL_NAME" 2>/dev/null || {
+            echo "Failed to delete tunnel"
+        }
+    fi
+
+    echo "Session ended at $(date)"
+    exit 0
+}
+
+# Trap signals to ensure cleanup.
+trap cleanup SIGTERM SIGINT SIGQUIT SIGHUP EXIT
+
+# Wait for timeout or until processes die.
+sleep "$SESSION_TIMEOUT" &
+SLEEP_PID=$!
+
+# Monitor processes
+while kill -0 "$SLEEP_PID" 2>/dev/null; do
+    # Check SSH daemon.
+    if ! kill -0 "$SSHD_PID" 2>/dev/null; then
+        echo "SSH daemon died at $(date)"
+        break
+    fi
+
+    # Check cloudflared,
+    if ! kill -0 "$CLOUDFLARED_PID" 2>/dev/null; then
+        echo "Cloudflared died at $(date)"
+        break
+    fi
+
+    sleep 10
+done
+
+cleanup

.github/actions/ssh-debug/sshd_config.template

@@ -0,0 +1,25 @@
+Port 2222
+HostKey $PWD/ssh_host_rsa_key
+PidFile $PWD/sshd.pid
+
+# Connection settings
+ClientAliveInterval 30
+ClientAliveCountMax 10
+MaxStartups 10
+LoginGraceTime 120
+
+# Allow TCP forwarding for tunneling
+AllowTcpForwarding yes
+
+# Try to prevent timeouts
+TCPKeepAlive yes
+
+# Security
+TrustedUserCAKeys /etc/ssh/ca.pub
+PubkeyAuthentication yes
+PasswordAuthentication no
+
+AuthorizedPrincipalsCommand /bin/bash -c "echo '%t %k' | ssh-keygen -L -f - | grep -A1 Principals"
+AuthorizedPrincipalsCommandUser nobody
+
+PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com

.github/config.yml

@@ -2,7 +2,9 @@
 newPRWelcomeComment: |
   💖 Thanks for opening this pull request! 💖
 
-  We use [semantic commit messages](https://github.com/electron/electron/blob/master/docs/development/pull-requests.md#commit-message-guidelines) to streamline the release process. Before your pull request can be merged, you should **update your pull request title** to start with a semantic prefix.
+  ### Semantic PR titles
+
+  We use [semantic commit messages](https://github.com/electron/electron/blob/main/docs/development/pull-requests.md#commit-message-guidelines) to streamline the release process. Before your pull request can be merged, you should **update your pull request title** to start with a semantic prefix.
 
   Examples of commit messages with semantic prefixes:
 
@@ -10,11 +12,18 @@ newPRWelcomeComment: |
   - `feat: add app.isPackaged() method`
   - `docs: app.isDefaultProtocolClient is now available on Linux`
 
+  ### Commit signing
+
+  This repo enforces [commit signatures](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits) for all incoming PRs.
+  To sign your commits, see GitHub's documentation on [Telling Git about your signing key](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key).
+  
+  ### PR tips
+
   Things that will help get your PR across the finish line:
 
-  - Follow the JavaScript, C++, and Python [coding style](https://github.com/electron/electron/blob/master/docs/development/coding-style.md).
+  - Follow the JavaScript, C++, and Python [coding style](https://github.com/electron/electron/blob/main/docs/development/coding-style.md).
   - Run `npm run lint` locally to catch formatting errors earlier.
-  - Document any user-facing changes you've made following the [documentation styleguide](https://github.com/electron/electron/blob/master/docs/styleguide.md).
+  - Document any user-facing changes you've made following the [documentation styleguide](https://github.com/electron/electron/blob/main/docs/styleguide.md).
   - Include tests when adding/changing behavior.
   - Include screenshots and animated GIFs whenever possible.
 
@@ -25,17 +34,3 @@ newPRWelcomeComment: |
 # Comment to be posted to on pull requests merged by a first time user
 firstPRMergeComment: >
   Congrats on merging your first pull request! 🎉🎉🎉
-
-# Users authorized to run manual trop backports
-authorizedUsers:
-  - alexeykuzmin
-  - BinaryMuse
-  - ckerr
-  - codebytere
-  - deepak1556
-  - jkleinsc
-  - MarshallOfSound
-  - miniak
-  - nitsakh
-  - nornagon
-  - zcbenz

.github/dependabot.yml

@@ -0,0 +1,68 @@
+# Keep GitHub Actions up to date with GitHub's Dependabot...
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - "no-backport"
+      - "semver/none"
+    target-branch: main
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /spec
+      - /npm
+    schedule:
+      interval: daily
+    labels:
+      - "no-backport"
+    open-pull-requests-limit: 2
+    target-branch: main
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /spec
+      - /npm
+    schedule:
+      interval: daily
+    labels:
+      - "backport-check-skip"
+    open-pull-requests-limit: 0
+    target-branch: 33-x-y
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /spec
+      - /npm
+    schedule:
+      interval: daily
+    labels:
+      - "backport-check-skip"
+    open-pull-requests-limit: 0
+    target-branch: 32-x-y
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /spec
+      - /npm
+    schedule:
+      interval: daily
+    labels:
+      - "backport-check-skip"
+    open-pull-requests-limit: 0
+    target-branch: 31-x-y
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /spec
+      - /npm
+    schedule:
+      interval: daily
+    labels:
+      - "backport-check-skip"
+    open-pull-requests-limit: 0
+    target-branch: 30-x-y

.github/problem-matchers/clang.json

@@ -0,0 +1,18 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "clang",
+      "fromPath": "src/out/Default/args.gn",
+      "pattern": [
+        {
+          "regexp": "^(.+)[(:](\\d+)[:,](\\d+)\\)?:\\s+(warning|error):\\s+(.*)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "severity": 4,
+          "message": 5
+        }
+      ]
+    }
+  ]
+}

.github/problem-matchers/eslint-stylish.json

@@ -0,0 +1,22 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "eslint-stylish",
+      "pattern": [
+        {
+          "regexp": "^\\s*([^\\s].*)$",
+          "file": 1
+        },
+        {
+          "regexp": "^\\s+(\\d+):(\\d+)\\s+(error|warning|info)\\s+(.*)\\s\\s+(.*)$",
+          "line": 1,
+          "column": 2,
+          "severity": 3,
+          "message": 4,
+          "code": 5,
+          "loop": true
+        }
+      ]
+    }
+  ]
+}

.github/problem-matchers/patch-conflict.json

@@ -0,0 +1,34 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "merge-conflict",
+      "pattern": [
+        {
+          "regexp": "^CONFLICT\\s\\(\\S+\\): (Merge conflict in \\S+)$",
+          "message": 1
+        }
+      ]
+    },
+    {
+      "owner": "patch-conflict",
+      "pattern": [
+        {
+          "regexp": "^error: (patch failed: (\\S+):(\\d+))$",
+          "message": 1,
+          "file": 2,
+          "line": 3
+        }
+      ]
+    },
+    {
+      "owner": "patch-needs-update",
+      "pattern": [
+        {
+          "regexp": "^((patches\/.*): needs update)$",
+          "message": 1,
+          "file": 2
+        }
+      ]
+    }
+  ]
+}

.github/stale.yml

@@ -1,25 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 45
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-   - fixme/bug
-   - fixme/crash
-   - fixme/regression
-   - fixme/security
-   - blocked
-   - blocking-stable
-   - needs-review
-# Label to use when marking an issue as stale
-staleLabel: stale
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity and is not currently prioritized. It will be closed
-  in a week if no further activity occurs :)
-
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: >
-  If you still think this issue is relevant, please ping a maintainer or
-  leave a comment!

.github/workflows/archaeologist-dig.yml

@@ -0,0 +1,69 @@
+name: Archaeologist
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+   archaeologist-dig:
+    name: Archaeologist Dig
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Electron
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+        with:
+          fetch-depth: 0
+      - name: Setup Node.js/npm
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
+        with:
+          node-version: 24.12.x
+      - name: Setting Up Dig Site
+        run: |
+          echo "remote: ${{ github.event.pull_request.head.repo.clone_url }}"
+          echo "sha ${{ github.event.pull_request.head.sha }}"
+          echo "base ref ${{ github.event.pull_request.base.ref }}"
+          git clone https://github.com/electron/electron.git electron          
+          cd electron
+          mkdir -p artifacts
+          git remote add fork ${{ github.event.pull_request.head.repo.clone_url }} && git fetch fork
+          git checkout  ${{ github.event.pull_request.head.sha }}
+          git merge-base origin/${{ github.event.pull_request.base.ref }} HEAD > .dig-old
+          echo  ${{ github.event.pull_request.head.sha }} > .dig-new
+          cp .dig-old artifacts
+
+      - name: Generating Types for SHA in .dig-new
+        uses: ./.github/actions/generate-types
+        with:
+          sha-file: .dig-new
+          filename: electron.new.d.ts
+      - name: Generating Types for SHA in .dig-old
+        uses: ./.github/actions/generate-types
+        with:
+          sha-file: .dig-old
+          filename: electron.old.d.ts
+      - name: Upload artifacts
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
+        with:
+          name: artifacts
+          path: electron/artifacts
+          include-hidden-files: true
+      - name: Set job output
+        run: |
+          git diff --no-index electron.old.d.ts electron.new.d.ts > patchfile || true
+          if [ -s patchfile ]; then
+            echo "Changes Detected"
+            echo "## Changes Detected" > $GITHUB_STEP_SUMMARY
+            echo "Looks like the \`electron.d.ts\` file changed." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`\`\`\`diff" >> $GITHUB_STEP_SUMMARY
+            cat patchfile >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`\`\`\`" >> $GITHUB_STEP_SUMMARY    
+          else
+            echo "No Changes Detected"
+            echo "## No Changes" > $GITHUB_STEP_SUMMARY
+            echo "We couldn't see any changes in the \`electron.d.ts\` artifact" >> $GITHUB_STEP_SUMMARY
+          fi
+        working-directory: ./electron/artifacts

.github/workflows/audit-branch-ci.yml

@@ -0,0 +1,161 @@
+name: Audit CI on Branches
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run every 2 hours
+    - cron: '0 */2 * * *'
+
+permissions: {}
+
+jobs:
+  audit_branch_ci:
+    name: Audit CI on Branches
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Setup Node.js
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version: 22.17.x
+      - name: Sparse checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .
+            .github
+            .yarn
+      - run: yarn workspaces focus @electron/gha-workflows
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        id: audit-errors
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { chdir } = require('node:process');
+            chdir('${{ github.workspace }}/.github/workflows');
+
+            const cache = require('@actions/cache');
+            const { ElectronVersions } = require('@electron/fiddle-core');
+
+            const runsWithErrors = [];
+
+            // Only want the most recent workflow run that wasn't skipped or cancelled
+            const isValidWorkflowRun = (run) => !['skipped', 'cancelled'].includes(run.conclusion);
+
+            const versions = await ElectronVersions.create({ ignoreCache: true });
+            const branches = versions.supportedMajors.map((branch) => `${branch}-x-y`);
+
+            for (const branch of ["main", ...branches]) {
+              const latestCheckRuns = new Map();
+              const allCheckRuns = await github.paginate(github.rest.checks.listForRef, {
+                owner: "electron",
+                repo: "electron",
+                ref: branch,
+                status: 'completed',
+              });
+
+              // Sort the check runs by completed_at so that multiple check runs on the
+              // same ref (like a scheduled workflow) only looks at the most recent one
+              for (const checkRun of allCheckRuns.filter(
+                (run) => !['skipped', 'cancelled'].includes(run.conclusion),
+              ).sort((a, b) => new Date(b.completed_at) - new Date(a.completed_at))) {
+                if (!latestCheckRuns.has(checkRun.name)) {
+                  latestCheckRuns.set(checkRun.name, checkRun);
+                }
+              }
+
+              // Check for runs which had error annotations
+              for (const checkRun of Array.from(latestCheckRuns.values())) {
+                if (checkRun.name === "Audit CI on Branches") {
+                  continue; // Skip the audit workflow itself
+                }
+
+                const annotations = (await github.rest.checks.listAnnotations({
+                  owner: "electron",
+                  repo: "electron",
+                  check_run_id: checkRun.id,
+                })).data ?? [];
+
+                if (
+                  annotations.find(
+                    ({ annotation_level, message }) =>
+                      annotation_level === "failure" &&
+                      !message.startsWith("Process completed with exit code") &&
+                      !message.startsWith("Response status code does not indicate success") &&
+                      !message.startsWith("The hosted runner lost communication with the server") &&
+                      !message.startsWith("Dependabot encountered an error performing the update") &&
+                      !/Unable to make request/.test(message) &&
+                      !/The requested URL returned error/.test(message),
+                  )
+                ) {
+                  checkRun.hasErrorAnnotations = true;
+                } else {
+                  continue;
+                }
+
+                // Check if this is a known failure from a previous audit run
+                const cacheKey = `check-run-error-annotations-${checkRun.id}`;
+                const cacheHit =
+                  (await cache.restoreCache(['/dev/null'], cacheKey, undefined, {
+                    lookupOnly: true,
+                  })) !== undefined;
+
+                if (cacheHit) {
+                  checkRun.isStale = true;
+                }
+
+                checkRun.branch = branch;
+                runsWithErrors.push(checkRun);
+  
+                // Create a cache entry (only the name matters) to keep track of
+                // failures we've seen from previous runs to mark them as stale
+                if (!cacheHit) {
+                  await cache.saveCache(['/dev/null'], cacheKey);
+                }
+              }
+            }
+
+            if (runsWithErrors.length > 0) {
+              core.summary.addHeading('⚠️ Runs with Errors');
+              core.summary.addTable([
+                [
+                  { data: 'Branch', header: true },
+                  { data: 'Workflow Run', header: true },
+                  { data: 'Status', header: true },
+                ],
+                ...runsWithErrors
+                  .sort(
+                    (a, b) =>
+                      a.branch.localeCompare(b.branch) ||
+                      a.name.localeCompare(b.name),
+                  )
+                  .map((run) => [
+                    run.branch,
+                    `<a href="${run.html_url}">${run.name}</a>`,
+                    run.isStale
+                      ? '📅 Stale'
+                      : run.hasErrorAnnotations
+                      ? '⚠️ Errors'
+                      : '✅ Succeeded',
+                  ]),
+              ]);
+
+              // Set this as failed so it's easy to scan runs to find failures
+              if (runsWithErrors.find((run) => !run.isStale)) {
+                core.setOutput('errorsFound', true);
+                process.exitCode = 1;
+              }
+            } else {
+              core.summary.addRaw('🎉 No runs with errors');
+            }
+
+            await core.summary.write();
+      - name: Send Slack message if errors
+        if: ${{ always() && steps.audit-errors.outputs.errorsFound && github.ref == 'refs/heads/main' }}
+        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
+        with:
+          payload: |
+            link: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          webhook: ${{ secrets.CI_ERRORS_SLACK_WEBHOOK_URL }}
+          webhook-type: webhook-trigger

.github/workflows/branch-created.yml

@@ -0,0 +1,128 @@
+name: Branch Created
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch-name:
+        description: Branch name (e.g. `29-x-y`)
+        required: true
+        type: string
+  create:
+
+permissions: {}
+
+jobs:
+  release-branch-created:
+    name: Release Branch Created
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.ref_type == 'branch' && endsWith(github.event.ref, '-x-y') && !startsWith(github.event.ref, 'roller')) }}
+    permissions:
+      contents: read
+      pull-requests: write
+      repository-projects: write  # Required for labels
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine Major Version
+        id: check-major-version
+        env:
+          BRANCH_NAME: ${{ github.event.inputs.branch-name || github.event.ref }}
+        run: |
+          if [[ "$BRANCH_NAME" =~ ^([0-9]+)-x-y$ ]]; then
+            echo "MAJOR=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          else
+            echo "Not a release branch: $BRANCH_NAME"
+          fi
+      - name: New Release Branch Tasks
+        if: ${{ steps.check-major-version.outputs.MAJOR }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: electron/electron
+          MAJOR: ${{ steps.check-major-version.outputs.MAJOR }}
+          NUM_SUPPORTED_VERSIONS: 3
+        run: |
+          PREVIOUS_MAJOR=$((MAJOR - 1))
+          UNSUPPORTED_MAJOR=$((MAJOR - NUM_SUPPORTED_VERSIONS - 1))
+
+          # Create new labels
+          gh label create $MAJOR-x-y --color 8d9ee8 || true
+          gh label create target/$MAJOR-x-y --color ad244f --description "PR should also be added to the \"${MAJOR}-x-y\" branch." || true
+          gh label create merged/$MAJOR-x-y --color 61a3c6 --description "PR was merged to the \"${MAJOR}-x-y\" branch." || true
+          gh label create in-flight/$MAJOR-x-y --color db69a6 || true
+          gh label create needs-manual-bp/$MAJOR-x-y --color 8b5dba || true
+
+          # Change color of old labels
+          gh label edit $UNSUPPORTED_MAJOR-x-y --color ededed || true
+          gh label edit target/$UNSUPPORTED_MAJOR-x-y --color ededed || true
+          gh label edit merged/$UNSUPPORTED_MAJOR-x-y --color ededed || true
+          gh label edit in-flight/$UNSUPPORTED_MAJOR-x-y --color ededed || true
+          gh label edit needs-manual-bp/$UNSUPPORTED_MAJOR-x-y --color ededed || true
+
+          # Add the new target label to any PRs which:
+          #   * target the previous major
+          #   * are in-flight for the previous major
+          #   * need manual backport for the previous major
+          for PREVIOUS_MAJOR_LABEL in target/$PREVIOUS_MAJOR-x-y in-flight/$PREVIOUS_MAJOR-x-y needs-manual-bp/$PREVIOUS_MAJOR-x-y; do
+            PULL_REQUESTS=$(gh pr list --label $PREVIOUS_MAJOR_LABEL --jq .[].number --json number --limit 500)
+            if [[ $PULL_REQUESTS ]]; then
+              echo $PULL_REQUESTS | xargs -n 1 gh pr edit --add-label target/$MAJOR-x-y || true
+            fi
+          done
+      - name: Generate GitHub App token
+        if: ${{ steps.check-major-version.outputs.MAJOR }}
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.RELEASE_BOARD_GH_APP_CREDS }}
+          org: electron
+      - name: Generate Release Project Board Metadata
+        if: ${{ steps.check-major-version.outputs.MAJOR }}
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        id: generate-project-metadata
+        with:
+          script: |
+            const major = ${{ steps.check-major-version.outputs.MAJOR }}
+            const nextMajor = major + 1
+            const prevMajor = major - 1
+
+            core.setOutput("major", major)
+            core.setOutput("next-major", nextMajor)
+            core.setOutput("prev-major", prevMajor)
+            core.setOutput("prev-prev-major", prevMajor - 1)
+            core.setOutput("template-view", JSON.stringify({
+                major,
+                "next-major": nextMajor,
+                "prev-major": prevMajor,
+            }))
+      - name: Create Release Project Board
+        if: ${{ steps.check-major-version.outputs.MAJOR }}
+        uses: dsanders11/project-actions/copy-project@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        id: create-release-board
+        with:
+          drafts: true
+          project-number: 64
+          # TODO - Set to public once GitHub fixes their GraphQL bug
+          # public: true
+          # TODO - Enable once GitHub doesn't require overly broad, read
+          #        and write permission for repo "Contents" to link
+          # link-to-repository: electron/electron
+          template-view: ${{ steps.generate-project-metadata.outputs.template-view }}
+          title: ${{ steps.generate-project-metadata.outputs.major }}-x-y
+          token: ${{ steps.generate-token.outputs.token }}
+      - name: Dump Release Project Board Contents
+        if: ${{ steps.check-major-version.outputs.MAJOR }}
+        run: gh project item-list ${{ steps.create-release-board.outputs.number }} --owner electron --format json | jq
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+      - name: Find Previous Release Project Board
+        if: ${{ steps.check-major-version.outputs.MAJOR }}
+        uses: dsanders11/project-actions/find-project@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        id: find-prev-release-board
+        with:
+          fail-if-project-not-found: false
+          title: ${{ steps.generate-project-metadata.outputs.prev-prev-major }}-x-y
+          token: ${{ steps.generate-token.outputs.token }}
+      - name: Close Previous Release Project Board
+        if: ${{ steps.find-prev-release-board.outputs.number }}
+        uses: dsanders11/project-actions/close-project@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          project-number: ${{ steps.find-prev-release-board.outputs.number }}
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/build-git-cache.yml

@@ -0,0 +1,82 @@
+name: Build Git Cache
+# This workflow updates git cache on the cross-instance cache volumes
+# It runs daily at midnight.
+
+on:  
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions: {}
+
+jobs:
+  build-git-cache-linux:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}      
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Build Git Cache
+      uses: ./src/electron/.github/actions/build-git-cache
+      with:
+        target-platform: linux
+
+  build-git-cache-windows:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
+      options: --user root --device /dev/fuse --cap-add SYS_ADMIN
+      volumes:
+        - /mnt/win-cache:/mnt/win-cache
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_win=True'
+      TARGET_OS: 'win'
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Build Git Cache
+      uses: ./src/electron/.github/actions/build-git-cache
+      with:
+        target-platform: win
+
+  build-git-cache-macos:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    # This job updates the same git cache as linux, so it needs to run after the linux one.
+    needs: build-git-cache-linux
+    container:
+      image: ghcr.io/electron/build:a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Build Git Cache
+      uses: ./src/electron/.github/actions/build-git-cache
+      with:
+        target-platform: macos

.github/workflows/build.yml

@@ -0,0 +1,436 @@
+name: Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-image-sha:
+        type: string
+        description: 'SHA for electron/build image'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
+        required: true
+      skip-macos:
+        type: boolean
+        description: 'Skip macOS builds'
+        default: true
+        required: false
+      skip-linux:
+        type: boolean
+        description: 'Skip Linux builds'
+        default: true
+        required: false
+      skip-windows:
+        type: boolean
+        description: 'Skip Windows builds'
+        default: false
+        required: false
+      skip-lint:
+        type: boolean
+        description: 'Skip lint check'
+        default: false
+        required: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
+  push:
+    branches:
+      - main
+      - '[1-9][0-9]-x-y'
+  pull_request:
+
+defaults:
+  run:
+    shell: bash
+
+permissions: {}
+
+jobs:
+  setup:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+        docs: ${{ steps.filter.outputs.docs }}
+        src: ${{ steps.filter.outputs.src }}
+        build-image-sha: ${{ steps.set-output.outputs.build-image-sha }}
+        docs-only: ${{ steps.set-output.outputs.docs-only }}
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      id: filter
+      with:
+        filters: |
+          docs:
+            - 'docs/**'
+            - README.md
+            - SECURITY.md
+            - CONTRIBUTING.md
+            - CODE_OF_CONDUCT.md
+          src:
+            - '!docs/**'
+    - name: Set Outputs for Build Image SHA & Docs Only
+      id: set-output
+      run: |
+        if [ -z "${{ inputs.build-image-sha }}" ]; then
+          echo "build-image-sha=a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb" >> "$GITHUB_OUTPUT"
+        else
+          echo "build-image-sha=${{ inputs.build-image-sha }}" >> "$GITHUB_OUTPUT"
+        fi
+        echo "docs-only=${{ steps.filter.outputs.docs == 'true' && steps.filter.outputs.src == 'false' }}" >> "$GITHUB_OUTPUT"
+
+  # Lint Jobs
+  lint:
+    needs: setup
+    if: ${{ !inputs.skip-lint }}
+    uses: ./.github/workflows/pipeline-electron-lint.yml
+    permissions:
+      contents: read
+    with:
+      container: '{"image":"ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}","options":"--user root"}'
+    secrets: inherit
+
+  # Docs Only Jobs
+  docs-only:
+    needs: [setup, checkout-linux]
+    if: ${{ needs.setup.outputs.docs-only == 'true' }}
+    uses: ./.github/workflows/pipeline-electron-docs-only.yml
+    permissions:
+      contents: read
+    with:
+      container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+    secrets: inherit
+
+  # Checkout Jobs
+  checkout-macos:
+    needs: setup
+    if: ${{ needs.setup.outputs.src == 'true' && inputs.skip-macos == 'false'}}
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
+    outputs:
+      build-image-sha: ${{ needs.setup.outputs.build-image-sha }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        generate-sas-token: 'true'
+        target-platform: macos
+
+  checkout-linux:
+    needs: setup
+    if: ${{ inputs.skip-linux == 'false' }}
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      DD_API_KEY: ${{ secrets.DD_API_KEY }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
+      PATCH_UP_APP_CREDS: ${{ secrets.PATCH_UP_APP_CREDS }}
+    outputs:
+      build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        target-platform: linux
+
+  checkout-windows:
+    needs: setup
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:${{ needs.setup.outputs.build-image-sha }}
+      options: --user root --device /dev/fuse --cap-add SYS_ADMIN
+      volumes:
+        - /mnt/win-cache:/mnt/win-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_win=True'
+      TARGET_OS: 'win'
+      ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN: '1'
+    outputs:
+      build-image-sha: ${{ needs.setup.outputs.build-image-sha}}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        generate-sas-token: 'true'
+        target-platform: win
+
+  # GN Check Jobs
+  macos-gn-check:
+    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
+    needs: checkout-macos
+    with:
+      target-platform: macos
+      target-archs: x64 arm64
+      check-runs-on: macos-15
+      gn-build-type: testing
+    secrets: inherit
+
+  linux-gn-check:
+    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
+    needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
+    with:
+      target-platform: linux
+      target-archs: x64 arm arm64
+      check-runs-on: electron-arc-centralus-linux-amd64-8core
+      check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      gn-build-type: testing
+    secrets: inherit
+
+  windows-gn-check:
+    uses: ./.github/workflows/pipeline-segment-electron-gn-check.yml
+    permissions:
+      contents: read
+    needs: checkout-windows
+    with:
+      target-platform: win
+      target-archs: x64 x86 arm64
+      check-runs-on: electron-arc-centralus-linux-amd64-8core
+      check-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
+      gn-build-type: testing
+    secrets: inherit
+
+  # Build Jobs - These cascade into testing jobs
+  macos-x64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-macos
+    with:
+      build-runs-on: macos-15-xlarge
+      test-runs-on: macos-15-large
+      target-platform: macos
+      target-arch: x64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+      enable-ssh: ${{ inputs.enable-ssh || false }}
+    secrets: inherit
+  
+  macos-arm64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-macos
+    with:
+      build-runs-on: macos-15-xlarge
+      test-runs-on: macos-15
+      target-platform: macos
+      target-arch: arm64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+      enable-ssh: ${{ inputs.enable-ssh || false }}
+    secrets: inherit
+
+  linux-x64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test-and-nan.yml
+    needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-amd64-4core
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
+      target-platform: linux
+      target-arch: x64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  linux-x64-asan:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-amd64-4core
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      test-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
+      target-platform: linux
+      target-arch: x64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+      is-asan: true
+    secrets: inherit
+  
+  linux-arm:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: electron-arc-centralus-linux-arm64-4core
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      test-container: '{"image":"ghcr.io/electron/test:arm32v7-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init --memory=12g","volumes":["/home/runner/externals:/mnt/runner-externals"]}'
+      target-platform: linux
+      target-arch: arm
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+  
+  linux-arm64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-linux
+    if: ${{ needs.setup.outputs.src == 'true' }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: ubuntu-22.04-arm
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      test-container: '{"image":"ghcr.io/electron/test:arm64v8-${{ needs.checkout-linux.outputs.build-image-sha }}","options":"--user root --privileged --init"}'
+      target-platform: linux
+      target-arch: arm64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  windows-x64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-windows
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: windows-latest
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
+      target-platform: win
+      target-arch: x64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  windows-x86:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-windows
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: windows-latest
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
+      target-platform: win
+      target-arch: x86
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  windows-arm64:
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    uses: ./.github/workflows/pipeline-electron-build-and-test.yml
+    needs: checkout-windows
+    if: ${{ needs.setup.outputs.src == 'true' && !inputs.skip-windows }}
+    with:
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      test-runs-on: windows-11-arm
+      build-container: '{"image":"ghcr.io/electron/build:${{ needs.checkout-windows.outputs.build-image-sha }}","options":"--user root --device /dev/fuse --cap-add SYS_ADMIN","volumes":["/mnt/win-cache:/mnt/win-cache"]}'
+      target-platform: win
+      target-arch: arm64
+      is-release: false
+      gn-build-type: testing
+      generate-symbols: false
+      upload-to-storage: '0'
+    secrets: inherit
+
+  gha-done:
+    name: GitHub Actions Completed
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: [docs-only, macos-x64, macos-arm64, linux-x64, linux-x64-asan, linux-arm, linux-arm64, windows-x64, windows-x86, windows-arm64]
+    if: always() && !contains(needs.*.result, 'failure')
+    steps: 
+    - name: GitHub Actions Jobs Done
+      run: |
+        echo "All GitHub Actions Jobs are done"

.github/workflows/clean-src-cache.yml

@@ -0,0 +1,33 @@
+name: Clean Source Cache
+
+# Description:
+# This workflow cleans up the source cache on the cross-instance cache volume
+# to free up space. It runs daily at midnight and clears files older than 15 days.
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions: {}
+
+jobs:
+  clean-src-cache:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:bc2f48b2415a670de18d13605b1cf0eb5fdbaae1
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+        - /mnt/win-cache:/mnt/win-cache
+    steps:
+    - name: Cleanup Source Cache
+      shell: bash
+      run: |
+        df -h /mnt/cross-instance-cache
+        find /mnt/cross-instance-cache -type f -mtime +15 -delete
+        df -h /mnt/cross-instance-cache
+        df -h /mnt/win-cache
+        find /mnt/win-cache -type f -mtime +15 -delete
+        df -h /mnt/win-cache

.github/workflows/issue-commented.yml

@@ -0,0 +1,35 @@
+name: Issue Commented
+
+on:
+  issue_comment:
+    types:
+      - created
+
+permissions: {}
+
+jobs:
+  issue-commented:
+    name: Remove blocked/{need-info,need-repro} on comment
+    if: ${{ (contains(github.event.issue.labels.*.name, 'blocked/need-repro') || contains(github.event.issue.labels.*.name, 'blocked/need-info ❌')) && github.event.comment.user.type != 'Bot' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get author association
+        id: get-author-association
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          AUTHOR_ASSOCIATION=$(gh api /repos/electron/electron/issues/comments/${{ github.event.comment.id }} --jq '.author_association')
+          echo "author_association=$AUTHOR_ASSOCIATION" >> "$GITHUB_OUTPUT"
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        if: ${{ !contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), steps.get-author-association.outputs.author_association) }}
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+      - name: Remove label
+        if: ${{ !contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), steps.get-author-association.outputs.author_association) }}
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+          ISSUE_URL: ${{ github.event.issue.html_url }}
+        run: |
+          gh issue edit $ISSUE_URL --remove-label 'blocked/need-repro','blocked/need-info ❌'

.github/workflows/issue-labeled.yml

@@ -0,0 +1,91 @@
+name: Issue Labeled
+
+on:
+  issues:
+    types: [labeled]
+
+permissions: {}
+
+jobs:
+  issue-labeled-with-status:
+    name: status/{confirmed,reviewed} label added
+    if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+          org: electron
+      - name: Set status
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          project-number: 90
+          field: Status
+          field-value: ✅ Triaged
+          fail-if-item-not-found: false
+  issue-labeled-blocked:
+    name: blocked/* label added
+    if: startsWith(github.event.label.name, 'blocked/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+          org: electron
+      - name: Set status
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          project-number: 90
+          field: Status
+          field-value: 🛑 Blocked
+          fail-if-item-not-found: false
+  issue-labeled-blocked-need-repro:
+    name: blocked/need-repro label added
+    if: github.event.label.name == 'blocked/need-repro'
+    permissions:
+      issues: write  # for actions-cool/issues-helper to update issues
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if comment needed
+        id: check-for-comment
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: electron/electron
+        run: |
+          set -eo pipefail
+          COMMENT_COUNT=$(gh issue view ${{ github.event.issue.number }} --comments --json comments | jq '[ .comments[] | select(.author.login == "electron-issue-triage" or .authorAssociation == "OWNER" or .authorAssociation == "MEMBER") | select(.body | startswith("<!-- blocked/need-repro -->")) ] | length')
+          if [[ $COMMENT_COUNT -eq 0 ]]; then
+            echo "SHOULD_COMMENT=1" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Generate GitHub App token
+        if: ${{ steps.check-for-comment.outputs.SHOULD_COMMENT }}
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+      - name: Create comment
+        if: ${{ steps.check-for-comment.outputs.SHOULD_COMMENT }}
+        uses: actions-cool/issues-helper@e2ff99831a4f13625d35064e2b3dfe65c07a0396 # v3.7.5
+        with:
+          actions: 'create-comment'
+          token: ${{ steps.generate-token.outputs.token }}
+          body: |
+            <!-- blocked/need-repro -->
+
+            Hello @${{ github.event.issue.user.login }}. Thanks for reporting this and helping to make Electron better!
+
+            Would it be possible for you to make a standalone testcase with only the code necessary to reproduce the issue? For example, [Electron Fiddle](https://www.electronjs.org/fiddle) is a great tool for making small test cases and makes it easy to publish your test case to a [gist](https://gist.github.com) that Electron maintainers can use.
+
+            Stand-alone test cases make fixing issues go more smoothly: it ensure everyone's looking at the same issue, it removes all unnecessary variables from the equation, and it can also provide the basis for automated regression tests.
+
+            Now adding the https://github.com/electron/electron/labels/blocked%2Fneed-repro label for this reason. After you make a test case, please link to it in a followup comment. This issue will be closed in 10 days if the above is not addressed.

.github/workflows/issue-opened.yml

@@ -0,0 +1,160 @@
+name: Issue Opened
+
+on:
+  issues:
+    types:
+      - opened
+
+permissions: {}
+
+jobs:
+  add-to-issue-triage:
+    if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+          org: electron
+      - name: Add to Issue Triage
+        uses: dsanders11/project-actions/add-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          field: Reporter
+          field-value: ${{ github.event.issue.user.login }}
+          project-number: 90
+          token: ${{ steps.generate-token.outputs.token }}
+  set-labels:
+    if: ${{ contains(github.event.issue.labels.*.name, 'bug :beetle:') }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+          org: electron
+      - name: Sparse checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .
+            .github
+            .yarn
+      - run: yarn workspaces focus @electron/gha-workflows
+      - name: Add labels
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        id: add-labels
+        env:
+          ISSUE_BODY: ${{ github.event.issue.body }}
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            const { chdir } = require('node:process');
+            chdir('${{ github.workspace }}/.github/workflows');
+
+            const { ElectronVersions } = require('@electron/fiddle-core');
+            const { fromMarkdown } = require('mdast-util-from-markdown');
+            const { select } = require('unist-util-select');
+            const semver = require('semver');
+
+            const [ owner, repo ] = '${{ github.repository }}'.split('/');
+            const issue_number = ${{ github.event.issue.number }};
+
+            const tree = fromMarkdown(process.env.ISSUE_BODY);
+
+            const labels = [];
+
+            const electronVersion = select('heading:has(> text[value="Electron Version"]) + paragraph > text', tree)?.value.trim();
+            if (electronVersion !== undefined) {
+              // It's possible for multiple versions to be listed -
+              // for now check for comma or space separated version.
+              const versions = electronVersion.split(/, | /);
+              let hasSupportedVersion = false;
+
+              for (const version of versions) {
+                const major = semver.coerce(version, { loose: true })?.major;
+                if (major) {
+                  const versionLabel = `${major}-x-y`;
+                  let labelExists = false;
+
+                  try {
+                    await github.rest.issues.getLabel({
+                      owner,
+                      repo,
+                      name: versionLabel,
+                    });
+                    labelExists = true;
+                  } catch {}
+
+                  const electronVersions = await ElectronVersions.create(undefined, { ignoreCache: true });
+                  const validVersions = [...electronVersions.supportedMajors, ...electronVersions.prereleaseMajors];
+
+                  if (validVersions.includes(major)) {
+                    hasSupportedVersion = true;
+                    if (labelExists) {
+                      labels.push(versionLabel);
+                    }
+                  }
+                }
+              }
+
+              if (!hasSupportedVersion) {
+                core.setOutput('unsupportedMajor', true);
+                labels.push('blocked/need-info ❌');
+              }
+            }
+
+            const operatingSystems = select('heading:has(> text[value="What operating system(s) are you using?"]) + paragraph > text', tree)?.value.trim().split(', ');
+            const platformLabels = new Set();
+            for (const operatingSystem of (operatingSystems ?? [])) {
+              switch (operatingSystem) {
+                case 'Windows':
+                  platformLabels.add('platform/windows');
+                  break;
+                case 'macOS':
+                  platformLabels.add('platform/macOS');
+                  break;
+                case 'Ubuntu':
+                case 'Other Linux':
+                  platformLabels.add('platform/linux');
+                  break;
+              }
+            }
+
+            if (platformLabels.size === 3) {
+              labels.push('platform/all');
+            } else {
+              labels.push(...platformLabels);
+            }
+
+            const gistUrl = select('heading:has(> text[value="Testcase Gist URL"]) + paragraph > text', tree)?.value.trim();
+            if (gistUrl !== undefined && gistUrl.startsWith('https://gist.github.com/')) {
+              labels.push('has-repro-gist');
+            }
+
+            if (labels.length) {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number,
+                labels,
+              });
+            }
+      - name: Create unsupported major comment
+        if: ${{ steps.add-labels.outputs.unsupportedMajor }}
+        uses: actions-cool/issues-helper@e2ff99831a4f13625d35064e2b3dfe65c07a0396 # v3.7.5
+        with:
+          actions: 'create-comment'
+          token: ${{ steps.generate-token.outputs.token }}
+          body: |
+            <!-- end-of-life -->
+
+            Hello @${{ github.event.issue.user.login }}. Thanks for reporting this and helping to make Electron better!
+            
+            The version of Electron reported in this issue has reached end-of-life and is [no longer supported](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline). If you're still experiencing this issue on a [supported version](https://www.electronjs.org/releases/stable) of Electron, please update this issue to reflect that version of Electron.
+
+            Now adding the https://github.com/electron/electron/labels/blocked%2Fneed-info%20%E2%9D%8C label for this reason. This issue will be closed in 10 days if the above is not addressed.

.github/workflows/issue-transferred.yml

@@ -0,0 +1,28 @@
+name: Issue Transferred
+
+on:
+  issues:
+    types: [transferred]
+
+permissions: {}
+
+jobs:
+  issue-transferred:
+    name: Issue Transferred
+    runs-on: ubuntu-latest
+    permissions: {}
+    if: ${{ !github.event.changes.new_repository.private }}
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+          org: electron
+      - name: Remove from issue triage
+        uses: dsanders11/project-actions/delete-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          project-number: 90
+          item: ${{ github.event.changes.new_issue.html_url }}
+          fail-if-item-not-found: false

.github/workflows/issue-unlabeled.yml

@@ -0,0 +1,40 @@
+name: Issue Unlabeled
+
+on:
+  issues:
+    types: [unlabeled]
+
+permissions: {}
+
+jobs:
+  issue-unlabeled-blocked:
+    name: All blocked/* labels removed
+    if: startsWith(github.event.label.name, 'blocked/') && github.event.issue.state == 'open'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check for any blocked labels
+        id: check-for-blocked-labels
+        run: |
+          set -eo pipefail
+          BLOCKED_LABEL_COUNT=$(echo '${{ toJSON(github.event.issue.labels.*.name) }}' | jq '[ .[] | select(startswith("blocked/")) ] | length')
+          if [[ $BLOCKED_LABEL_COUNT -eq 0 ]]; then
+            echo "NOT_BLOCKED=1" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Generate GitHub App token
+        if: ${{ steps.check-for-blocked-labels.outputs.NOT_BLOCKED }}
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+          org: electron
+      - name: Set status
+        if: ${{ steps.check-for-blocked-labels.outputs.NOT_BLOCKED }}
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          project-number: 90
+          field: Status
+          field-value: 📥 Was Blocked
+          fail-if-item-not-found: false

.github/workflows/linux-publish.yml

@@ -0,0 +1,94 @@
+name: Publish Linux
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-image-sha:
+        type: string
+        description: 'SHA for electron/build image'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
+      upload-to-storage:
+        description: 'Uploads to Azure storage'
+        required: false
+        default: '1'
+        type: string
+      run-linux-publish:
+        description: 'Run the publish jobs vs just the build jobs'
+        type: boolean
+        default: false
+
+permissions: {}
+
+jobs:
+  checkout-linux:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True'
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+
+  publish-x64:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-linux
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      target-platform: linux
+      target-arch: x64
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-arm:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-linux
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      target-platform: linux
+      target-arch: arm
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-arm64:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-linux
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-centralus-linux-amd64-32core
+      build-container: '{"image":"ghcr.io/electron/build:${{ inputs.build-image-sha }}","options":"--user root","volumes":["/mnt/cross-instance-cache:/mnt/cross-instance-cache"]}'
+      target-platform: linux
+      target-arch: arm64
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit

.github/workflows/macos-disk-cleanup.yml

@@ -0,0 +1,104 @@
+name: macOS Disk Space Cleanup
+
+# Description:
+# This workflow runs the disk space reclaimer on macOS runners every night
+# and logs disk space metrics to Datadog for monitoring.
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  macos-disk-cleanup:
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - macos-15
+          - macos-15-large
+          - macos-15-xlarge
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .github/actions/free-space-macos
+          sparse-checkout-cone-mode: false
+
+      - name: Get Disk Space Before Cleanup
+        id: disk-before
+        shell: bash
+        run: |
+          echo "Disk space before cleanup:"
+          df -h /
+          FREE_SPACE_BEFORE=$(df -k / | tail -1 | awk '{print $4}')
+          echo "free_kb=$FREE_SPACE_BEFORE" >> $GITHUB_OUTPUT
+
+      - name: Free Space on macOS
+        uses: ./.github/actions/free-space-macos
+
+      - name: Get Disk Space After Cleanup
+        id: disk-after
+        shell: bash
+        run: |
+          echo "Disk space after cleanup:"
+          df -h /
+          FREE_SPACE_AFTER=$(df -k / | tail -1 | awk '{print $4}')
+          echo "free_kb=$FREE_SPACE_AFTER" >> $GITHUB_OUTPUT
+
+      - name: Log Disk Space to Datadog
+        if: ${{ env.DD_API_KEY != '' }}
+        shell: bash
+        env:
+          DD_API_KEY: ${{ secrets.DD_API_KEY }}
+          FREE_BEFORE: ${{ steps.disk-before.outputs.free_kb }}
+          FREE_AFTER: ${{ steps.disk-after.outputs.free_kb }}
+          MATRIX_RUNNER: ${{ matrix.runner }}
+        run: |
+          TIMESTAMP=$(date +%s)
+          FREE_BEFORE_GB=$(echo "scale=2; $FREE_BEFORE / 1024 / 1024" | bc)
+          FREE_AFTER_GB=$(echo "scale=2; $FREE_AFTER / 1024 / 1024" | bc)
+          SPACE_FREED_GB=$(echo "scale=2; ($FREE_AFTER - $FREE_BEFORE) / 1024 / 1024" | bc)
+
+          echo "Free space before: ${FREE_BEFORE_GB}GB"
+          echo "Free space after: ${FREE_AFTER_GB}GB"
+          echo "Space freed: ${SPACE_FREED_GB}GB"
+
+          curl -s -X POST "https://api.datadoghq.com/api/v2/series" \
+            -H "Content-Type: application/json" \
+            -H "DD-API-KEY: ${DD_API_KEY}" \
+            -d @- << EOF
+          {
+            "series": [
+              {
+                "metric": "electron.macos.disk.free_space_before_cleanup_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${FREE_BEFORE_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              },
+              {
+                "metric": "electron.macos.disk.free_space_after_cleanup_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${FREE_AFTER_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              },
+              {
+                "metric": "electron.macos.disk.space_freed_gb",
+                "points": [{"timestamp": ${TIMESTAMP}, "value": ${SPACE_FREED_GB}}],
+                "type": 3,
+                "unit": "gigabyte",
+                "tags": ["runner:${MATRIX_RUNNER}", "platform:macos"]
+              }
+            ]
+          }
+          EOF
+
+          echo "Disk space metrics logged to Datadog"

.github/workflows/macos-publish.yml

@@ -0,0 +1,115 @@
+name: Publish MacOS
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-image-sha:
+        type: string
+        description: 'SHA for electron/build image'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
+        required: true
+      upload-to-storage:
+        description: 'Uploads to Azure storage'
+        required: false
+        default: '1'
+        type: string
+      run-macos-publish:
+        description: 'Run the publish jobs vs just the build jobs'
+        type: boolean
+        default: false
+
+permissions: {}
+
+jobs:
+  checkout-macos:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
+      options: --user root
+      volumes:
+        - /mnt/cross-instance-cache:/mnt/cross-instance-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_mac=True --custom-var=host_os=mac'
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        generate-sas-token: 'true'
+        target-platform: macos
+
+  publish-x64-darwin:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-macos
+    with:
+      environment: production-release
+      build-runs-on: macos-15-xlarge
+      target-platform: macos
+      target-arch: x64
+      target-variant: darwin
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-x64-mas:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-macos
+    with:
+      environment: production-release
+      build-runs-on: macos-15-xlarge
+      target-platform: macos
+      target-arch: x64
+      target-variant: mas
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-arm64-darwin:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-macos
+    with:
+      environment: production-release
+      build-runs-on: macos-15-xlarge
+      target-platform: macos
+      target-arch: arm64
+      target-variant: darwin
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-arm64-mas:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-macos
+    with:
+      environment: production-release
+      build-runs-on: macos-15-xlarge
+      target-platform: macos
+      target-arch: arm64
+      target-variant: mas
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit

.github/workflows/non-maintainer-dependency-change.yml

@@ -0,0 +1,49 @@
+name: Check for Disallowed Non-Maintainer Change
+
+on:
+  pull_request_target:
+    paths:
+      - 'yarn.lock'
+      - 'spec/yarn.lock'
+      - '.github/workflows/**'
+      - '.github/actions/**'
+      - '.yarn/**'
+      - '.yarnrc.yml'
+
+permissions: {}
+
+jobs:
+  check-for-non-maintainer-dependency-change:
+    name: Check for disallowed non-maintainer change
+    if: ${{ github.event.pull_request.user.type != 'Bot' && !github.event.pull_request.draft }}
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get author association
+        id: get-author-association
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          AUTHOR_ASSOCIATION=$(gh api /repos/electron/electron/pulls/${{ github.event.pull_request.number }} --jq '.author_association')
+          echo "author_association=$AUTHOR_ASSOCIATION" >> "$GITHUB_OUTPUT"
+      - name: Check for existing review
+        id: check-for-review
+        if: ${{ !contains(fromJSON('["MEMBER", "OWNER"]'), steps.get-author-association.outputs.author_association) }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -eo pipefail
+          REVIEW_COUNT=$(gh pr view $PR_URL --json reviews | jq '[ .reviews[] | select(.author.login == "github-actions") | select(.body | startswith("<!-- disallowed-non-maintainer-change -->")) ] | length')
+          if [[ $REVIEW_COUNT -eq 0 ]]; then
+            echo "SHOULD_REVIEW=1" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Request changes
+        if: ${{ steps.check-for-review.outputs.SHOULD_REVIEW }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          printf "<!-- disallowed-non-maintainer-change -->\n\nHello @${{ github.event.pull_request.user.login }}! It looks like this pull request touches one of our dependency or CI files, and per [our contribution policy](https://github.com/electron/electron/blob/main/CONTRIBUTING.md#dependencies-upgrades-policy) we do not accept these types of changes in PRs." | gh pr review $PR_URL -r --body-file=-

.github/workflows/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@electron/gha-workflows",
+  "version": "0.0.0-development",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@actions/cache": "^4.0.3",
+    "@electron/fiddle-core": "^2.0.1",
+    "mdast-util-from-markdown": "^2.0.0",
+    "semver": "^7.7.2",
+    "unist-util-select": "^5.1.0"
+  }
+}

.github/workflows/pipeline-electron-build-and-test-and-nan.yml

@@ -0,0 +1,103 @@
+name: Electron Build & Test (+ Node + NaN) Pipeline
+
+on:
+  workflow_call:
+    inputs:
+      target-platform:
+        type: string
+        description: 'Platform to run on, can be macos, win or linux.'
+        required: true
+      target-arch:
+        type: string
+        description: 'Arch to build for, can be x64, arm64 or arm'
+        required: true
+      build-runs-on:
+        type: string
+        description: 'What host to run the build'
+        required: true
+      test-runs-on:
+        type: string
+        description: 'What host to run the tests on'
+        required: true
+      build-container:
+        type: string
+        description: 'JSON container information for aks runs-on'
+        required: false
+        default: '{"image":null}'
+      test-container:
+        type: string
+        description: 'JSON container information for testing'
+        required: false
+        default: '{"image":null}'
+      is-release:
+        description: 'Whether this build job is a release job'
+        required: true
+        type: boolean
+        default: false
+      gn-build-type:
+        description: 'The gn build type - testing or release'
+        required: true
+        type: string
+        default: testing
+      generate-symbols: 
+        description: 'Whether or not to generate symbols'
+        required: true
+        type: boolean
+        default: false
+      upload-to-storage: 
+        description: 'Whether or not to upload build artifacts to external storage'
+        required: true
+        type: string
+        default: '0'
+      is-asan: 
+        description: 'Building the Address Sanitizer (ASan) Linux build'
+        required: false
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: electron-build-and-test-and-nan-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+jobs:
+  build:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    with:
+      build-runs-on: ${{ inputs.build-runs-on }}
+      build-container: ${{ inputs.build-container }}
+      target-platform: ${{ inputs.target-platform }}
+      target-arch: ${{ inputs.target-arch }}
+      is-release: ${{ inputs.is-release }}
+      gn-build-type: ${{ inputs.gn-build-type }}
+      generate-symbols: ${{ inputs.generate-symbols }}
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+  test:
+    uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    needs: build
+    with:
+      target-arch: ${{ inputs.target-arch }}
+      target-platform: ${{ inputs.target-platform }}
+      test-runs-on: ${{ inputs.test-runs-on }}
+      test-container: ${{ inputs.test-container }}
+    secrets: inherit
+  nn-test:
+    uses: ./.github/workflows/pipeline-segment-node-nan-test.yml
+    permissions:
+      contents: read
+    needs: build
+    with:
+      target-arch: ${{ inputs.target-arch }}
+      target-platform: ${{ inputs.target-platform }}
+      test-runs-on: ${{ inputs.test-runs-on }}
+      test-container: ${{ inputs.test-container }}
+      gn-build-type: ${{ inputs.gn-build-type }}
+    secrets: inherit

.github/workflows/pipeline-electron-build-and-test.yml

@@ -0,0 +1,100 @@
+name: Electron Build & Test Pipeline
+
+on:
+  workflow_call:
+    inputs:
+      target-platform:
+        type: string
+        description: 'Platform to run on, can be macos, win or linux'
+        required: true
+      target-arch:
+        type: string
+        description: 'Arch to build for, can be x64, arm64 or arm'
+        required: true
+      build-runs-on:
+        type: string
+        description: 'What host to run the build'
+        required: true
+      test-runs-on:
+        type: string
+        description: 'What host to run the tests on'
+        required: true
+      build-container:
+        type: string
+        description: 'JSON container information for aks runs-on'
+        required: false
+        default: '{"image":null}'
+      test-container:
+        type: string
+        description: 'JSON container information for testing'
+        required: false
+        default: '{"image":null}'
+      is-release:
+        description: 'Whether this build job is a release job'
+        required: true
+        type: boolean
+        default: false
+      gn-build-type:
+        description: 'The gn build type - testing or release'
+        required: true
+        type: string
+        default: testing
+      generate-symbols: 
+        description: 'Whether or not to generate symbols'
+        required: true
+        type: boolean
+        default: false
+      upload-to-storage: 
+        description: 'Whether or not to upload build artifacts to external storage'
+        required: true
+        type: string
+        default: '0'
+      is-asan: 
+        description: 'Building the Address Sanitizer (ASan) Linux build'
+        required: false
+        type: boolean
+        default: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: electron-build-and-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+permissions: {}
+
+jobs:
+  build:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    with:
+      build-runs-on: ${{ inputs.build-runs-on }}
+      build-container: ${{ inputs.build-container }}
+      target-platform: ${{ inputs.target-platform }}
+      target-arch: ${{ inputs.target-arch }}
+      is-release: ${{ inputs.is-release }}
+      gn-build-type: ${{ inputs.gn-build-type }}
+      generate-symbols: ${{ inputs.generate-symbols }}
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+      is-asan: ${{ inputs.is-asan }}
+      enable-ssh: ${{ inputs.enable-ssh }}
+    secrets: inherit
+  test:
+    uses: ./.github/workflows/pipeline-segment-electron-test.yml
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    needs: build
+    with:
+      target-arch: ${{ inputs.target-arch }}
+      target-platform: ${{ inputs.target-platform }}
+      test-runs-on: ${{ inputs.test-runs-on }}
+      test-container: ${{ inputs.test-container }}
+      is-asan: ${{ inputs.is-asan }}
+      enable-ssh: ${{ inputs.enable-ssh }}
+    secrets: inherit

.github/workflows/pipeline-electron-docs-only.yml

@@ -0,0 +1,65 @@
+name: Electron Docs Compile
+
+on:
+  workflow_call:
+    inputs:
+      container:
+        required: true
+        description: 'Container to run the docs-only ts compile in'
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: electron-docs-only-${{ github.ref }}
+  cancel-in-progress: true
+
+env:  
+  GCLIENT_EXTRA_ARGS: --custom-var=checkout_arm=True --custom-var=checkout_arm64=True
+
+jobs:
+  docs-only:
+    name: Docs Only Compile
+    runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
+    timeout-minutes: 20
+    container: ${{ fromJSON(inputs.container) }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Generate DEPS Hash
+      run: |
+        node src/electron/script/generate-deps-hash.js
+        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
+        echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
+        echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
+    - name: Restore src cache via AKS
+      uses: ./src/electron/.github/actions/restore-cache-aks
+      with:
+        target-platform: linux
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Run TS/JS compile
+      shell: bash
+      run: |
+        cd src/electron
+        node script/yarn.js create-typescript-definitions
+        node script/yarn.js tsc -p tsconfig.default_app.json --noEmit
+        for f in build/webpack/*.js
+        do
+            out="${f:29}"
+            if [ "$out" != "base.js" ]; then
+            node script/yarn.js webpack --config $f --output-filename=$out --output-path=./.tmp --env mode=development
+            fi
+        done

.github/workflows/pipeline-electron-lint.yml

@@ -0,0 +1,88 @@
+name: Electron Lint
+
+on:
+  workflow_call:
+    inputs:
+      container:
+        required: true
+        description: 'Container to run lint in'
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: electron-lint-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}  
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
+    timeout-minutes: 20
+    container: ${{ fromJSON(inputs.container) }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
+    - name: Setup third_party Depot Tools
+      shell: bash
+      run: |
+        # "depot_tools" has to be checkout into "//third_party/depot_tools" so pylint.py can a "pylintrc" file.
+        git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git src/third_party/depot_tools
+        echo "$(pwd)/src/third_party/depot_tools" >> $GITHUB_PATH
+    - name: Download GN Binary
+      shell: bash
+      run: |
+        chromium_revision="$(grep -A1 chromium_version src/electron/DEPS | tr -d '\n' | cut -d\' -f4)"
+        gn_version="$(curl -sL "https://chromium.googlesource.com/chromium/src/+/${chromium_revision}/DEPS?format=TEXT" | base64 -d | grep gn_version | head -n1 | cut -d\' -f4)"
+
+        cipd ensure -ensure-file - -root . <<-CIPD
+        \$ServiceURL https://chrome-infra-packages.appspot.com/
+        @Subdir src/buildtools/linux64
+        gn/gn/linux-amd64 $gn_version
+        CIPD
+
+        buildtools_path="$(pwd)/src/buildtools"
+        echo "CHROMIUM_BUILDTOOLS_PATH=$buildtools_path" >> $GITHUB_ENV
+    - name: Download clang-format Binary
+      shell: bash
+      run: |
+        chromium_revision="$(grep -A1 chromium_version src/electron/DEPS | tr -d '\n' | cut -d\' -f4)"
+
+        mkdir -p src/buildtools
+        curl -sL "https://chromium.googlesource.com/chromium/src/+/${chromium_revision}/buildtools/DEPS?format=TEXT" | base64 -d > src/buildtools/DEPS
+
+        gclient sync --spec="solutions=[{'name':'src/buildtools','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':True},'managed':False}]"
+    - name: Add ESLint problem matcher
+      shell: bash
+      run: echo "::add-matcher::src/electron/.github/problem-matchers/eslint-stylish.json"
+    - name: Run Lint
+      shell: bash
+      run: |
+        # gn.py tries to find a gclient root folder starting from the current dir.
+        # When it fails and returns "None" path, the whole script fails. Let's "fix" it.
+        touch .gclient
+        # Another option would be to checkout "buildtools" inside the Electron checkout,
+        # but then we would lint its contents (at least gn format), and it doesn't pass it.
+
+        cd src/electron
+        node script/yarn.js install --immutable
+        node script/yarn.js lint
+    - name: Run Script Typechecker
+      shell: bash
+      run: |
+        cd src/electron
+        node script/yarn.js tsc -p tsconfig.script.json
+    

.github/workflows/pipeline-segment-electron-build.yml

@@ -0,0 +1,246 @@
+name: Pipeline Segment - Electron Build
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        description: using the production or testing environment
+        required: false
+        type: string
+      target-platform:
+        type: string
+        description: 'Platform to run on, can be macos, win or linux'
+        required: true
+      target-arch:
+        type: string
+        description: 'Arch to build for, can be x64, arm64, ia32 or arm'
+        required: true
+      target-variant:
+        type: string
+        description: 'Variant to build for, no effect on non-macOS target platforms. Can be darwin, mas or all.'
+        default: all
+      build-runs-on:
+        type: string
+        description: 'What host to run the build'
+        required: true
+      build-container:
+        type: string
+        description: 'JSON container information for aks runs-on'
+        required: false
+        default: '{"image":null}'
+      is-release:
+        description: 'Whether this build job is a release job'
+        required: true
+        type: boolean
+        default: false
+      gn-build-type:
+        description: 'The gn build type - testing or release'
+        required: true
+        type: string
+        default: testing
+      generate-symbols: 
+        description: 'Whether or not to generate symbols'
+        required: true
+        type: boolean
+        default: false
+      upload-to-storage: 
+        description: 'Whether or not to upload build artifacts to external storage'
+        required: true
+        type: string
+        default: '0'
+      is-asan: 
+        description: 'Building the Address Sanitizer (ASan) Linux build'
+        required: false
+        type: boolean
+        default: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: electron-build-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.target-variant }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+  CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+  DD_API_KEY: ${{ secrets.DD_API_KEY }}
+  ELECTRON_ARTIFACTS_BLOB_STORAGE: ${{ secrets.ELECTRON_ARTIFACTS_BLOB_STORAGE }}
+  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+  SUDOWOODO_EXCHANGE_URL: ${{ secrets.SUDOWOODO_EXCHANGE_URL }}
+  SUDOWOODO_EXCHANGE_TOKEN: ${{ secrets.SUDOWOODO_EXCHANGE_TOKEN }}
+  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || inputs.target-platform == 'win' && '--custom-var=checkout_win=True' || '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' }}
+  ELECTRON_OUT_DIR: Default
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
+
+jobs:
+  build:
+    defaults:
+      run:
+        shell: bash
+    runs-on: ${{ inputs.build-runs-on }}
+    permissions:
+      contents: read
+    container: ${{ fromJSON(inputs.build-container) }}
+    environment: ${{ inputs.environment }}
+    env:
+      TARGET_ARCH: ${{ inputs.target-arch }}
+      TARGET_PLATFORM: ${{ inputs.target-platform }}
+    steps:
+    - name: Create src dir
+      run: |
+        mkdir src
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Setup SSH Debugging
+      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
+      uses: ./src/electron/.github/actions/ssh-debug
+      with:
+        tunnel: 'true'
+      env:
+        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
+        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
+        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
+        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Free up space (macOS)
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: ./src/electron/.github/actions/free-space-macos
+    - name: Check disk space after freeing up space
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: df -h
+    - name: Setup Node.js/npm
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
+      with:
+        node-version: 22.21.x
+        cache: yarn
+        cache-dependency-path: src/electron/yarn.lock
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Install AZCopy
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: brew install azcopy
+    - name: Enable windows toolchain
+      if: ${{ inputs.target-platform == 'win' }}
+      run: |
+        echo "ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN=1" >> $GITHUB_ENV      
+    - name: Set GN_EXTRA_ARGS for Linux
+      if: ${{ inputs.target-platform == 'linux' }}
+      run: |
+        if [ "${{ inputs.target-arch  }}" = "arm" ]; then
+          if [ "${{ inputs.is-release  }}" = true ]; then
+            GN_EXTRA_ARGS='target_cpu="arm" build_tflite_with_xnnpack=false symbol_level=1'
+          else
+            GN_EXTRA_ARGS='target_cpu="arm" build_tflite_with_xnnpack=false'
+          fi
+        elif [ "${{ inputs.target-arch }}" = "arm64" ]; then
+          GN_EXTRA_ARGS='target_cpu="arm64" fatal_linker_warnings=false enable_linux_installer=false'
+        elif [ "${{ inputs.is-asan }}" = true ]; then
+          GN_EXTRA_ARGS='is_asan=true'
+        fi
+        echo "GN_EXTRA_ARGS=$GN_EXTRA_ARGS" >> $GITHUB_ENV
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
+    - name: Install Build Tools
+      uses: ./src/electron/.github/actions/install-build-tools      
+    - name: Generate DEPS Hash
+      run: |
+        node src/electron/script/generate-deps-hash.js
+        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
+        echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
+        echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
+    - name: Restore src cache via AZCopy
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: ./src/electron/.github/actions/restore-cache-azcopy
+      with:
+        target-platform: ${{ inputs.target-platform }}
+    - name: Restore src cache via AKS
+      if: ${{ inputs.target-platform != 'macos' }}
+      uses: ./src/electron/.github/actions/restore-cache-aks
+      with:
+        target-platform: ${{ inputs.target-platform }}      
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Fix Sync
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: ./src/electron/.github/actions/fix-sync
+      with:
+        target-platform: ${{ inputs.target-platform }}
+      env:
+        ELECTRON_DEPOT_TOOLS_DISABLE_LOG: true
+    - name: Init Build Tools
+      run: |
+        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }} --remote-build siso
+        e sanitize-config
+    - name: Run Electron Only Hooks
+      run: |
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          rm -rf src/third_party/depot_tools/win_toolchain/vs_files*
+        fi
+        echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]" > tmpgclient
+        if [ "${{ inputs.target-platform }}" = "win" ]; then          
+          echo "target_os=['win']" >> tmpgclient
+        fi
+        gclient runhooks --gclientfile=tmpgclient
+        # Fix VS Toolchain
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          e d python3 src/build/vs_toolchain.py update --force
+        fi
+    - name: Regenerate DEPS Hash
+      run: |
+        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js
+        echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
+    - name: Add CHROMIUM_BUILDTOOLS_PATH to env
+      run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
+    - name: Free up space (macOS)
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: ./src/electron/.github/actions/free-space-macos
+    - name: Build Electron
+      if: ${{ inputs.target-platform != 'macos' || (inputs.target-variant == 'all' || inputs.target-variant == 'darwin') }}
+      uses: ./src/electron/.github/actions/build-electron
+      with:
+        target-arch: ${{ inputs.target-arch }}
+        target-platform: ${{ inputs.target-platform }}
+        artifact-platform: ${{ inputs.target-platform == 'macos' && 'darwin' || inputs.target-platform }}
+        is-release: '${{ inputs.is-release }}'
+        generate-symbols: '${{ inputs.generate-symbols }}'
+        upload-to-storage: '${{ inputs.upload-to-storage }}'
+        is-asan: '${{ inputs.is-asan }}'
+    - name: Set GN_EXTRA_ARGS for MAS Build
+      if: ${{ inputs.target-platform == 'macos' && (inputs.target-variant == 'all' || inputs.target-variant == 'mas') }}
+      run: |
+        echo "MAS_BUILD=true" >> $GITHUB_ENV
+        GN_EXTRA_ARGS='is_mas_build=true'
+        echo "GN_EXTRA_ARGS=$GN_EXTRA_ARGS" >> $GITHUB_ENV
+    - name: Build Electron (MAS)
+      if: ${{ inputs.target-platform == 'macos' && (inputs.target-variant == 'all' || inputs.target-variant == 'mas') }}
+      uses: ./src/electron/.github/actions/build-electron
+      with:
+        target-arch: ${{ inputs.target-arch }}
+        target-platform: ${{ inputs.target-platform }}
+        artifact-platform: 'mas'
+        is-release: '${{ inputs.is-release }}'
+        generate-symbols: '${{ inputs.generate-symbols }}'
+        upload-to-storage: '${{ inputs.upload-to-storage }}'
+        step-suffix: '(mas)'
+    - name: Wait for active SSH sessions
+      shell: bash
+      if: always() && !cancelled()
+      run: |
+        while [ -f /var/.ssh-lock ]
+        do
+          sleep 60
+        done        

.github/workflows/pipeline-segment-electron-gn-check.yml

@@ -0,0 +1,166 @@
+name: Pipeline Segment - Electron GN Check
+
+on:
+  workflow_call:
+    inputs:
+      target-platform:
+        type: string
+        description: 'Platform to run on, can be macos, win or linux'
+        required: true
+      target-archs:
+        type: string
+        description: 'Archs to check for, can be x64, x86, arm64 or arm space separated'
+        required: true
+      check-runs-on:
+        type: string
+        description: 'What host to run the tests on'
+        required: true
+      check-container:
+        type: string
+        description: 'JSON container information for aks runs-on'
+        required: false
+        default: '{"image":null}'
+      gn-build-type:
+        description: 'The gn build type - testing or release'
+        required: true
+        type: string
+        default: testing
+
+permissions: {}
+
+concurrency:
+  group: electron-gn-check-${{ inputs.target-platform }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+  GCLIENT_EXTRA_ARGS: ${{ inputs.target-platform == 'macos' && '--custom-var=checkout_mac=True --custom-var=host_os=mac' || (inputs.target-platform == 'linux' && '--custom-var=checkout_arm=True --custom-var=checkout_arm64=True' || '--custom-var=checkout_win=True') }}
+  ELECTRON_OUT_DIR: Default
+
+jobs:
+  gn-check:
+    defaults:
+      run:
+        shell: bash
+    runs-on: ${{ inputs.check-runs-on }}
+    permissions:
+      contents: read
+    container: ${{ fromJSON(inputs.check-container) }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Cleanup disk space on macOS
+      if: ${{ inputs.target-platform == 'macos' }}
+      shell: bash
+      run: |   
+        sudo mkdir -p $TMPDIR/del-target
+
+        tmpify() {
+          if [ -d "$1" ]; then
+            sudo mv "$1" $TMPDIR/del-target/$(echo $1|shasum -a 256|head -n1|cut -d " " -f1)
+          fi
+        }   
+        tmpify /Library/Developer/CoreSimulator
+        tmpify ~/Library/Developer/CoreSimulator
+        sudo rm -rf $TMPDIR/del-target
+    - name: Check disk space after freeing up space
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: df -h
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
+    - name: Install Build Tools
+      uses: ./src/electron/.github/actions/install-build-tools
+    - name: Enable windows toolchain
+      if: ${{ inputs.target-platform == 'win' }}
+      run: |
+        echo "ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN=1" >> $GITHUB_ENV
+    - name: Generate DEPS Hash
+      run: |
+        node src/electron/script/generate-deps-hash.js
+        DEPSHASH=v1-src-cache-$(cat src/electron/.depshash)
+        echo "DEPSHASH=$DEPSHASH" >> $GITHUB_ENV
+        echo "CACHE_PATH=$DEPSHASH.tar" >> $GITHUB_ENV
+    - name: Restore src cache via AZCopy
+      if: ${{ inputs.target-platform == 'macos' }}
+      uses: ./src/electron/.github/actions/restore-cache-azcopy
+      with:
+        target-platform: ${{ inputs.target-platform }}      
+    - name: Restore src cache via AKS
+      if: ${{ inputs.target-platform == 'linux' || inputs.target-platform == 'win' }}
+      uses: ./src/electron/.github/actions/restore-cache-aks
+      with:
+        target-platform: ${{ inputs.target-platform }}
+    - name: Run Electron Only Hooks
+      run: |
+        echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False},'managed':False}]" > tmpgclient
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          echo "solutions=[{'name':'src/electron','url':None,'deps_file':'DEPS','custom_vars':{'process_deps':False,'install_sysroot':False,'checkout_win':True},'managed':False}]" > tmpgclient
+          echo "target_os=['win']" >> tmpgclient
+        fi
+        e d gclient runhooks --gclientfile=tmpgclient
+
+        # Fix VS Toolchain
+        if [ "${{ inputs.target-platform }}" = "win" ]; then
+          rm -rf src/third_party/depot_tools/win_toolchain/vs_files
+          e d python3 src/build/vs_toolchain.py update --force
+        fi
+    - name: Regenerate DEPS Hash
+      run: |
+        (cd src/electron && git checkout .) && node src/electron/script/generate-deps-hash.js
+        echo "DEPSHASH=$(cat src/electron/.depshash)" >> $GITHUB_ENV
+    - name: Add CHROMIUM_BUILDTOOLS_PATH to env
+      run: echo "CHROMIUM_BUILDTOOLS_PATH=$(pwd)/src/buildtools" >> $GITHUB_ENV
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Default GN gen
+      run: |
+        cd src/electron
+        git pack-refs
+    - name: Run GN Check for ${{ inputs.target-archs }}
+      run: |
+        for target_cpu in ${{ inputs.target-archs }}
+        do
+          e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu $target_cpu
+          cd src
+          export GN_EXTRA_ARGS="target_cpu=\"$target_cpu\""
+          if [ "${{ inputs.target-platform }}" = "linux" ]; then
+            if [ "$target_cpu" = "arm" ]; then
+              export GN_EXTRA_ARGS="$GN_EXTRA_ARGS build_tflite_with_xnnpack=false"
+            elif [ "$target_cpu" = "arm64" ]; then
+              export GN_EXTRA_ARGS="$GN_EXTRA_ARGS fatal_linker_warnings=false enable_linux_installer=false"
+            fi
+          fi
+          if [ "${{ inputs.target-platform }}" = "win" ]; then
+            export GN_EXTRA_ARGS="$GN_EXTRA_ARGS use_v8_context_snapshot=true target_os=\"win\""
+          fi
+
+          e build --only-gen
+
+          e d gn check out/Default //electron:electron_lib
+          e d gn check out/Default //electron:electron_app
+          e d gn check out/Default //electron/shell/common:mojo
+          e d gn check out/Default //electron/shell/common:plugin
+
+          # Check the hunspell filenames
+          node electron/script/gen-hunspell-filenames.js --check
+          node electron/script/gen-libc++-filenames.js --check
+          cd ..
+        done
+    - name: Wait for active SSH sessions
+      if: always() && !cancelled()
+      shell: bash
+      run: |
+        while [ -f /var/.ssh-lock ]
+        do
+          sleep 60
+        done

.github/workflows/pipeline-segment-electron-test.yml

@@ -0,0 +1,281 @@
+name: Pipeline Segment - Electron Test
+
+on:
+  workflow_call:
+    inputs:
+      target-platform:
+        type: string
+        description: 'Platform to run on, can be macos, win or linux'
+        required: true
+      target-arch:
+        type: string
+        description: 'Arch to build for, can be x64, arm64 or arm'
+        required: true
+      test-runs-on:
+        type: string
+        description: 'What host to run the tests on'
+        required: true
+      test-container:
+        type: string
+        description: 'JSON container information for aks runs-on'
+        required: false
+        default: '{"image":null}'
+      is-asan: 
+        description: 'Building the Address Sanitizer (ASan) Linux build'
+        required: false
+        type: boolean
+        default: false
+      enable-ssh:
+        description: 'Enable SSH debugging'
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: electron-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ inputs.is-asan }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+permissions: {}
+
+env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+  CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+  ELECTRON_OUT_DIR: Default
+  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+  ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
+
+jobs:
+  test:
+    defaults:
+      run:
+        shell: bash
+    runs-on: ${{ inputs.test-runs-on }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    container: ${{ fromJSON(inputs.test-container) }}
+    strategy:
+      fail-fast: false
+      matrix:
+        build-type: ${{ inputs.target-platform == 'macos' && fromJSON('["darwin","mas"]') || (inputs.target-platform == 'win' && fromJSON('["win"]') || fromJSON('["linux"]')) }}
+        shard: ${{ inputs.target-platform == 'linux' && fromJSON('[1, 2, 3]') || fromJSON('[1, 2]') }}
+    env:
+      BUILD_TYPE: ${{ matrix.build-type }}
+      TARGET_ARCH: ${{ inputs.target-arch }}
+      ARTIFACT_KEY: ${{ matrix.build-type }}_${{ inputs.target-arch }}
+    steps:
+    - name: Fix node20 on arm32 runners
+      if: ${{ inputs.target-arch == 'arm' && inputs.target-platform == 'linux' }}
+      run: |
+        cp $(which node) /mnt/runner-externals/node20/bin/
+        cp $(which node) /mnt/runner-externals/node24/bin/
+    - name: Setup Node.js/npm
+      if: ${{ inputs.target-platform == 'win' }}
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
+      with:
+        node-version: 22.21.x
+    - name: Add TCC permissions on macOS
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: |
+        epochdate=$(($(date +'%s * 1000 + %-N / 1000000')))
+        configure_user_tccdb () {
+          local values=$1
+          local dbPath="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+          local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
+          sqlite3 "$dbPath" "$sqlQuery"
+        }
+
+        configure_sys_tccdb () {
+          local values=$1
+          local dbPath="/Library/Application Support/com.apple.TCC/TCC.db"
+          local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
+          sudo sqlite3 "$dbPath" "$sqlQuery"
+        }
+
+        userValuesArray=(
+            "'kTCCServiceCamera','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceBluetoothAlways','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceAppleEvents','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceCamera','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceBluetoothAlways','/opt/hca/hosted-compute-agent',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159"
+            "'kTCCServiceScreenCapture','/bin/bash',1,2,3,1,NULL,NULL,NULL,'UNUSED',NULL,0,$epochdate"
+        )
+        for values in "${userValuesArray[@]}"; do
+          # Sonoma and higher have a few extra values
+          # Ref: https://github.com/actions/runner-images/blob/main/images/macos/scripts/build/configure-tccdb-macos.sh
+          if [ "$OSTYPE" = "darwin23" ] || [ "$OSTYPE" = "darwin24" ]; then
+            configure_user_tccdb "$values,NULL,NULL,'UNUSED',${values##*,}"
+            configure_sys_tccdb "$values,NULL,NULL,'UNUSED',${values##*,}"
+          else
+            configure_user_tccdb "$values"
+            configure_sys_tccdb "$values"
+          fi
+        done
+    - name: Turn off the unexpectedly quit dialog on macOS
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: defaults write com.apple.CrashReporter DialogType server
+    - name: Set xcode to 16.4
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: sudo xcode-select --switch /Applications/Xcode_16.4.app
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Turn off screenshot nag on macOS
+      if: ${{ inputs.target-platform == 'macos' }}
+      run: |
+        defaults write ~/Library/Group\ Containers/group.com.apple.replayd/ScreenCaptureApprovals.plist "/bin/bash" -date "3024-09-23 12:00:00 +0000"
+        src/electron/script/actions/screencapture-nag-remover.sh -a $(which bash)
+        src/electron/script/actions/screencapture-nag-remover.sh -a /opt/hca/hosted-compute-agent
+    - name: Setup SSH Debugging
+      if: ${{ inputs.target-platform == 'macos' && (inputs.enable-ssh || env.ACTIONS_STEP_DEBUG == 'true') }}
+      uses: ./src/electron/.github/actions/ssh-debug
+      with:
+        tunnel: 'true'
+      env:
+        CLOUDFLARE_TUNNEL_CERT: ${{ secrets.CLOUDFLARE_TUNNEL_CERT }}
+        CLOUDFLARE_TUNNEL_HOSTNAME: ${{ vars.CLOUDFLARE_TUNNEL_HOSTNAME }}
+        CLOUDFLARE_USER_CA_CERT: ${{ secrets.CLOUDFLARE_USER_CA_CERT }}
+        AUTHORIZED_USERS: ${{ secrets.SSH_DEBUG_AUTHORIZED_USERS }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
+    - name: Get Depot Tools
+      timeout-minutes: 5
+      run: |
+        git config --global core.filemode false
+        git config --global core.autocrlf false
+        git config --global branch.autosetuprebase always
+        git config --global core.fscache true
+        git config --global core.longpaths true
+        git config --global core.preloadindex true
+        git config --global core.longpaths true
+        git clone --filter=tree:0 https://chromium.googlesource.com/chromium/tools/depot_tools.git
+        # Ensure depot_tools does not update.
+        test -d depot_tools && cd depot_tools
+        touch .disable_auto_update
+    - name: Add Depot Tools to PATH
+      run: echo "$(pwd)/depot_tools" >> $GITHUB_PATH
+    - name: Load ASan specific environment variables
+      if: ${{ inputs.is-asan == true }}
+      run: |
+        echo "ARTIFACT_KEY=${{ matrix.build-type }}_${{ inputs.target-arch }}_asan" >> $GITHUB_ENV
+        echo "DISABLE_CRASH_REPORTER_TESTS=true" >> $GITHUB_ENV
+        echo "IS_ASAN=true" >> $GITHUB_ENV
+    - name: Download Generated Artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      with:
+        name: generated_artifacts_${{ env.ARTIFACT_KEY }}
+        path: ./generated_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
+    - name: Download Src Artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      with:
+        name: src_artifacts_${{ env.ARTIFACT_KEY }}
+        path: ./src_artifacts_${{ matrix.build-type }}_${{ inputs.target-arch }}
+    - name: Restore Generated Artifacts
+      run: ./src/electron/script/actions/restore-artifacts.sh
+    - name: Unzip Dist (win)
+      if: ${{ inputs.target-platform == 'win' }}
+      shell: powershell
+      run: |
+        Set-ExecutionPolicy Bypass -Scope Process -Force
+        cd src/out/Default
+        Expand-Archive -Force dist.zip -DestinationPath ./
+    - name: Unzip Dist (unix)
+      if: ${{ inputs.target-platform != 'win' }}
+      run: |
+        cd src/out/Default
+        unzip -:o dist.zip
+    #- name: Import & Trust Self-Signed Codesigning Cert on MacOS
+    #  if: ${{ inputs.target-platform == 'macos' && inputs.target-arch == 'x64' }}
+    #  run: |
+    #    sudo security authorizationdb write com.apple.trust-settings.admin allow
+    #    cd src/electron
+    #    ./script/codesign/generate-identity.sh
+
+    - name: Run Electron Tests
+      shell: bash
+      env:
+        MOCHA_REPORTER: mocha-multi-reporters
+        MOCHA_MULTI_REPORTERS: mocha-junit-reporter, tap
+        ELECTRON_DISABLE_SECURITY_WARNINGS: 1
+        DISPLAY: ':99.0'
+        NPM_CONFIG_MSVS_VERSION: '2022'
+      run: |
+        cd src/electron
+        export ELECTRON_TEST_RESULTS_DIR=`pwd`/junit
+        # Get which tests are on this shard
+        tests_files=$(node script/split-tests ${{ matrix.shard }} ${{ inputs.target-platform == 'linux' && 3 || 2 }})
+
+        # Run tests
+        if [ "${{ inputs.target-platform }}" != "linux" ]; then
+          echo "About to start tests"
+          if [ "${{ inputs.target-platform }}" = "win" ]; then
+            if [ "${{ inputs.target-arch }}" = "x86" ]; then
+              export npm_config_arch="ia32"
+            fi
+            if [ "${{ inputs.target-arch }}" = "arm64" ]; then
+              export ELECTRON_FORCE_TEST_SUITE_EXIT="true"
+            fi
+          fi
+          node script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+        else
+          chown :builduser .. && chmod g+w ..
+          chown -R :builduser . && chmod -R g+w .
+          chmod 4755 ../out/Default/chrome-sandbox
+          runuser -u builduser -- git config --global --add safe.directory $(pwd)
+          if [ "${{ inputs.is-asan }}" == "true" ]; then
+            cd ..
+            ASAN_SYMBOLIZE="$PWD/tools/valgrind/asan/asan_symbolize.py --executable-path=$PWD/out/Default/electron"
+            export ASAN_OPTIONS="symbolize=0 handle_abort=1"
+            export G_SLICE=always-malloc
+            export NSS_DISABLE_ARENA_FREE_LIST=1
+            export NSS_DISABLE_UNLOAD=1
+            export LLVM_SYMBOLIZER_PATH=$PWD/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer
+            export MOCHA_TIMEOUT=180000
+            echo "Piping output to ASAN_SYMBOLIZE ($ASAN_SYMBOLIZE)"
+            cd electron
+            runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --trace-uncaught --enable-logging --files $tests_files | $ASAN_SYMBOLIZE
+          else
+            if [ "${{ inputs.target-arch }}" = "arm" ]; then
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --skipYarnInstall --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+            else 
+              runuser -u builduser -- xvfb-run script/actions/run-tests.sh script/yarn.js test --runners=main --enableRerun=3 --trace-uncaught --enable-logging --files $tests_files
+            fi
+            
+          fi
+        fi
+    - name: Upload Test results to Datadog
+      env:
+        DD_ENV: ci
+        DD_SERVICE: electron
+        DD_API_KEY: ${{ secrets.DD_API_KEY }}
+        DD_CIVISIBILITY_LOGS_ENABLED: true
+        DD_TAGS: "os.architecture:${{ inputs.target-arch }},os.family:${{ inputs.target-platform }},os.platform:${{ inputs.target-platform }},asan:${{ inputs.is-asan }}"
+      run: |
+        if ! [ -z $DD_API_KEY ] && [ -f src/electron/junit/test-results-main.xml ]; then
+          cd src/electron
+          export DATADOG_PATH=`node script/yarn.js bin datadog-ci`
+          $DATADOG_PATH junit upload junit/test-results-main.xml
+        fi
+      if: always() && !cancelled()
+    - name: Upload Test Artifacts
+      if: always() && !cancelled()
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+      with:
+        name: test_artifacts_${{ env.ARTIFACT_KEY }}_${{ matrix.shard }}
+        path: src/electron/spec/artifacts
+        if-no-files-found: ignore
+    - name: Wait for active SSH sessions
+      if: always() && !cancelled()
+      shell: bash
+      run: |
+        while [ -f /var/.ssh-lock ]
+        do
+          sleep 60
+        done

.github/workflows/pipeline-segment-node-nan-test.yml

@@ -0,0 +1,158 @@
+name: Pipeline Segment - Node/Nan Test
+
+on:
+  workflow_call:
+    inputs:
+      target-platform:
+        type: string
+        description: 'Platform to run on, can be macos, win or linux'
+        required: true
+      target-arch:
+        type: string
+        description: 'Arch to build for, can be x64, arm64 or arm'
+        required: true
+      test-runs-on:
+        type: string
+        description: 'What host to run the tests on'
+        required: true
+      test-container:
+        type: string
+        description: 'JSON container information for aks runs-on'
+        required: false
+        default: '{"image":null}'
+      gn-build-type:
+        description: 'The gn build type - testing or release'
+        required: true
+        type: string
+        default: testing
+
+permissions: {}
+
+concurrency:
+  group: electron-node-nan-test-${{ inputs.target-platform }}-${{ inputs.target-arch }}-${{ github.ref_protected == true && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.ref_protected != true }}
+
+env:
+  CHROMIUM_GIT_COOKIE: ${{ secrets.CHROMIUM_GIT_COOKIE }}
+  ELECTRON_OUT_DIR: Default
+  ELECTRON_RBE_JWT: ${{ secrets.ELECTRON_RBE_JWT }}
+
+jobs:
+  node-tests:
+    name: Run Node.js Tests
+    runs-on: electron-arc-centralus-linux-amd64-8core
+    permissions:
+      contents: read
+    timeout-minutes: 30
+    env: 
+      TARGET_ARCH: ${{ inputs.target-arch }}
+      BUILD_TYPE: linux
+    container: ${{ fromJSON(inputs.test-container) }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
+    - name: Install Build Tools
+      uses: ./src/electron/.github/actions/install-build-tools
+    - name: Init Build Tools
+      run: |
+        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }} --import ${{ inputs.gn-build-type }} --target-cpu ${{ inputs.target-arch }}
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Download Generated Artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      with:
+        name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
+        path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
+    - name: Download Src Artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      with:
+        name: src_artifacts_linux_${{ env.TARGET_ARCH }}
+        path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
+    - name: Restore Generated Artifacts
+      run: ./src/electron/script/actions/restore-artifacts.sh
+    - name: Unzip Dist
+      run: |
+        cd src/out/Default
+        unzip -:o dist.zip
+    - name: Setup Linux for Headless Testing
+      run: sh -e /etc/init.d/xvfb start
+    - name: Run Node.js Tests
+      run: |
+        cd src
+        node electron/script/node-spec-runner.js --default --jUnitDir=junit
+    - name: Wait for active SSH sessions
+      if: always() && !cancelled()
+      shell: bash
+      run: |
+        while [ -f /var/.ssh-lock ]
+        do
+          sleep 60
+        done
+  nan-tests:
+    name: Run Nan Tests
+    runs-on: electron-arc-centralus-linux-amd64-4core
+    permissions:
+      contents: read
+    timeout-minutes: 30
+    env: 
+      TARGET_ARCH: ${{ inputs.target-arch }}
+      BUILD_TYPE: linux
+    container: ${{ fromJSON(inputs.test-container) }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Set Chromium Git Cookie
+      uses: ./src/electron/.github/actions/set-chromium-cookie
+    - name: Install Build Tools
+      uses: ./src/electron/.github/actions/install-build-tools
+    - name: Init Build Tools
+      run: |
+        e init -f --root=$(pwd) --out=Default ${{ inputs.gn-build-type }}
+    - name: Install Dependencies
+      uses: ./src/electron/.github/actions/install-dependencies
+    - name: Download Generated Artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      with:
+        name: generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
+        path: ./generated_artifacts_${{ env.BUILD_TYPE }}_${{ env.TARGET_ARCH }}
+    - name: Download Src Artifacts
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      with:
+        name: src_artifacts_linux_${{ env.TARGET_ARCH }}
+        path: ./src_artifacts_linux_${{ env.TARGET_ARCH }}
+    - name: Restore Generated Artifacts
+      run: ./src/electron/script/actions/restore-artifacts.sh
+    - name: Unzip Dist
+      run: |
+        cd src/out/Default
+        unzip -:o dist.zip
+    - name: Setup Linux for Headless Testing
+      run: sh -e /etc/init.d/xvfb start
+    - name: Add Clang problem matcher
+      shell: bash
+      run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
+    - name: Run Nan Tests
+      run: |
+        cd src
+        node electron/script/nan-spec-runner.js
+    - name: Remove Clang problem matcher
+      shell: bash
+      run: echo "::remove-matcher owner=clang::"
+    - name: Wait for active SSH sessions
+      shell: bash
+      if: always() && !cancelled()
+      run: |
+        while [ -f /var/.ssh-lock ]
+        do
+          sleep 60
+        done

.github/workflows/pull-request-labeled.yml

@@ -0,0 +1,46 @@
+name: Pull Request Labeled
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions: {}
+
+jobs:
+  pull-request-labeled-backport-requested:
+    name: backport/requested label added
+    if: github.event.label.name == 'backport/requested 🗳'
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Trigger Slack workflow
+        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
+        with:
+          webhook: ${{ secrets.BACKPORT_REQUESTED_SLACK_WEBHOOK_URL }} 
+          webhook-type: webhook-trigger
+          payload: |
+            {
+              "base_ref": ${{ toJSON(github.event.pull_request.base.ref) }},
+              "title": ${{ toJSON(github.event.pull_request.title) }},
+              "url": ${{ toJSON(github.event.pull_request.html_url) }},
+              "user": ${{ toJSON(github.event.pull_request.user.login) }}
+            }
+  pull-request-labeled-deprecation-review-complete:
+    name: deprecation-review/complete label added
+    if: github.event.label.name == 'deprecation-review/complete ✅'
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.RELEASE_BOARD_GH_APP_CREDS }}
+          org: electron
+      - name: Set status
+        uses: dsanders11/project-actions/edit-item@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          project-number: 94
+          field: Status
+          field-value: ✅ Reviewed

.github/workflows/scorecards.yml

@@ -0,0 +1,55 @@
+name: Scorecards supply-chain security
+on:
+  # Only the default branch is supported.
+  branch_protection_rule:
+  schedule:
+    - cron: '44 17 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Used to receive a badge.
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      # This is a pre-submit / pre-release.
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+
+          # Publish the results for public repositories to enable scorecard badges. For more details, see
+          # https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless
+          # of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.29.5
+        with:
+          sarif_file: results.sarif

.github/workflows/semantic.yml

@@ -0,0 +1,25 @@
+name: "Check Semantic Commit"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+permissions: {}
+
+jobs:
+  main:
+    permissions:
+      pull-requests: read  # for amannn/action-semantic-pull-request to analyze PRs
+      statuses: write  # for amannn/action-semantic-pull-request to mark status of analyzed PR
+    name: Validate PR Title
+    runs-on: ubuntu-latest
+    steps:
+      - name: semantic-pull-request
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          validateSingleCommit: false

.github/workflows/stable-prep-items.yml

@@ -0,0 +1,36 @@
+name: Check Stable Prep Items
+
+on:
+  schedule:
+    - cron:  '0 */12 * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  check-stable-prep-items:
+    name: Check Stable Prep Items
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.RELEASE_BOARD_GH_APP_CREDS }}
+          org: electron
+      - name: Find Newest Release Project Board
+        id: find-project-number
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |
+          set -eo pipefail
+          PROJECT_NUMBER=$(gh project list --owner electron --format json | jq -r '.projects | map(select(.title | test("^[0-9]+-x-y$"))) | max_by(.number) | .number')
+          echo "PROJECT_NUMBER=$PROJECT_NUMBER" >> "$GITHUB_OUTPUT"
+      - name: Update Completed Stable Prep Items
+        uses: dsanders11/project-actions/completed-by@2134fe7cc71c58b7ae259c82a8e63c6058255678 # v1.7.0
+        with:
+          field: Prep Status
+          field-value: ✅ Complete
+          project-number: ${{ steps.find-project-number.outputs.PROJECT_NUMBER }}
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/stale.yml

@@ -0,0 +1,54 @@
+name: 'Close stale issues'
+on:
+  workflow_dispatch:
+  schedule:
+    # 1:30am every day
+    - cron: '30 1 * * *'
+
+permissions: {}
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # tag: v10.1.1
+        with:
+          repo-token: ${{ steps.generate-token.outputs.token }}
+          days-before-stale: 90
+          days-before-close: 30
+          stale-issue-label: stale
+          operations-per-run: 1750
+          stale-issue-message: >
+            This issue has been automatically marked as stale. **If this issue is still affecting you, please leave any comment** (for example, "bump"), and we'll keep it open. If you have any new additional information—in particular, if this is still reproducible in the [latest version of Electron](https://www.electronjs.org/releases/stable) or in the [beta](https://www.electronjs.org/releases/beta)—please include it with your comment!
+          close-issue-message: >
+            This issue has been closed due to inactivity, and will not be monitored.  If this is a bug and you can reproduce this issue on a [supported version of Electron](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline) please open a new issue and include instructions for reproducing the issue.
+          exempt-issue-labels: "discussion,security \U0001F512,enhancement :sparkles:,status/confirmed,stale-exempt,upgrade-follow-up,tracking-upstream"
+          only-pr-labels: not-a-real-label
+  pending-repro:
+    runs-on: ubuntu-latest
+    permissions: {}
+    if: ${{ always() }}
+    needs: stale
+    steps:
+      - name: Generate GitHub App token
+        uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
+        id: generate-token
+        with:
+          creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # tag: v10.1.1
+        with:
+          repo-token: ${{ steps.generate-token.outputs.token }}
+          days-before-stale: -1
+          days-before-close: 10
+          remove-stale-when-updated: false
+          stale-issue-label: blocked/need-repro
+          stale-pr-label: not-a-real-label
+          operations-per-run: 1750
+          close-issue-message: >
+            Unfortunately, without a way to reproduce this issue, we're unable to continue investigation. This issue has been closed and will not be monitored further. If you're able to provide a minimal test case that reproduces this issue on a [supported version of Electron](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#timeline) please open a new issue and include instructions for reproducing the issue.

.github/workflows/update-website-docs.yml

@@ -0,0 +1,39 @@
+name: Update Website Docs
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  update-website-docs:
+    name: Update Website Docs
+    runs-on: ubuntu-latest
+    environment: website-docs-updater
+    permissions:
+      contents: read
+      id-token: write # needed for secret-service-action
+    steps:
+      - name: Get GitHub App token
+        id: secret-service
+        uses: electron/secret-service-action@3476425e8b30555aac15b1b7096938e254b0e155 # v1.0.0
+      - name: Check if this release is the latest
+        id: check-if-latest-release
+        env:
+          GH_REPO: electron/electron
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          LATEST_RELEASE_TAG="$(gh release view --json tagName --jq '.tagName')"
+          if [ "$LATEST_RELEASE_TAG" = "${GITHUB_REF#refs/tags/}" ]; then
+            echo "isLatestRelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "isLatestRelease=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Trigger website docs update
+        if: ${{ steps.check-if-latest-release.outputs.isLatestRelease }}
+        env:
+          GH_REPO: electron/website
+          GH_TOKEN: ${{ fromJSON(steps.secret-service.outputs.secrets).WEBSITE_DOCS_UPDATER_APP_TOKEN }}
+        run: |
+          gh workflow run update-docs.yml -f sha=$GITHUB_SHA

.github/workflows/windows-publish.yml

@@ -0,0 +1,99 @@
+name: Publish Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-image-sha:
+        type: string
+        description: 'SHA for electron/build image'
+        default: 'a82b87d7a4f5ff0cab61405f8151ac4cf4942aeb'
+        required: true
+      upload-to-storage:
+        description: 'Uploads to Azure storage'
+        required: false
+        default: '1'
+        type: string
+      run-windows-publish:
+        description: 'Run the publish jobs vs just the build jobs'
+        type: boolean
+        default: false
+
+permissions: {}
+
+jobs:
+  checkout-windows:
+    runs-on: electron-arc-centralus-linux-amd64-32core
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/electron/build:${{ inputs.build-image-sha }}
+      options: --user root --device /dev/fuse --cap-add SYS_ADMIN
+      volumes:
+        - /mnt/win-cache:/mnt/win-cache
+        - /var/run/sas:/var/run/sas
+    env:
+      CHROMIUM_GIT_COOKIE_WINDOWS_STRING: ${{ secrets.CHROMIUM_GIT_COOKIE_WINDOWS_STRING }}
+      GCLIENT_EXTRA_ARGS: '--custom-var=checkout_win=True'
+      TARGET_OS: 'win'
+      ELECTRON_DEPOT_TOOLS_WIN_TOOLCHAIN: '1'
+    outputs:
+      build-image-sha: ${{ inputs.build-image-sha }}
+    steps:
+    - name: Checkout Electron
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      with:
+        path: src/electron
+        fetch-depth: 0
+    - name: Checkout & Sync & Save
+      uses: ./src/electron/.github/actions/checkout
+      with:
+        generate-sas-token: 'true'
+        target-platform: win
+
+  publish-x64-win:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-windows
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      target-platform: win
+      target-arch: x64
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-arm64-win:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-windows
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      target-platform: win
+      target-arch: arm64
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit
+
+  publish-x86-win:
+    uses: ./.github/workflows/pipeline-segment-electron-build.yml
+    permissions:
+      contents: read
+    needs: checkout-windows
+    with:
+      environment: production-release
+      build-runs-on: electron-arc-centralus-windows-amd64-16core
+      target-platform: win
+      target-arch: x86
+      is-release: true
+      gn-build-type: release
+      generate-symbols: true
+      upload-to-storage: ${{ inputs.upload-to-storage }}
+    secrets: inherit

.gitignore

@@ -17,24 +17,6 @@
 *.xcodeproj
 /.idea/
 /dist/
-/external_binaries/
-/out/
-/vendor/.gclient
-/vendor/debian_jessie_mips64-sysroot/
-/vendor/debian_stretch_amd64-sysroot/
-/vendor/debian_stretch_arm-sysroot/
-/vendor/debian_stretch_arm64-sysroot/
-/vendor/debian_stretch_i386-sysroot/
-/vendor/gcc-4.8.3-d197-n64-loongson/
-/vendor/readme-gcc483-loongson.txt
-/vendor/download/
-/vendor/llvm-build/
-/vendor/llvm/
-/vendor/npm/
-/vendor/python_26/
-/vendor/native_mksnapshot
-/vendor/LICENSES.chromium.html
-/vendor/pyyaml
 node_modules/
 SHASUMS256.txt
 **/package-lock.json
@@ -44,6 +26,7 @@ compile_commands.json
 # npm package
 /npm/dist
 /npm/path.txt
+/npm/checksums.json
 
 .npmrc
 
@@ -55,10 +38,20 @@ electron.d.ts
 spec/.hash
 
 # Eslint Cache
-.eslintcache
+.eslintcache*
 
 # Generated native addon files
 /spec/fixtures/native-addon/echo/build/
 
 # If someone runs tsc this is where stuff will end up
 ts-gen
+
+# Used to accelerate CI builds
+.depshash
+
+# Used to accelerate builds after sync
+patches/mtime-cache.json
+
+spec/fixtures/logo.png
+
+.yarn/install-state.gz

.gitmodules

@@ -1,6 +0,0 @@
-[submodule "vendor/requests"]
-	path = vendor/requests
-	url = https://github.com/kennethreitz/requests
-[submodule "vendor/boto"]
-	path = vendor/boto
-	url = https://github.com/boto/boto.git

.husky/pre-commit

@@ -0,0 +1 @@
+npm run precommit

.husky/pre-push

@@ -0,0 +1 @@
+npm run prepack

.lint-roller.json

@@ -0,0 +1,13 @@
+{
+  "markdown-ts-check": {
+    "defaultImports": [
+      "import * as childProcess from 'node:child_process'",
+      "import * as fs from 'node:fs'",
+      "import * as path from 'node:path'",
+      "import { app, autoUpdater, contextBridge, crashReporter, dialog, BrowserWindow, ipcMain, ipcRenderer, Menu, MessageChannelMain, nativeImage, net, protocol, session, systemPreferences, Tray, utilityProcess, webFrame, webFrameMain } from 'electron'"
+    ],
+    "typings": [
+      "../electron.d.ts"
+    ]
+  }
+}

.markdownlint-cli2.jsonc

@@ -0,0 +1,34 @@
+{
+  "config": {
+    "extends": "@electron/lint-roller/configs/markdownlint.json",
+    "descriptive-link-text": false,
+    "link-image-style": {
+      "autolink": false,
+      "shortcut": false
+    },
+    "MD049": {
+      "style": "underscore"
+    },
+    "no-angle-brackets": true,
+    "no-curly-braces": true,
+    "no-inline-html": {
+      "allowed_elements": [
+        "br",
+        "details",
+        "img",
+        "li",
+        "summary",
+        "ul",
+        "unknown",
+        "Tabs",
+        "TabItem",
+        "DocCardList",
+        "kbd"
+      ]
+    },
+    "no-newline-in-links": true
+  },
+  "customRules": [
+    "./node_modules/@electron/lint-roller/markdownlint-rules/index.mjs"
+  ]
+}

.nvmrc

@@ -0,0 +1 @@
+22

.yarnrc.yml

@@ -0,0 +1,12 @@
+enableScripts: false
+
+nmHoistingLimits: workspaces
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 10080
+
+npmPreapprovedPackages:
+  - "@electron/*"
+
+yarnPath: .yarn/releases/yarn-4.12.0.cjs

CLAUDE.md

@@ -0,0 +1,226 @@
+# Electron Development Guide
+
+## Project Overview
+
+Electron is a framework for building cross-platform desktop applications using web technologies. It embeds Chromium for rendering and Node.js for backend functionality.
+
+## Directory Structure
+
+```text
+electron/                 # This repo (run `e` commands here)
+├── shell/               # Core C++ application code
+│   ├── browser/         # Main process implementation (107+ API modules)
+│   ├── renderer/        # Renderer process code
+│   ├── common/          # Shared code between processes
+│   ├── app/             # Application entry points
+│   └── services/        # Node.js service integration
+├── lib/                 # TypeScript/JavaScript library code
+│   ├── browser/         # Main process JS (47 API implementations)
+│   ├── renderer/        # Renderer process JS
+│   └── common/          # Shared JS modules
+├── patches/             # Patches for upstream dependencies
+│   ├── chromium/        # ~159 patches to Chromium
+│   ├── node/            # ~48 patches to Node.js
+│   └── ...              # Other targets (v8, boringssl, etc.)
+├── spec/                # Test suite (1189+ TypeScript test files)
+├── docs/                # API documentation and guides
+├── build/               # Build configuration
+├── script/              # Build and automation scripts
+└── chromium_src/        # Chromium source overrides
+../                      # Parent directory is Chromium source
+```
+
+## Build Tools Setup
+
+Electron uses `@electron/build-tools` for development. The `e` command is the primary CLI.
+
+**Installation:**
+
+```bash
+npm i -g @electron/build-tools
+```
+
+**Configuration location:** `~/.electron_build_tools/configs/`
+
+## Essential Commands
+
+### Configuration Management
+
+| Command | Purpose |
+|---------|---------|
+| `e init <name> --root=<path> --bootstrap testing` | Create new build config and sync |
+| `e use <name>` | Switch to a different build configuration |
+| `e show current` | Display active configuration name |
+| `e show configs` | List all available configurations |
+
+### Build & Development Loop
+
+| Command | Purpose |
+|---------|---------|
+| `e sync` | Fetch/update all source code and apply patches |
+| `e sync --3` | Sync with 3-way merge (required for Chromium upgrades) |
+| `e build` | Build Electron (runs GN + Ninja) |
+| `e build -k 999` | Build and continue on errors (up to 999) |
+| `e build -t <target>` | Build specific target (e.g., `electron:node_headers`) |
+| `e start` | Run the built Electron executable |
+| `e start --version` | Verify Electron launches and print version |
+| `e test` | Run the test suite |
+| `e debug` | Run Electron in debugger (lldb on macOS, gdb on Linux) |
+
+### Patch Management
+
+| Command | Purpose |
+|---------|---------|
+| `e patches <target>` | Export patches for a target (chromium, node, v8, etc.) |
+| `e patches all` | Export all patches from all targets |
+| `e patches --list-targets` | List available patch targets |
+
+## Typical Development Workflow
+
+```bash
+# 1. Ensure you're on the right config
+e show current
+
+# 2. Sync to get latest code
+e sync
+
+# 3. Make your changes in shell/ or lib/ or ../
+
+# 4. Build
+e build
+
+# 5. Test your changes (Leave the user to do this, don't run these commands unless asked)
+e start
+e test
+
+# 6. If you modified patched files in Chromium:
+cd ..  # Go to Chromium repo
+git add <files>
+git commit -m "description of change"
+cd electron
+e patches chromium  # Export the patch
+```
+
+## Patches System
+
+Electron patches upstream dependencies (Chromium, Node.js, V8, etc.) to add features or modify behavior.
+
+**How patches work:**
+
+```text
+patches/{target}/*.patch  →  [e sync --3]  →  target repo commits
+                          ←  [e patches]   ←
+```
+
+**Patch configuration:** `patches/config.json` maps patch directories to target repos.
+
+**Key rules:**
+
+- Fix existing patches 99% of the time rather than creating new ones
+- Preserve original authorship in TODO comments
+- Never change TODO assignees (`TODO(name)` must retain original name)
+- Each patch file includes commit message explaining its purpose
+
+**Creating/modifying patches:**
+
+1. Make changes in the target repo (e.g., `../` for Chromium)
+2. Create a git commit
+3. Run `e patches <target>` to export
+
+## Testing
+
+**Test location:** `spec/` directory
+
+**Running tests:**
+
+```bash
+e test                    # Run full test suite
+```
+
+**Test frameworks:** Mocha, Chai, Sinon
+
+## Build Configuration
+
+**GN build arguments:** Located in `build/args/`:
+
+- `testing.gn` - Debug/testing builds
+- `release.gn` - Release builds
+- `all.gn` - Common arguments for all builds
+
+**Main build file:** `BUILD.gn`
+
+**Feature flags:** `buildflags/buildflags.gni`
+
+## Chromium Upgrade Workflow
+
+When working on the `roller/chromium/main` branch to upgrade Chromium activate the "Electron Chromium Upgrade" skill.
+
+## Code Style
+
+**C++:** Follows Chromium style, enforced by clang-format
+**TypeScript/JavaScript:** ESLint configuration in `.eslintrc.json`
+
+**Linting:**
+
+```bash
+npm run lint              # Run all linters
+npm run lint:clang-format # C++ formatting
+```
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `BUILD.gn` | Main GN build configuration |
+| `DEPS` | Dependency versions and checkout paths |
+| `patches/config.json` | Patch target configuration |
+| `filenames.gni` | Source file lists by platform |
+| `package.json` | Node.js dependencies and scripts |
+
+## Environment Variables
+
+| Variable | Purpose |
+|----------|---------|
+| `GN_EXTRA_ARGS` | Additional GN arguments (useful in CI) |
+| `ELECTRON_RUN_AS_NODE=1` | Run Electron as Node.js |
+
+## Useful Git Commands for Chromium
+
+```bash
+# Find CL that changed a file
+cd ..
+git log --oneline -10 -- {file}
+git blame -L {start},{end} -- {file}
+
+# Look for Chromium CL reference in commit
+git log -1 {commit_sha}  # Find "Reviewed-on:" line
+
+# Find which patch affects a file
+grep -l "filename.cc" patches/chromium/*.patch
+```
+
+## CI/CD
+
+GitHub Actions workflows in `.github/workflows/`:
+
+- `build.yml` - Main build workflow
+- `pipeline-electron-lint.yml` - Linting
+- `pipeline-segment-electron-test.yml` - Testing
+
+## Common Issues
+
+**Patch conflict during sync:**
+
+- Use `e sync --3` for 3-way merge
+- Check if file was renamed/moved upstream
+- Verify patch is still needed
+
+**Build error in patched file:**
+
+- Find the patch: `grep -l "filename" patches/chromium/*.patch`
+- Match existing patch style (#if 0 guards, BUILDFLAG conditionals, etc.)
+
+**Remote build issues:**
+
+- Try `e build --no-remote` to build locally
+- Check reclient/siso configuration in your build config

CODE_OF_CONDUCT.md

@@ -1,46 +1,135 @@
-# Contributor Covenant Code of Conduct:
+# Code of Conduct
 
-## Our Pledge
+As a member project of the OpenJS Foundation, Electron uses [Contributor Covenant v2.0](https://contributor-covenant.org/version/2/0/code_of_conduct) as their code of conduct. The full text is included [below](#contributor-covenant-code-of-conduct) in English, and translations are available from the Contributor Covenant organisation:
 
-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+* [contributor-covenant.org/translations](https://www.contributor-covenant.org/translations)
+* [github.com/ContributorCovenant](https://github.com/ContributorCovenant/contributor_covenant/tree/release/content/version/2/0)
 
-## Our Standards
+## Contributor Covenant Code of Conduct
 
-Examples of behavior that contributes to creating a positive environment include:
+### Our Pledge
 
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
 
-Examples of unacceptable behavior by participants include:
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
 
-* The use of sexualized language or imagery and unwelcome sexual attention or advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
+### Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
 * Public or private harassment
-* Publishing others' private information, such as a physical or electronic address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a professional setting
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
 
-## Our Responsibilities
+### Enforcement Responsibilities
 
-Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
 
-Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
 
-## Scope
+### Scope
 
-This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
 
-## Enforcement
+### Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at [coc@electronjs.org](mailto:coc@electronjs.org). All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[coc@electronjs.org](mailto:coc@electronjs.org).
+All complaints will be reviewed and investigated promptly and fairly.
 
-Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
 
-## Attribution
+### Enforcement Guidelines
 
-This Code of Conduct is adapted from the [Contributor-Covenant][homepage], version 1.4, available at [https://contributor-covenant.org/version/1/4][version]
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
 
-[homepage]: https://contributor-covenant.org
-[version]: https://contributor-covenant.org/version/1/4/
+#### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+#### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+#### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+#### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+### Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/inclusion).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -12,7 +12,7 @@ propose changes to this document in a pull request.
 
 ## [Issues](https://electronjs.org/docs/development/issues)
 
-Issues are created [here](https://github.com/electron/electron/issues/new).
+Issues are created [here](https://github.com/electron/electron/issues/new/choose).
 
 * [How to Contribute in Issues](https://electronjs.org/docs/development/issues#how-to-contribute-in-issues)
 * [Asking for General Help](https://electronjs.org/docs/development/issues#asking-for-general-help)
@@ -20,13 +20,23 @@ Issues are created [here](https://github.com/electron/electron/issues/new).
 * [Triaging a Bug Report](https://electronjs.org/docs/development/issues#triaging-a-bug-report)
 * [Resolving a Bug Report](https://electronjs.org/docs/development/issues#resolving-a-bug-report)
 
-### Issue Maintenance and Closure
-* If an issue is inactive for 45 days (no activity of any kind), it will be
-marked for closure with `stale`.
-* If after this label is applied, no further activity occurs in the next 7 days,
-the issue will be closed.
-  * If an issue has been closed and you still feel it's relevant, feel free to
-  ping a maintainer or add a comment!
+### Issue Closure
+
+Bug reports will be closed if the issue has been inactive and the latest affected version no longer receives support. At the moment, Electron maintains its three latest major versions, with a new major version being released every 8 weeks. (For more information on Electron's release cadence, see [this blog post](https://electronjs.org/blog/8-week-cadence).)
+
+_If an issue has been closed and you still feel it's relevant, feel free to ping a maintainer or add a comment!_
+
+### Languages
+
+We accept issues in _any_ language.
+When an issue is posted in a language besides English, it is acceptable and encouraged to post an English-translated copy as a reply.
+Anyone may post the translated reply.
+In most cases, a quick pass through translation software is sufficient.
+Having the original text _as well as_ the translation can help mitigate translation errors.
+
+Responses to posted issues may or may not be in the original language.
+
+**Please note** that using non-English as an attempt to circumvent our [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) will be an immediate, and possibly indefinite, ban from the project.
 
 ## [Pull Requests](https://electronjs.org/docs/development/pull-requests)
 
@@ -37,24 +47,28 @@ dependencies, and tools contained in the `electron/electron` repository.
   * [Step 1: Fork](https://electronjs.org/docs/development/pull-requests#step-1-fork)
   * [Step 2: Build](https://electronjs.org/docs/development/pull-requests#step-2-build)
   * [Step 3: Branch](https://electronjs.org/docs/development/pull-requests#step-3-branch)
-* [The Process of Making Changes](https://electronjs.org/docs/development/pull-requests#the-process-of-making-changes)
+* [Making Changes](https://electronjs.org/docs/development/pull-requests#making-changes)
   * [Step 4: Code](https://electronjs.org/docs/development/pull-requests#step-4-code)
   * [Step 5: Commit](https://electronjs.org/docs/development/pull-requests#step-5-commit)
     * [Commit message guidelines](https://electronjs.org/docs/development/pull-requests#commit-message-guidelines)
   * [Step 6: Rebase](https://electronjs.org/docs/development/pull-requests#step-6-rebase)
   * [Step 7: Test](https://electronjs.org/docs/development/pull-requests#step-7-test)
   * [Step 8: Push](https://electronjs.org/docs/development/pull-requests#step-8-push)
-  * [Step 8: Opening the Pull Request](https://electronjs.org/docs/development/pull-requests#step-8-opening-the-pull-request)
-  * [Step 9: Discuss and Update](#step-9-discuss-and-update)
+  * [Step 9: Opening the Pull Request](https://electronjs.org/docs/development/pull-requests#step-9-opening-the-pull-request)
+  * [Step 10: Discuss and Update](https://electronjs.org/docs/development/pull-requests#step-10-discuss-and-update)
     * [Approval and Request Changes Workflow](https://electronjs.org/docs/development/pull-requests#approval-and-request-changes-workflow)
-  * [Step 10: Landing](https://electronjs.org/docs/development/pull-requests#step-10-landing)
+  * [Step 11: Landing](https://electronjs.org/docs/development/pull-requests#step-11-landing)
   * [Continuous Integration Testing](https://electronjs.org/docs/development/pull-requests#continuous-integration-testing)
 
+### Dependencies Upgrades Policy
+
+Dependencies in Electron's `package.json` or `yarn.lock` files should only be altered by maintainers. For security reasons, we will not accept PRs that alter our `package.json` or `yarn.lock` files. We invite contributors to make requests updating these files in our issue tracker. If the change is significantly complicated, draft PRs are welcome, with the understanding that these PRs will be closed in favor of a duplicate PR submitted by an Electron maintainer.
+
 ## Style Guides
 
 See [Coding Style](https://electronjs.org/docs/development/coding-style) for information about which standards Electron adheres to in different parts of its codebase.
 
 ## Further Reading
 
-For more in-depth guides on developing Electron, see 
-[/docs/development](/docs/development/README.md)
+For more in-depth guides on developing Electron, see
+[/docs/development](/docs/development/README.md).

DEPS

@@ -1,61 +1,65 @@
-gclient_gn_args_file = 'src/build/config/gclient_args.gni'
-gclient_gn_args = [
-  'build_with_chromium',
-  'checkout_android',
-  'checkout_android_native_support',
-  'checkout_libaom',
-  'checkout_nacl',
-  'checkout_oculus_sdk'
-]
+gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '76.0.3809.146',
+    '146.0.7645.0',
   'node_version':
-    'v12.4.0',
+    'v24.13.0',
+  'nan_version':
+    '675cefebca42410733da8a454c8d9391fcebfbc2',
+  'squirrel.mac_version':
+    '0e5d146ba13101a1302d59ea6e6e0b3cace4ae38',
+  'reactiveobjc_version':
+    '74ab5baccc6f7202c8ac69a8d1e152c29dc1ea76',
+  'mantle_version':
+    '2a8e2123a3931038179ee06105c9e6ec336b12ea',
+  'engflow_reclient_configs_version':
+    '955335c30a752e9ef7bff375baab5e0819b6c00d',
 
-  'boto_version': 'f7574aa6cc2c819430c1f05e9a1a1a666ef8169b',
   'pyyaml_version': '3.12',
-  'requests_version': 'e4d59bedfd3c7f4f254f4f5d036587bcd8152458',
 
-  'boto_git': 'https://github.com/boto',
   'chromium_git': 'https://chromium.googlesource.com',
   'electron_git': 'https://github.com/electron',
   'nodejs_git': 'https://github.com/nodejs',
-  'requests_git': 'https://github.com/kennethreitz',
   'yaml_git': 'https://github.com/yaml',
-
-  # KEEP IN SYNC WITH spec-runner FILE
-  'yarn_version': '1.15.2',
+  'squirrel_git': 'https://github.com/Squirrel',
+  'reactiveobjc_git': 'https://github.com/ReactiveCocoa',
+  'mantle_git': 'https://github.com/Mantle',
+  'engflow_git': 'https://github.com/EngFlow',
+  
+  # The path of the sysroots.json file.
+  'sysroots_json_path': 'electron/script/sysroots.json',
 
   # To be able to build clean Chromium from sources.
   'apply_patches': True,
 
-  # Apply the patches specific to windows on arm64
-  'apply_win_arm64_patches': False,
-
-  # Python interface to Amazon Web Services. Is used for releases only.
-  'checkout_boto': False,
+  # To use an mtime cache for patched files to speed up builds.
+  'use_mtime_cache': True,
 
   # To allow in-house builds to checkout those manually.
   'checkout_chromium': True,
   'checkout_node': True,
+  'checkout_nan': True,
+  'checkout_pgo_profiles': True,
 
   # It's only needed to parse the native tests configurations.
   'checkout_pyyaml': False,
 
-  # Python "requests" module is used for releases only.
-  'checkout_requests': False,
+  # Can be used to disable the sysroot hooks.
+  'install_sysroot': True,
 
-  # It is always needed for normal Electron builds,
-  # but might be impossible for custom in-house builds.
-  'download_external_binaries': True,
+  'use_rts': False,
+
+  'mac_xcode_version': 'default',
+
+  'generate_location_tags': False,
+
+  # To allow running hooks without parsing the DEPS tree
+  'process_deps': True,
 
   'checkout_nacl':
     False,
-  'checkout_libaom':
-    True,
-  'checkout_oculus_sdk':
+  'checkout_openxr':
     False,
   'build_with_chromium':
     True,
@@ -63,89 +67,141 @@ vars = {
     False,
   'checkout_android_native_support':
     False,
+  'checkout_clang_tidy':
+    True,
 }
 
 deps = {
   'src': {
     'url': (Var("chromium_git")) + '/chromium/src.git@' + (Var("chromium_version")),
-    'condition': 'checkout_chromium',
+    'condition': 'checkout_chromium and process_deps',
+  },
+  'src/third_party/nan': {
+    'url': (Var("nodejs_git")) + '/nan.git@' + (Var("nan_version")),
+    'condition': 'checkout_nan and process_deps',
   },
   'src/third_party/electron_node': {
     'url': (Var("nodejs_git")) + '/node.git@' + (Var("node_version")),
-    'condition': 'checkout_node',
+    'condition': 'checkout_node and process_deps',
   },
-  'src/electron/vendor/pyyaml': {
+  'src/third_party/pyyaml': {
     'url': (Var("yaml_git")) + '/pyyaml.git@' + (Var("pyyaml_version")),
-    'condition': 'checkout_pyyaml',
+    'condition': 'checkout_pyyaml and process_deps',
   },
-  'src/electron/vendor/boto': {
-    'url': Var('boto_git') + '/boto.git' + '@' +  Var('boto_version'),
-    'condition': 'checkout_boto',
+  'src/third_party/squirrel.mac': {
+    'url': Var("squirrel_git") + '/Squirrel.Mac.git@' + Var("squirrel.mac_version"),
+    'condition': 'process_deps',
   },
-  'src/electron/vendor/requests': {
-    'url': Var('requests_git') + '/requests.git' + '@' +  Var('requests_version'),
-    'condition': 'checkout_requests',
+  'src/third_party/squirrel.mac/vendor/ReactiveObjC': {
+    'url': Var("reactiveobjc_git") + '/ReactiveObjC.git@' + Var("reactiveobjc_version"),
+    'condition': 'process_deps'
   },
+  'src/third_party/squirrel.mac/vendor/Mantle': {
+    'url':  Var("mantle_git") + '/Mantle.git@' + Var("mantle_version"),
+    'condition': 'process_deps',
+  },
+  'src/third_party/engflow-reclient-configs': {
+    'url': Var("engflow_git") + '/reclient-configs.git@' + Var("engflow_reclient_configs_version"),
+    'condition': 'process_deps'
+  }
 }
 
+pre_deps_hooks = [
+  {
+    'name': 'generate_mtime_cache',
+    'condition': '(checkout_chromium and apply_patches and use_mtime_cache) and process_deps',
+    'pattern': 'src/electron',
+    'action': [
+      'python3',
+      'src/electron/script/patches-mtime-cache.py',
+      'generate',
+      '--cache-file',
+      'src/electron/patches/mtime-cache.json',
+      '--patches-config',
+      'src/electron/patches/config.json',
+    ],
+  },
+]
+
 hooks = [
   {
     'name': 'patch_chromium',
-    'condition': 'checkout_chromium and apply_patches',
+    'condition': '(checkout_chromium and apply_patches) and process_deps',
     'pattern': 'src/electron',
     'action': [
-      'python',
+      'python3',
       'src/electron/script/apply_all_patches.py',
-      'src/electron/patches/common/config.json',
+      'src/electron/patches/config.json',
     ],
   },
   {
-    'name': 'patch_chromium',
-    'condition': '(checkout_chromium and apply_patches) and apply_win_arm64_patches',
+    'name': 'apply_mtime_cache',
+    'condition': '(checkout_chromium and apply_patches and use_mtime_cache) and process_deps',
     'pattern': 'src/electron',
     'action': [
-      'python',
-      'src/electron/script/apply_all_patches.py',
-      'src/electron/patches/win_arm64/config.json',
-    ],
-  },
-  {
-    'name': 'electron_external_binaries',
-    'pattern': 'src/electron/script/update-external-binaries.py',
-    'condition': 'download_external_binaries',
-    'action': [
-      'python',
-      'src/electron/script/update-external-binaries.py',
+      'python3',
+      'src/electron/script/patches-mtime-cache.py',
+      'apply',
+      '--cache-file',
+      'src/electron/patches/mtime-cache.json',
     ],
   },
   {
     'name': 'electron_npm_deps',
     'pattern': 'src/electron/package.json',
     'action': [
-      'python',
+      'python3',
       '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["python", "script/lib/npx.py", "yarn@' + (Var("yarn_version")) + '", "install", "--frozen-lockfile"]);',
+      'import os, subprocess; os.chdir(os.path.join("src", "electron")); subprocess.check_call(["node", ".yarn/releases/yarn-4.12.0.cjs", "install", "--immutable"]);',
     ],
   },
   {
-    'name': 'setup_boto',
-    'pattern': 'src/electron',
-    'condition': 'checkout_boto',
-    'action': [
-      'python',
-      '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron", "vendor", "boto")); subprocess.check_call(["python", "setup.py", "build"]);',
-    ],
+    'name': 'sysroot_arm',
+    'pattern': '.',
+    'condition': 'install_sysroot and checkout_linux and checkout_arm',
+    'action': ['python3', 'src/build/linux/sysroot_scripts/install-sysroot.py',
+               '--sysroots-json-path=' + Var('sysroots_json_path'),
+               '--arch=arm'],
   },
   {
-    'name': 'setup_requests',
-    'pattern': 'src/electron',
-    'condition': 'checkout_requests',
-    'action': [
-      'python',
-      '-c',
-      'import os, subprocess; os.chdir(os.path.join("src", "electron", "vendor", "requests")); subprocess.check_call(["python", "setup.py", "build"]);',
-    ],
+    'name': 'sysroot_arm64',
+    'pattern': '.',
+    'condition': 'install_sysroot and checkout_linux and checkout_arm64',
+    'action': ['python3', 'src/build/linux/sysroot_scripts/install-sysroot.py',
+               '--sysroots-json-path=' + Var('sysroots_json_path'),
+               '--arch=arm64'],
+  },
+  {
+    'name': 'sysroot_x86',
+    'pattern': '.',
+    'condition': 'install_sysroot and checkout_linux and (checkout_x86 or checkout_x64)',
+    'action': ['python3', 'src/build/linux/sysroot_scripts/install-sysroot.py',
+               '--sysroots-json-path=' + Var('sysroots_json_path'),
+               '--arch=x86'],
+  },
+  {
+    'name': 'sysroot_mips',
+    'pattern': '.',
+    'condition': 'install_sysroot and checkout_linux and checkout_mips',
+    'action': ['python3', 'src/build/linux/sysroot_scripts/install-sysroot.py',
+               '--sysroots-json-path=' + Var('sysroots_json_path'),
+               '--arch=mips'],
+  },
+  {
+    'name': 'sysroot_mips64',
+    'pattern': '.',
+    'condition': 'install_sysroot and checkout_linux and checkout_mips64',
+    'action': ['python3', 'src/build/linux/sysroot_scripts/install-sysroot.py',
+               '--sysroots-json-path=' + Var('sysroots_json_path'),
+               '--arch=mips64el'],
+  },
+  {
+    'name': 'sysroot_x64',
+    'pattern': '.',
+    'condition': 'install_sysroot and checkout_linux and checkout_x64',
+    'action': ['python3', 'src/build/linux/sysroot_scripts/install-sysroot.py',
+               '--sysroots-json-path=' + Var('sysroots_json_path'),
+               '--arch=x64'],
   },
 ]
 

Dockerfile

@@ -1,47 +0,0 @@
-FROM ubuntu:18.04
-
-RUN groupadd --gid 1000 builduser \
-  && useradd --uid 1000 --gid builduser --shell /bin/bash --create-home builduser
-
-# Set up TEMP directory
-ENV TEMP=/tmp
-RUN chmod a+rwx /tmp
-
-# Install Linux packages
-ADD build/install-build-deps.sh /setup/install-build-deps.sh
-RUN echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true | debconf-set-selections
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    curl \
-    libnotify-bin \
-    locales \
-    lsb-release \
-    nano \
-    python-dbus \
-    python-pip \
-    python-setuptools \
-    sudo \
-    vim-nox \
-    wget \
-  && /setup/install-build-deps.sh --syms --no-prompt --no-chromeos-fonts --lib32 --arm \
-  && rm -rf /var/lib/apt/lists/*
-
-# Install Node.js
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash - \
-  && DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs \
-  && rm -rf /var/lib/apt/lists/*
-
-# crcmod is required by gsutil, which is used for filling the gclient git cache
-RUN pip install -U crcmod
-
-# dbusmock is needed for Electron tests
-RUN pip install python-dbusmock
-
-RUN mkdir /tmp/workspace
-RUN chown builduser:builduser /tmp/workspace
-
-# Add xvfb init script
-ADD tools/xvfb-init.sh /etc/init.d/xvfb
-RUN chmod a+x /etc/init.d/xvfb
-
-USER builduser
-WORKDIR /home/builduser