Upstream sync needs review

.github/workflows/fork-budget.yml

@@ -0,0 +1,54 @@
+name: Fork job budget
+
+# Fails a run before it spends runners once the fork has run too many jobs in
+# the last 24 hours. GitHub froze this fork's Actions in October 2026 after
+# about 650 jobs in 2.5 days (up to 315 in one day). The count covers every
+# workflow's jobs that got a runner, retries included, so runs cancelled while
+# waiting (fork-release's settle wait) cost nothing. Raise or lower the limit
+# with the FORK_JOB_BUDGET repository variable.
+
+on:
+  workflow_call:
+
+permissions:
+  actions: read
+
+jobs:
+  budget:
+    name: Check job budget
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ github.token }}
+      LIMIT: ${{ vars.FORK_JOB_BUDGET || 150 }}
+    steps:
+      - run: |
+          set -euo pipefail
+          since=$(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ)
+          # Lists every run because reruns keep the run's created_at. Marks the
+          # runs that may have started jobs since the cutoff: unfinished ones,
+          # and finished ones updated since (a run updates when it ends, after
+          # its last job started). Assigned first so a failed API call fails
+          # the job instead of counting nothing.
+          runs=$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs?per_page=100" \
+            --jq ".workflow_runs[] | \"\(.id) \(.status != \"completed\" or .updated_at >= \"$since\")\"")
+          # The listing quietly ends at 40,000 runs, which would hide newer reruns of older runs.
+          if (( $(wc -l <<< "$runs") >= 40000 )); then
+            echo "::error::Over 40,000 runs; too many to count."
+            exit 1
+          fi
+          # Collects jobs a runner started since the cutoff. Rerunning failed
+          # jobs copies the passed ones into the new attempt under new job IDs
+          # but with their original runner and start time, so each runner start
+          # counts once.
+          starts=""
+          for id in $(awk '$2 == "true" { print $1 }' <<< "$runs"); do
+            starts+=$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$id/jobs?filter=all&per_page=100" \
+              --jq ".jobs[] | select((.runner_name // \"\") != \"\" and .started_at >= \"$since\") | \"\(.runner_id) \(.started_at)\"")$'\n'
+          done
+          used=$(awk 'NF && !seen[$0]++' <<< "$starts" | wc -l)
+          echo "$used of $LIMIT jobs used in the last 24 hours."
+          if (( used >= LIMIT )); then
+            echo "::error::The fork ran $used jobs in the last 24 hours (limit $LIMIT). Rerun this workflow once older runs age out."
+            exit 1
+          fi

.github/workflows/fork-checks.yml

@@ -0,0 +1,177 @@
+name: Fork checks
+
+# The release gate from upstream's release.yml (quality, tests, sharded server
+# tests) on GitHub-hosted runners, which this fork has instead of Blacksmith.
+# Called by fork-sync.yml before promoting a sync, by fork-pr-checks.yml, and
+# by fork-release.yml before publishing.
+#
+# When every check passes on a ref given as a full commit SHA, the record job
+# sets a `fork-checks` commit status on that commit, naming the commit this
+# workflow file came from. Fork
+# release skips its checks when that status is on the commit it releases and
+# this file is unchanged there (a promoted sync candidate, or a branch checked
+# with Fork PR checks and pushed to main unchanged). Only the record job can
+# write statuses: the check jobs run the checked ref's code, which could
+# otherwise forge a pass. Callers grant statuses: write.
+
+on:
+  workflow_call:
+    inputs:
+      repository:
+        default: ${{ github.repository }}
+        type: string
+      ref:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
+      - name: Check
+        run: vp check
+
+      - name: Typecheck
+        run: vp run typecheck
+
+  test:
+    name: Tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
+      - name: Install browser secret helper build libraries
+        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config build-essential
+
+      - name: Test
+        run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' --filter '!@t3tools/web' test
+
+      - name: Test fork scripts
+        if: hashFiles('fork/scripts/*.test.cjs') != ''
+        run: node --test 'fork/scripts/*.test.cjs'
+
+  # The web suite gets its own job, as in upstream's ci.yml: sharing a 4-vCPU
+  # runner with the other packages starved its 30 s import hooks into timeouts.
+  test_web:
+    name: Web tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      # Upstream runs React tests in headless Chromium. Older upstream bases
+      # have no web Playwright dependency and no browser tests.
+      - name: Install Chromium for web browser tests
+        run: |
+          if [[ -f apps/web/node_modules/playwright/cli.js ]]; then
+            node apps/web/node_modules/playwright/cli.js install --with-deps --only-shell chromium
+          fi
+
+      - name: Test
+        run: vp run --filter @t3tools/web test
+
+  test_server:
+    name: Server tests ${{ matrix.shard }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install Chromium for server browser integration tests
+        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+
+      - name: Test
+        run: vp run --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }}
+
+  record:
+    name: Record pass
+    needs: [quality, test, test_web, test_server]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      statuses: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REF: ${{ inputs.ref }}
+    steps:
+      # Only a full commit SHA proves every job checked the same commit; a
+      # branch can move between their checkouts. A local reusable workflow
+      # comes from the caller's commit, GITHUB_SHA.
+      - run: |
+          if [[ ! $REF =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Checked ref $REF is not a full commit SHA; not recording a reusable pass."
+            exit 0
+          fi
+          gh api "repos/$GITHUB_REPOSITORY/statuses/$REF" -f state=success -f context=fork-checks \
+            -f "description=checks@$GITHUB_SHA" \
+            -f "target_url=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > /dev/null

.github/workflows/fork-pr-checks.yml

@@ -0,0 +1,42 @@
+name: Fork PR checks
+
+# Runs upstream's release gate (fork-checks.yml) on a branch prepared for an
+# upstream pull request. Upstream holds CI on PRs from unvouched contributors
+# at "action required" until a maintainer approves the run, so this is the
+# fork's own evidence that the branch passes.
+#
+# Upstream PR branches start from upstream main and don't contain this file,
+# so pushes to them can't trigger it. Start it from main instead:
+#   gh workflow run fork-pr-checks.yml -R Alb11747/t3code -f ref=<branch-or-sha>
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Branch or commit to check
+        required: true
+        type: string
+
+concurrency:
+  group: fork-pr-checks-${{ inputs.ref }}
+  cancel-in-progress: true
+
+permissions:
+  # The job budget reads the repository's recent runs.
+  actions: read
+  contents: read
+
+jobs:
+  budget:
+    name: Job budget
+    uses: ./.github/workflows/fork-budget.yml
+
+  checks:
+    name: Checks
+    needs: [budget]
+    permissions:
+      contents: read
+      statuses: write
+    uses: ./.github/workflows/fork-checks.yml
+    with:
+      ref: ${{ inputs.ref }}