fix(a11y): dialog semantics, focus management, icon labels, html lang

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,7 +1,7 @@
 <!--
 
-1. If you haven't already, please read https://github.com/ether/etherpad-lite/blob/master/CONTRIBUTING.md#pull-requests .
-2. Run all the tests, both front-end and back-end.  (see https://github.com/ether/etherpad-lite/blob/master/CONTRIBUTING.md#testing)
+1. If you haven't already, please read https://github.com/ether/etherpad/blob/master/CONTRIBUTING.md#pull-requests .
+2. Run all the tests, both front-end and back-end.  (see https://github.com/ether/etherpad/blob/master/CONTRIBUTING.md#testing)
 3. Keep business logic and validation on the server-side.
 4. Update documentation.
 5. Write `fixes #XXXX` in your comment to auto-close an issue.

.github/workflows/backend-tests.yml

@@ -27,7 +27,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [">=20.0.0 <21.0.0", ">=22.0.0 <23.0.0", ">=24.0.0 <25.0.0"]
+        # PRs: test on latest Node only. Push to develop: full matrix.
+        node: ${{ github.event_name == 'pull_request' && fromJSON('[">=24.0.0 <25.0.0"]') || fromJSON('[">=20.0.0 <21.0.0", ">=22.0.0 <23.0.0", ">=24.0.0 <25.0.0"]') }}
     steps:
       -
         name: Checkout repository
@@ -83,7 +84,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [">=20.0.0 <21.0.0", ">=22.0.0 <23.0.0", ">=24.0.0 <25.0.0"]
+        node: ${{ github.event_name == 'pull_request' && fromJSON('[">=24.0.0 <25.0.0"]') || fromJSON('[">=20.0.0 <21.0.0", ">=22.0.0 <23.0.0", ">=24.0.0 <25.0.0"]') }}
     steps:
       -
         name: Checkout repository
@@ -124,29 +125,26 @@ jobs:
           ep_author_hover
           ep_cursortrace
           ep_font_size
-          ep_hash_auth
           ep_headings2
           ep_markdown
           ep_readonly_guest
           ep_set_title_on_pad
           ep_spellcheck
           ep_subscript_and_superscript
-          ep_table_of_contents   --runtimeVersion="${{ matrix.node }}"
+          ep_table_of_contents
       -
         name: Run the backend tests
         run: gnpm test   --runtimeVersion="${{ matrix.node }}"
       - name: Run the new vitest tests
         working-directory: src
         run: gnpm run test:vitest   --runtimeVersion="${{ matrix.node }}"
 
+  # Windows tests only run on push to develop/master, not on PRs
   withoutpluginsWindows:
     env:
       PNPM_HOME: ~\\.pnpm-store
-    # run on pushes to any branch
-    # run on PRs from external forks
     if: |
-      (github.event_name != 'pull_request')
-      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      github.event_name != 'pull_request'
     strategy:
       fail-fast: false
       matrix:
@@ -194,11 +192,8 @@ jobs:
   withpluginsWindows:
     env:
       PNPM_HOME: ~\\.pnpm-store
-    # run on pushes to any branch
-    # run on PRs from external forks
     if: |
-      (github.event_name != 'pull_request')
-      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
+      github.event_name != 'pull_request'
     strategy:
       fail-fast: false
       matrix:
@@ -232,22 +227,19 @@ jobs:
         run: gnpm build --runtimeVersion="${{ matrix.node }}"
       -
         name: Install Etherpad plugins
-        # The --legacy-peer-deps flag is required to work around a bug in npm
-        # v7: https://github.com/npm/cli/issues/2199
         run: >
           gnpm install --workspace-root
           ep_align
           ep_author_hover
           ep_cursortrace
           ep_font_size
-          ep_hash_auth
           ep_headings2
           ep_markdown
           ep_readonly_guest
           ep_set_title_on_pad
           ep_spellcheck
           ep_subscript_and_superscript
-          ep_table_of_contents   --runtimeVersion="${{ matrix.node }}"
+          ep_table_of_contents
       # Etherpad core dependencies must be installed after installing the
       # plugin's dependencies, otherwise npm will try to hoist common
       # dependencies by removing them from src/node_modules and installing them

.github/workflows/build-and-deploy-docs.yml

@@ -50,7 +50,7 @@ jobs:
         with:
           version: 0.0.12
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
       - name: Install dependencies
         run: gnpm install
       - name: Build app
@@ -59,10 +59,10 @@ jobs:
         env:
           COMMIT_REF: ${{ github.sha }}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           # Upload entire repository
           path: './doc/.vitepress/dist'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/docker.yml

@@ -12,12 +12,15 @@ on:
       - 'v?[0-9]+.[0-9]+.[0-9]+'
 env:
   TEST_TAG: etherpad/etherpad:test
+
 permissions:
   contents: read
 
 jobs:
-  docker:
+  build-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       PNPM_HOME: ~/.pnpm-store
     steps:
@@ -26,17 +29,12 @@ jobs:
         uses: actions/checkout@v6
         with:
           path: etherpad
-
-      -
-        name: Set up QEMU
-        if: github.event_name == 'push'
-        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Build and export to Docker
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./etherpad
           target: production
@@ -78,37 +76,186 @@ jobs:
           done
           (cd src && gnpm run test-container)
           git clean -dxf .
+
+  build-test-db-drivers:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    services:
+      mysql:
+        image: mysql:8
+        env:
+          MYSQL_ROOT_PASSWORD: password
+          MYSQL_DATABASE: etherpad
+          MYSQL_USER: etherpad
+          MYSQL_PASSWORD: password
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -ppassword"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=20
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: etherpad
+          POSTGRES_USER: etherpad
+          POSTGRES_PASSWORD: password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U etherpad -d etherpad"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=20
+    steps:
+      -
+        name: Check out
+        uses: actions/checkout@v6
+        with:
+          path: etherpad
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      -
+        name: Build production image
+        uses: docker/build-push-action@v7
+        with:
+          context: ./etherpad
+          target: production
+          load: true
+          tags: ${{ env.TEST_TAG }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      -
+        name: Driver presence test (all 10 ueberdb2 drivers must resolve)
+        run: |
+          docker run --rm -w /opt/etherpad-lite/src "$TEST_TAG" node -e "
+            const mods = [
+              '@elastic/elasticsearch','cassandra-driver','mongodb','mssql',
+              'mysql2','nano','pg','redis','rethinkdb','surrealdb'
+            ];
+            let fail = false;
+            for (const m of mods) {
+              try { require(m); console.log('ok', m); }
+              catch (e) { console.error('MISSING', m, e.message); fail = true; }
+            }
+            if (fail) process.exit(1);
+          "
+      -
+        name: MySQL smoke — start Etherpad against mysql service
+        run: |
+          docker run --rm -d \
+            --network host \
+            -e NODE_ENV=production \
+            -e ADMIN_PASSWORD=admin \
+            -e DB_TYPE=mysql \
+            -e DB_HOST=127.0.0.1 \
+            -e DB_PORT=3306 \
+            -e DB_NAME=etherpad \
+            -e DB_USER=etherpad \
+            -e DB_PASS=password \
+            -e DB_CHARSET=utf8mb4 \
+            -e DEFAULT_PAD_TEXT="Test " \
+            --name et-mysql "$TEST_TAG"
+          for i in $(seq 1 60); do
+            if curl -sf http://127.0.0.1:9001/ >/dev/null; then
+              echo "mysql smoke: Etherpad is serving /"
+              docker rm -f et-mysql
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "mysql smoke: timed out waiting for Etherpad"
+          docker logs et-mysql || true
+          docker rm -f et-mysql || true
+          exit 1
+      -
+        name: Postgres smoke — start Etherpad against postgres service
+        run: |
+          docker run --rm -d \
+            --network host \
+            -e NODE_ENV=production \
+            -e ADMIN_PASSWORD=admin \
+            -e DB_TYPE=postgres \
+            -e DB_HOST=127.0.0.1 \
+            -e DB_PORT=5432 \
+            -e DB_NAME=etherpad \
+            -e DB_USER=etherpad \
+            -e DB_PASS=password \
+            -e DEFAULT_PAD_TEXT="Test " \
+            --name et-postgres "$TEST_TAG"
+          for i in $(seq 1 60); do
+            if curl -sf http://127.0.0.1:9001/ >/dev/null; then
+              echo "postgres smoke: Etherpad is serving /"
+              docker rm -f et-postgres
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "postgres smoke: timed out waiting for Etherpad"
+          docker logs et-postgres || true
+          docker rm -f et-postgres || true
+          exit 1
+
+  publish:
+    needs: [build-test, build-test-db-drivers]
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      -
+        name: Check out
+        uses: actions/checkout@v6
+        with:
+          path: etherpad
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
       -
         name: Docker meta
-        if: github.event_name == 'push'
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
-          images: etherpad/etherpad
+          images: |
+            etherpad/etherpad
+            ghcr.io/ether/etherpad
           tags: |
             type=ref,event=branch
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
       -
         name: Log in to Docker Hub
-        if: github.event_name == 'push'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build and push
         id: build-docker
-        if: github.event_name == 'push'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./etherpad
           target: production
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
       - name: Update repo description
         uses: peter-evans/dockerhub-description@v5
         if: github.ref == 'refs/heads/master'
@@ -118,8 +265,8 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           repository: etherpad/etherpad
           enable-url-completion: true
-      - name: Check out
-        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+      - name: Check out ether-charts
+        if: github.ref == 'refs/heads/develop'
         uses: actions/checkout@v6
         with:
           path: ether-charts