merge: Rocket.Chat 8.7.0 into MatterChat

.github/CODEOWNERS

@@ -1,5 +1,6 @@
 /packages/* @RocketChat/Architecture
 /packages/apps-engine/ @RocketChat/apps
+/packages/apps/ @RocketChat/apps
 /packages/core-typings/ @RocketChat/Architecture
 /packages/rest-typings/ @RocketChat/Architecture @RocketChat/backend
 /packages/ui-contexts/ @RocketChat/frontend
@@ -12,23 +13,30 @@
 /apps/meteor/tests/e2e @RocketChat/frontend
 /apps/meteor/tests/end-to-end @RocketChat/backend
 /apps/meteor/tests/unit/app @RocketChat/backend
-/apps/meteor/tests/unit/app/ui-utils @RocketChat/frontend
 /apps/meteor/tests/unit/client @RocketChat/frontend
 /apps/meteor/tests/unit/server @RocketChat/backend
 /apps/meteor/app/apps/ @RocketChat/apps
 /apps/meteor/app/livechat @RocketChat/omnichannel
-/apps/meteor/app/sms @RocketChat/omnichannel
-/apps/meteor/app/api @RocketChat/backend
-/apps/meteor/app/federation @RocketChat/backend
 /apps/meteor/app/file-upload @RocketChat/backend
 /apps/meteor/app/integrations @RocketChat/backend
 /apps/meteor/server @RocketChat/backend
+/apps/meteor/server/lib/omnichannel @RocketChat/omnichannel
+/apps/meteor/server/hooks/omnichannel @RocketChat/omnichannel
+/apps/meteor/server/api/v1/omnichannel @RocketChat/omnichannel
+/apps/meteor/server/meteor-methods/omnichannel @RocketChat/omnichannel
 /packages/models @RocketChat/Architecture
 apps/meteor/server/startup/migrations @RocketChat/Architecture
 /apps/meteor/packages/rocketchat-livechat @RocketChat/omnichannel
 /apps/meteor/server/features/EmailInbox @RocketChat/omnichannel
-/apps/meteor/ee/app/canned-responses @RocketChat/omnichannel
-/apps/meteor/ee/app/livechat @RocketChat/omnichannel
-/apps/meteor/ee/app/livechat-enterprise @RocketChat/omnichannel
+/apps/meteor/ee/server/apps/ @RocketChat/apps
+/apps/meteor/ee/tests/unit/server/apps/ @RocketChat/apps
+/apps/meteor/ee/server/lib/canned-responses @RocketChat/omnichannel
+/apps/meteor/ee/server/hooks/canned-responses @RocketChat/omnichannel
+/apps/meteor/ee/server/api/v1/canned-responses.ts @RocketChat/omnichannel
+/apps/meteor/ee/server/lib/omnichannel @RocketChat/omnichannel
+/apps/meteor/ee/server/hooks/omnichannel @RocketChat/omnichannel
+/apps/meteor/ee/server/api/v1/omnichannel @RocketChat/omnichannel
+/apps/meteor/ee/server/meteor-methods/saveCannedResponse.ts @RocketChat/omnichannel
+/apps/meteor/ee/server/meteor-methods/removeCannedResponse.ts @RocketChat/omnichannel
 /apps/meteor/client/omnichannel @RocketChat/omnichannel
 /apps/meteor/client/components/omnichannel @RocketChat/omnichannel

.github/actions/build-docker/action.yml

@@ -8,6 +8,12 @@ inputs:
   CR_PAT:
     required: true
     description: 'GitHub Container Registry Personal Access Token'
+  DOCKER_USER:
+    required: false
+    description: 'DockerHub username (required for FIPS builds to pull private base image)'
+  DOCKER_PASS:
+    required: false
+    description: 'DockerHub password (required for FIPS builds to pull private base image)'
   deno-version:
     required: true
     description: 'Deno version'
@@ -28,7 +34,7 @@ inputs:
     default: 'true'
   type:
     required: false
-    description: 'production or coverage'
+    description: 'production, coverage, or fips'
     default: 'coverage'
 
 runs:
@@ -43,11 +49,19 @@ runs:
         username: ${{ inputs.CR_USER }}
         password: ${{ inputs.CR_PAT }}
 
+    - name: Login to DockerHub
+      # FIPS base image (rocketchat/dhi-node) lives in a private DockerHub repo and requires auth to pull.
+      if: inputs.type == 'fips' && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'release' || github.event_name == 'merge_group' || github.ref == 'refs/heads/develop')
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      with:
+        username: ${{ inputs.DOCKER_USER }}
+        password: ${{ inputs.DOCKER_PASS }}
+
     - name: Restore meteor build
       if: inputs.service == 'rocketchat'
       uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       with:
-        name: build-${{ inputs.type }}
+        name: build-${{ inputs.type == 'fips' && ((github.event_name != 'release' && github.ref != 'refs/heads/develop') && 'coverage' || 'production') || inputs.type }}
         path: /tmp/build
 
     - name: Unpack meteor build
@@ -70,6 +84,33 @@ runs:
             }
           }
 
+    # Microservice images build from a pruned, self-contained context (out/<service>)
+    # produced by `turbo prune`, instead of a hand-maintained list of COPY lines.
+    # The rocketchat (Meteor) image is a prebuilt bundle and is staged separately above.
+    - name: Stage service build context
+      if: inputs.service != 'rocketchat'
+      shell: bash
+      env:
+        INPUT_SERVICE: ${{ inputs.service }}
+      run: |
+        set -o xtrace
+
+        # The Docker SERVICE arg (folder under ee/apps) lives in the compose build args;
+        # the compose service name (INPUT_SERVICE) can differ (e.g. ddp-streamer-service).
+        SERVICE_DIR=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "$INPUT_SERVICE" '.services[$s].build.args.SERVICE')
+        PKG_NAME=$(node -p "require('./ee/apps/${SERVICE_DIR}/package.json').name")
+        TURBO_VERSION=$(node -p "require('./package.json').devDependencies.turbo")
+
+        rm -rf "out/${SERVICE_DIR}"
+
+        # `turbo prune` derives the exact workspace dependency closure for the service — no
+        # hand-maintained list. --use-gitignore=false also captures the gitignored build output
+        # we need (dist/, generated definition/), at the cost of dragging in node_modules/.turbo,
+        # which we strip below; `yarn workspaces focus --production` rebuilds node_modules in-image.
+        npx -y "turbo@${TURBO_VERSION}" prune "$PKG_NAME" --skip-infer --use-gitignore=false --out-dir "out/${SERVICE_DIR}"
+
+        find "out/${SERVICE_DIR}" \( -name node_modules -o -name .turbo \) -type d -prune -exec rm -rf {} +
+
     - name: Build Docker images
       shell: bash
       env:
@@ -85,6 +126,10 @@ runs:
         GITHUB_REF: ${{ github.ref }}
       run: |
         set -o xtrace
+        compose_fips_override=''
+        if [[ "$INPUT_TYPE" == 'fips' ]]; then
+          compose_fips_override='-f docker-compose-ci.fips.yml'
+        fi
 
         # Removes unnecessary swc cores and sharp binaries to reduce image size
         swc_arch='x64'
@@ -109,10 +154,10 @@ runs:
         fi
 
         # Get image name from docker-compose-ci.yml since rocketchat image is different from service name (rocket.chat)
-        IMAGE=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "$INPUT_SERVICE" '.services[$s].image')
+        IMAGE=$(docker compose -f docker-compose-ci.yml $compose_fips_override config --format json 2>/dev/null | jq -r --arg s "$INPUT_SERVICE" '.services[$s].image')
 
         docker buildx bake \
-          -f docker-compose-ci.yml \
+          -f docker-compose-ci.yml $compose_fips_override \
           ${LOAD_OR_PUSH} \
           --allow=fs.read=/tmp/build \
           --set "*.tags+=${IMAGE}-gha-run-${GITHUB_RUN_ID}" \
@@ -133,6 +178,8 @@ runs:
           SERVICE_SUFFIX=''
           if [[ "$INPUT_SERVICE" == 'rocketchat' && "$INPUT_TYPE" == 'coverage' ]] && [[ "$GITHUB_EVENT_NAME" == 'release' || "$GITHUB_REF" == 'refs/heads/develop' ]]; then
             SERVICE_SUFFIX='-cov'
+          elif [[ "$INPUT_TYPE" == 'fips' ]]; then
+            SERVICE_SUFFIX='-fips'
           fi
 
           mkdir -p "/tmp/manifests/${INPUT_SERVICE}${SERVICE_SUFFIX}/${INPUT_ARCH}"
@@ -160,9 +207,13 @@ runs:
         TYPE: ${{ inputs.type }}
       run: |
         set -o xtrace
+        compose_fips_override=''
+        if [[ "$TYPE" == 'fips' ]]; then
+          compose_fips_override='-f docker-compose-ci.fips.yml'
+        fi
 
         # Get image name from docker-compose-ci.yml
-        IMAGE=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "$SERVICE" '.services[$s].image')
+        IMAGE=$(docker compose -f docker-compose-ci.yml $compose_fips_override config --format json 2>/dev/null | jq -r --arg s "$SERVICE" '.services[$s].image')
 
         # Create directory for image archives
         mkdir -p /tmp/docker-images