Sync upstream changes through 2026-06-19

.github/workflows/build-cli.yml

@@ -86,7 +86,7 @@ jobs:
           - platform: windows
             architecture: x86_64
             target-suffix: pc-windows-msvc
-            build-on: windows-latest
+            build-on: windows-2022
             variant: cuda
 
     steps:
@@ -299,7 +299,7 @@ jobs:
           echo "ARTIFACT_ZIP=target/${TARGET}/release/goose-${TARGET}${VARIANT_SUFFIX}.zip" >> $GITHUB_ENV
 
       - name: Upload CLI artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: goose-${{ matrix.architecture }}-${{ matrix.target-suffix }}${{ matrix.variant != 'standard' && matrix.variant != 'musl' && format('-{0}', matrix.variant) || '' }}
           path: |

.github/workflows/bundle-desktop-intel.yml

@@ -169,7 +169,7 @@ jobs:
           df -h
 
       - name: Upload Desktop artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-darwin-x64
           path: ui/desktop/out/ApeMind Agent-darwin-x64/ApeMind Agent_intel_mac.zip

.github/workflows/bundle-desktop-linux.yml

@@ -104,6 +104,11 @@ jobs:
             sudo apt-get install -y libasound2
           fi
 
+      - name: Configure RPM packaging
+        run: |
+          echo '%_build_id_links none' > ~/.rpmmacros
+          test "$(rpm --eval '%{_build_id_links}')" = "none"
+
       - name: Setup Flatpak Runtimes
         run: |
           flatpak remote-add --if-not-exists --user flathub https://dl.flathub.org/repo/flathub.flatpakrepo
@@ -181,6 +186,14 @@ jobs:
             done
           fi
 
+          for package in out/make/rpm/x64/*.rpm; do
+            package_contents="$(rpm -qlp "$package")"
+            if grep -qE '^/usr/lib/\.build-id(/|$)' <<< "$package_contents"; then
+              echo "::error file=$package::RPM contains build-id links"
+              exit 1
+            fi
+          done
+
           echo "Build completed. Checking output..."
           ls -la out/
           find out/ -name "*.deb" -o -name "*.rpm" -o -name "*.flatpak" | head -10
@@ -198,47 +211,47 @@ jobs:
 
       - name: Upload .deb package
         if: matrix.variant == 'standard'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-linux-x64-deb
           path: ui/desktop/out/make/deb/x64/*.deb
           if-no-files-found: error
 
       - name: Upload .deb package (Vulkan)
         if: matrix.variant == 'vulkan'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-linux-x64-vulkan-deb
           path: ui/desktop/out/make/deb/x64/*-vulkan.deb
           if-no-files-found: error
 
       - name: Upload .rpm package
         if: matrix.variant == 'standard'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-linux-x64-rpm
           path: ui/desktop/out/make/rpm/x64/*.rpm
           if-no-files-found: error
 
       - name: Upload .rpm package (Vulkan)
         if: matrix.variant == 'vulkan'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-linux-x64-vulkan-rpm
           path: ui/desktop/out/make/rpm/x64/*-vulkan.rpm
           if-no-files-found: error
 
       - name: Upload .flatpak package
         if: matrix.variant == 'standard'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-linux-x64-flatpak
           path: ui/desktop/out/make/flatpak/x86_64/*.flatpak
           if-no-files-found: error
 
       - name: Upload .flatpak package (Vulkan)
         if: matrix.variant == 'vulkan'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-linux-x64-vulkan-flatpak
           path: ui/desktop/out/make/flatpak/x86_64/*-vulkan.flatpak

.github/workflows/bundle-desktop-windows.yml

@@ -44,7 +44,7 @@ permissions:
 jobs:
   build-desktop-windows:
     name: Build Desktop (Windows)
-    runs-on: windows-latest
+    runs-on: ${{ inputs.windows_variant == 'cuda' && 'windows-2022' || 'windows-latest' }}
 
     steps:
       - name: Checkout repository
@@ -53,7 +53,7 @@ jobs:
           ref: ${{ inputs.ref != '' && inputs.ref || '' }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 24.10.0
 
@@ -195,7 +195,7 @@ jobs:
           ls -la ./dist-windows/resources/bin/
 
       - name: Upload unsigned distribution
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: windows-unsigned${{ inputs.windows_variant == 'cuda' && '-cuda' || '' }}
           path: ui/desktop/dist-windows/
@@ -255,7 +255,7 @@ jobs:
           7z a -tzip "${ZIP_NAME}.zip" dist-windows/
 
       - name: Upload signed Windows build
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-win32-x64${{ inputs.windows_variant == 'cuda' && '-cuda' || '' }}
           path: Goose-win32-x64${{ inputs.windows_variant == 'cuda' && '-cuda' || '' }}.zip
@@ -284,7 +284,7 @@ jobs:
           7z a -tzip "${ZIP_NAME}.zip" dist-windows/
 
       - name: Upload Windows build
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-win32-x64${{ inputs.windows_variant == 'cuda' && '-cuda' || '' }}
           path: Goose-win32-x64${{ inputs.windows_variant == 'cuda' && '-cuda' || '' }}.zip

.github/workflows/bundle-desktop.yml

@@ -202,7 +202,7 @@ jobs:
 
       - name: Upload Desktop artifact
         id: upload-app-bundle
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: Goose-darwin-arm64
           path: ui/desktop/out/ApeMind Agent-darwin-arm64/ApeMind Agent.zip

.github/workflows/canary.yml

@@ -61,7 +61,7 @@ jobs:
     needs: [build-cli]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: download_cli.sh
           path: download_cli.sh

.github/workflows/code-review.yml

@@ -64,7 +64,7 @@ jobs:
           OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
 
       - name: Upload review inputs
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: code-review-inputs
           path: /tmp/code-review/
@@ -119,7 +119,7 @@ jobs:
 
       - name: Upload review output
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: code-review-output
           path: |

.github/workflows/create-release-branch.yaml

@@ -24,7 +24,7 @@ jobs:
         fetch-depth: 0
 
     - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
-    - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b  # v7.2.0
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
     - name: Extract version and base branch
       env:

.github/workflows/create-version-bump-pr.yaml

@@ -25,64 +25,77 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      with:
-        ref: main
-        fetch-depth: 0
-
-    - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
-    - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b  # v7.2.0
-
-    - name: install dependencies
-      run: |
-        sudo apt update -y
-        sudo apt install -y libdbus-1-dev gnome-keyring libxcb1-dev
-
-    - name: Compute version and create bump branch
-      env:
-        ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
-        OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-        XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
-        TETRATE_API_KEY: ${{ secrets.TETRATE_API_KEY }}
-      run: |
-        VERSION=$(just get-next-minor-version)
-        echo "version=$VERSION" >> $GITHUB_ENV
-        echo "Version: $VERSION (minor bump on main)"
-
-        git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
-        git config --local user.name "github-actions[bot]"
-
-        BRANCH_NAME="version-bump/$VERSION"
-        git switch -c "$BRANCH_NAME"
-
-        just prepare-release $VERSION
-
-        echo "branch_name=$BRANCH_NAME" >> $GITHUB_ENV
-
-    - name: Push bump branch
-      run: |
-        git push origin "${{ env.branch_name }}"
-
-    - name: Create Pull Request
-      run: |
-        PR_BODY=$(cat <<'EOF'
-        Bumps version to **${{ env.version }}**.
-
-        **Please follow these steps:**
-
-        1. Close and reopen this PR to trigger CI checks. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
-        2. Review and resolve any merge conflicts.
-        3. Approve and merge this PR.
-        4. The `release/${{ env.version }}` PR will be created automatically.
-        EOF
-        )
-        PR_URL=$(gh pr create \
-          -B main \
-          -H "${{ env.branch_name }}" \
-          --title "chore(release): bump version to ${{ env.version }} (minor)" \
-          --body "$PR_BODY")
-        echo "pr_url=$PR_URL" >> $GITHUB_ENV
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+
+      - name: install dependencies
+        run: |
+          sudo apt update -y
+          sudo apt install -y libdbus-1-dev gnome-keyring libxcb1-dev
+
+      - name: Compute version and create bump branch
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          TETRATE_API_KEY: ${{ secrets.TETRATE_API_KEY }}
+        run: |
+          VERSION=$(just get-next-minor-version)
+          echo "version=$VERSION" >> $GITHUB_ENV
+          echo "Version: $VERSION (minor bump on main)"
+
+          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+
+          BRANCH_NAME="version-bump/$VERSION"
+          git switch -C "$BRANCH_NAME"
+
+          just prepare-release $VERSION
+
+          echo "branch_name=$BRANCH_NAME" >> $GITHUB_ENV
+
+      - name: Push bump branch
+        run: |
+          git push --force-with-lease origin "${{ env.branch_name }}"
+
+      - name: Create Pull Request if needed
+        run: |
+          EXISTING_PR_URL=$(gh pr list \
+            --base main \
+            --head "${{ env.branch_name }}" \
+            --state open \
+            --json url \
+            --jq '.[0].url // empty')
+
+          if [ -n "$EXISTING_PR_URL" ]; then
+            echo "Existing PR found: $EXISTING_PR_URL"
+            echo "pr_url=$EXISTING_PR_URL" >> $GITHUB_ENV
+            exit 0
+          fi
+
+          PR_BODY=$(cat <<'EOF'
+          Bumps version to **${{ env.version }}**.
+
+          **Please follow these steps:**
+
+          1. Close and reopen this PR to trigger CI checks. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+          2. Review and resolve any merge conflicts.
+          3. Approve and merge this PR.
+          4. The `release/${{ env.version }}` PR will be created automatically.
+          EOF
+          )
+          PR_URL=$(gh pr create \
+            -B main \
+            -H "${{ env.branch_name }}" \
+            --title "chore(release): bump version to ${{ env.version }} (minor)" \
+            --body "$PR_BODY")
+          echo "pr_url=$PR_URL" >> $GITHUB_ENV
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deploy-docs-and-extensions.yml

@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 20
 
@@ -58,10 +58,10 @@ jobs:
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d  # v6.0.0
 
       - name: Upload GitHub Pages artifact
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
         with:
           path: documentation/build
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4.0.5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5.0.0

.github/workflows/docs-update-cli-ref.yml

@@ -73,7 +73,7 @@ jobs:
           python-version: '3.11'
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20'
 
@@ -191,7 +191,7 @@ jobs:
 
       - name: Upload automation outputs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cli-docs-update-${{ steps.versions.outputs.old_version }}-to-${{ steps.versions.outputs.new_version }}
           path: |

.github/workflows/docs-update-recipe-ref.yml

@@ -61,7 +61,7 @@ jobs:
           sudo apt-get install -y jq ripgrep
 
       - name: Set up Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: '20'
 
@@ -178,7 +178,7 @@ jobs:
 
       - name: Upload automation outputs
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: recipe-docs-update-${{ steps.versions.outputs.old_version }}-to-${{ steps.versions.outputs.new_version }}
           path: |