* Canary June 2026

.gitattributes

@@ -3,6 +3,9 @@
 ###############################################################################
 * text=auto
 
+# VSIX manifest: UTF-8 without BOM, LF (VSSDK; avoid CRLF churn in PRs).
+*.vsixmanifest text eol=lf
+
 ###############################################################################
 # Set default behavior for command prompt diff.
 #

.github/BRANCH_POLICY.md

@@ -0,0 +1,67 @@
+# Branch and pull request policy
+
+This repository uses a **warn-then-fail** branch policy enforced in CI ([#3610](https://github.com/Krypton-Suite/Standard-Toolkit/issues/3610)).
+
+**Full developer documentation:** [Branch Policy and Workflow Hardening](https://krypton-suite.github.io/Standard-Toolkit-Online-Help/articles/Contributing/BranchPolicyandWorkflowHardening.html) (architecture, rules, operations, troubleshooting).
+
+## Product vs workflow changes
+
+| Flow | Allowed |
+|------|---------|
+| Topic branch → `master` | Yes (normal features and fixes) |
+| Topic branch → `alpha`, `canary`, LTS lines | Yes |
+| `master` → downstream branch | **Only** files under `.github/` |
+| `alpha` → `alpha-backup` | Yes (automated backup sync) |
+| Release line → `master` | **No** (do not merge `alpha` / `canary` / LTS into `master` via PR) |
+
+**Workflow/CI alignment** with `master` is by **file content** under `.github/`, not by Git ancestry. Use **Sync .github from master** (or a manual PR that only touches `.github/`). Release lines may legitimately diverge from `master` in product history; policy does **not** require merging `master` into every downstream branch.
+
+## Warn vs fail
+
+| Repository variable | Value | Behaviour |
+|---------------------|-------|-----------|
+| `BRANCH_POLICY_ENFORCE` | unset or `false` | Violations emit **`::warning::`**; the check **passes** |
+| `BRANCH_POLICY_ENFORCE` | `true` | Violations emit **`::error::`**; the check **fails** |
+| `BRANCH_POLICY_DISABLED` | `true` | Skips the PR policy workflow entirely |
+
+**Rollout:** leave enforce off while teams fix existing PRs, then set `BRANCH_POLICY_ENFORCE=true` and add **PR branch policy** as a required status check on protected branches.
+
+## Deploy on `master` first
+
+These workflows and config files must be present on the **default branch (`master`)**, not only on `alpha`:
+
+- `.github/workflows/sync-github-from-master.yml`
+- `.github/workflows/pr-branch-policy.yml`
+- `.github/branch-policy.json`
+- `.github/scripts/Invoke-BranchPolicyCheck.ps1`
+
+GitHub runs scheduled workflows and uses the default-branch copy of workflow definitions. If a PR merges this feature **only** into `alpha`, **Sync .github from master** does not run on the schedule until the same `.github/` tree exists on `master` (merge, cherry-pick, or a `.github/`-only PR `master` → downstream is not the bootstrap path — use **master** directly or **Sync** after `master` has the files).
+
+If `alpha` is later replaced (e.g. with `alpha-recovered`), commits that exist only on the old `alpha` tip can be lost unless this work is also on the recovered line (replay/cherry-pick the same commits).
+
+## Automated `.github` sync
+
+Workflow **Sync .github from master** (`.github/workflows/sync-github-from-master.yml`) opens PRs that copy only `.github/` from `master` onto configured release branches.
+
+Targets include `alpha`, `canary`, `gold`, `prerelease`, `V105-LTS`, `V85-LTS`, and `V110` (see `syncGithubFromMasterTargets` in `branch-policy.json`). The sync uses `git checkout origin/master -- .github` on the target branch tip (path copy, not a merge of `master`).
+
+## Required checks on `master` vs release branches
+
+When enforcing policy, require **PR branch policy** on release-branch rulesets only — not on `master` — so topic PRs into `master` are not gated by this check. Details in the [developer documentation](https://krypton-suite.github.io/Standard-Toolkit-Online-Help/articles/Contributing/BranchPolicyandWorkflowHardening.html#required-check-only-on-release-branches-not-topic-prs--master).
+
+| Variable | Purpose |
+|----------|---------|
+| `SYNC_GITHUB_FROM_MASTER_DISABLED` | `true` disables the sync workflow |
+| `BRANCH_POLICY_ENFORCE` | Independent; controls PR validation only |
+
+## Configuration
+
+Machine-readable rules: [branch-policy.json](branch-policy.json)
+
+Edit `downstreamBranches` and `syncGithubFromMasterTargets` there when adding a new release line.
+
+## Branch names
+
+- **`canary`** (lowercase) is used by `build.yml` and `release.yml`.
+- **`Canary`** (capital C) is used by `canary.yml` only.
+- Policy treats both as downstream lines; prefer consolidating to one branch name over time.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -117,4 +117,5 @@ body:
         - Navigator
         - Ribbon
         - Toolkit
+        - Utilities
         - Workspace

.github/branch-policy.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "Pull-request branch pairing rules for Krypton-Suite/Standard-Toolkit. See .github/BRANCH_POLICY.md.",
+  "downstreamBranches": [
+    "alpha",
+    "alpha-backup",
+    "canary",
+    "Canary",
+    "gold",
+    "prerelease",
+    "V105-LTS",
+    "V85-LTS",
+    "V110"
+  ],
+  "longLivedHeadBranches": [
+    "master",
+    "main",
+    "alpha",
+    "alpha-backup",
+    "canary",
+    "Canary",
+    "gold",
+    "prerelease",
+    "V105-LTS",
+    "V85-LTS",
+    "V110"
+  ],
+  "syncGithubFromMasterTargets": [
+    "alpha",
+    "canary",
+    "gold",
+    "prerelease",
+    "V105-LTS",
+    "V85-LTS",
+    "V110"
+  ],
+  "rules": [
+    {
+      "id": "master-github-downstream",
+      "description": "Workflow changes from master into release lines must touch only .github/",
+      "baseIn": "downstreamBranches",
+      "head": "master",
+      "pathsOnlyPrefix": ".github/"
+    },
+    {
+      "id": "alpha-to-alpha-backup",
+      "description": "alpha-backup is updated from alpha only",
+      "base": "alpha-backup",
+      "head": "alpha"
+    },
+    {
+      "id": "no-long-lived-to-master",
+      "description": "Do not open product PRs from another release line into master",
+      "base": "master",
+      "headIn": "longLivedHeadBranches",
+      "forbidden": true
+    }
+  ]
+}

.github/dependabot.yml

@@ -8,7 +8,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    target-branch: "alpha"
+    target-branch: "master"
     reviewers:
       - "Krypton-Suite/reviewers"
     labels:

.github/scripts/Invoke-BranchPolicyCheck.ps1

@@ -0,0 +1,154 @@
+# New BSD 3-Clause License (https://github.com/Krypton-Suite/Standard-Toolkit/blob/master/LICENSE)
+# Modifications by Peter Wagner (aka Wagnerp), Simon Coghlan (aka Smurf-IV), tobitege et al. 2026 - 2026. All rights reserved.
+#
+# Validates pull-request base/head pairing for Standard-Toolkit (no master ancestry requirement).
+# Called from .github/workflows/pr-branch-policy.yml
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$BaseRef,
+
+    [Parameter(Mandatory = $true)]
+    [string]$HeadRef,
+
+    [Parameter(Mandatory = $true)]
+    [string]$ChangedFilesFile,
+
+    [Parameter(Mandatory = $true)]
+    [string]$PolicyPath,
+
+    [Parameter(Mandatory = $true)]
+    [string]$Enforce,
+
+    [Parameter(Mandatory = $true)]
+    [string]$Repository
+)
+
+$ErrorActionPreference = 'Stop'
+
+$ChangedFiles = @()
+if (Test-Path -LiteralPath $ChangedFilesFile) {
+    $ChangedFiles = @(Get-Content -LiteralPath $ChangedFilesFile -Raw | ConvertFrom-Json)
+}
+
+function Write-PolicyMessage {
+    param(
+        [ValidateSet('Warning', 'Error')]
+        [string]$Level,
+        [string]$Message
+    )
+
+    if ($Level -eq 'Error') {
+        Write-Host "::error::$Message"
+    } else {
+        Write-Host "::warning::$Message"
+    }
+}
+
+function Test-BranchInList {
+    param(
+        [string]$Branch,
+        [string[]]$List
+    )
+    return $List -contains $Branch
+}
+
+function Test-PathsUnderPrefix {
+    param(
+        [string[]]$Files,
+        [string]$Prefix
+    )
+
+    if ($Files.Count -eq 0) {
+        return $true
+    }
+
+    foreach ($file in $Files) {
+        $normalized = $file -replace '\\', '/'
+        if (-not $normalized.StartsWith($Prefix, [System.StringComparison]::OrdinalIgnoreCase)) {
+            return $false
+        }
+    }
+
+    return $true
+}
+
+function Invoke-PolicyExit {
+    param(
+        [int]$ViolationCount,
+        [string]$EnforceMode
+    )
+
+    if ($ViolationCount -eq 0) {
+        Write-Host 'Branch policy check passed.'
+        exit 0
+    }
+
+    $suffix = " ($ViolationCount violation(s))"
+    if ($EnforceMode -eq 'true') {
+        Write-Host "Branch policy check failed$suffix."
+        exit 1
+    }
+
+    Write-Host "::notice::Branch policy is in warn-only mode. Set repository variable BRANCH_POLICY_ENFORCE=true to fail PRs on violations."
+    Write-Host "Branch policy reported warnings$suffix."
+    exit 0
+}
+
+if ($Repository -ne 'Krypton-Suite/Standard-Toolkit') {
+    Write-Host "Skipping branch policy for repository '$Repository'."
+    exit 0
+}
+
+if (-not (Test-Path -LiteralPath $PolicyPath)) {
+    throw "Policy file not found: $PolicyPath"
+}
+
+$policy = Get-Content -LiteralPath $PolicyPath -Raw | ConvertFrom-Json
+$violations = 0
+$enforceMode = $Enforce.ToLowerInvariant()
+
+function Add-Violation {
+    param(
+        [string]$RuleId,
+        [string]$Message
+    )
+
+    $script:violations++
+    $label = if ($enforceMode -eq 'true') { 'Error' } else { 'Warning' }
+    Write-PolicyMessage -Level $label -Message "[$RuleId] $Message"
+}
+
+# --- Rule: master -> downstream must be .github only ---
+$downstream = @($policy.downstreamBranches)
+if ($HeadRef -eq 'master' -and (Test-BranchInList -Branch $BaseRef -List $downstream)) {
+    $prefix = '.github/'
+    if (-not (Test-PathsUnderPrefix -Files $ChangedFiles -Prefix $prefix)) {
+        $outside = $ChangedFiles | Where-Object {
+            $n = $_ -replace '\\', '/'
+            -not $n.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)
+        }
+        $sample = ($outside | Select-Object -First 5) -join ', '
+        Add-Violation -RuleId 'master-github-downstream' -Message (
+            "Pull request master -> $BaseRef must only change files under '.github/'. " +
+            "Use workflow 'Sync .github from master' or limit the PR to CI files. Outside paths (sample): $sample"
+        )
+    }
+}
+
+# --- Rule: alpha -> alpha-backup only ---
+if ($BaseRef -eq 'alpha-backup' -and $HeadRef -ne 'alpha') {
+    Add-Violation -RuleId 'alpha-to-alpha-backup' -Message (
+        "Pull requests into alpha-backup must use head branch 'alpha' (current head: '$HeadRef')."
+    )
+}
+
+# --- Rule: long-lived branch must not target master for product merges ---
+$longLived = @($policy.longLivedHeadBranches)
+if ($BaseRef -eq 'master' -and (Test-BranchInList -Branch $HeadRef -List $longLived)) {
+    Add-Violation -RuleId 'no-long-lived-to-master' -Message (
+        "Pull request $HeadRef -> master is not allowed. Merge topic branches into master, or use a .github-only sync into downstream branches."
+    )
+}
+
+Invoke-PolicyExit -ViolationCount $violations -EnforceMode $enforceMode