Merge branch 'main' into fix/login-items-app-association

Author: RhysSullivan

.changeset/config.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@3.1.3/schema.json",
-  "changelog": ["@changesets/changelog-github", { "repo": "RhysSullivan/executor" }],
+  "changelog": ["@changesets/changelog-github", { "repo": "UsefulSoftwareCo/executor" }],
   "commit": false,
   "fixed": [
     [

.github/ISSUE_TEMPLATE/desktop-crash.yml

@@ -7,7 +7,7 @@ body:
     attributes:
       value: |
         Before filing, please try the quick fixes in the pinned
-        **[Desktop app crashing? Start here](https://github.com/RhysSullivan/executor/issues?q=is%3Aissue+label%3Acrash-triage)**
+        **[Desktop app crashing? Start here](https://github.com/UsefulSoftwareCo/executor/issues?q=is%3Aissue+label%3Acrash-triage)**
         guide — most crashes are fixed by updating to the latest version.
         If you're still stuck, the details below help us pin it down fast.
   - type: input

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   format:
     name: Format
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -29,13 +29,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - run: bun run format:check
 
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -51,13 +58,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - run: bun run lint
 
   typecheck:
     name: Typecheck
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -73,13 +87,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - run: bun run typecheck
 
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     env:
       TURBO_TEST_CONCURRENCY: 3
     steps:
@@ -130,7 +151,7 @@ jobs:
           - { target: cloud, shard: 7/8, shard-name: 7of8 }
           - { target: cloud, shard: 8/8, shard-name: 8of8 }
           - target: selfhost
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -191,7 +212,7 @@ jobs:
     # Skipped on pull_request: the local scenario boots a real `executor web`
     # plus a browser and is currently flaky on PRs. Still runs on push to main.
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -244,7 +265,7 @@ jobs:
 
   desktop-smoke:
     name: Desktop smoke build
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -260,6 +281,13 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - name: Build web app
@@ -277,19 +305,17 @@ jobs:
 
   selfhost-docker-smoke:
     name: Self-host Docker image
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       - name: Build self-host image
-        uses: docker/build-push-action@v6
+        uses: useblacksmith/build-push-action@v2
         with:
           context: .
           file: apps/host-selfhost/Dockerfile
           push: false
           tags: executor-selfhost:ci
-          cache-from: type=gha
-          cache-to: type=gha,mode=max

.github/workflows/pkg-pr-new.yml

@@ -64,7 +64,7 @@ jobs:
   publish:
     name: Publish
     needs: build-preview-binary
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: write
@@ -77,6 +77,13 @@ jobs:
         with:
           bun-version: 1.3.11
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the CI jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - name: Build executor preview wrapper

.github/workflows/preview-sweep.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   sweep:
     name: Destroy previews for closed PRs
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/preview.yml

@@ -27,14 +27,21 @@ jobs:
   deploy:
     name: Deploy preview
     if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the CI jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - name: Deploy
@@ -82,7 +89,7 @@ jobs:
   teardown:
     name: Tear down preview
     if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/publish-desktop.yml

@@ -177,7 +177,7 @@ jobs:
 
   release:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
 

.github/workflows/publish-executor-package.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       actions: write
       contents: write

.github/workflows/publish-selfhost-docker.yml

@@ -18,10 +18,12 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       packages: write
+    env:
+      HAS_LEGACY_TOKEN: ${{ secrets.GHCR_LEGACY_TOKEN != '' }}
 
     steps:
       - name: Checkout
@@ -57,6 +59,7 @@ jobs:
           version="${RELEASE_TAG#v}"
           owner="$(printf '%s' "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
           image="ghcr.io/${owner}/executor-selfhost"
+          legacy_image="ghcr.io/rhyssullivan/executor-selfhost"
           revision="$(git rev-parse HEAD)"
 
           if [[ "$version" == *-* ]]; then
@@ -74,6 +77,11 @@ jobs:
             echo "${image}:${version}"
             echo "${image}:${channel}"
             echo "TAGS"
+            echo "legacy_tags<<TAGS"
+            echo "${legacy_image}:${RELEASE_TAG}"
+            echo "${legacy_image}:${version}"
+            echo "${legacy_image}:${channel}"
+            echo "TAGS"
             echo "labels<<LABELS"
             echo "org.opencontainers.image.title=Executor self-host"
             echo "org.opencontainers.image.description=Single-container self-hosted Executor"
@@ -86,8 +94,8 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -97,11 +105,41 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push self-host image
-        uses: docker/build-push-action@v6
+        id: build
+        uses: useblacksmith/build-push-action@v2
         with:
           context: .
           file: apps/host-selfhost/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.image.outputs.tags }}
           labels: ${{ steps.image.outputs.labels }}
+
+      - name: Skip legacy GHCR mirror (GHCR_LEGACY_TOKEN not configured)
+        if: env.HAS_LEGACY_TOKEN != 'true'
+        run: echo "GHCR_LEGACY_TOKEN is not configured; skipping legacy GHCR mirror."
+
+      - name: Log in to legacy GHCR namespace
+        if: env.HAS_LEGACY_TOKEN == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: rhyssullivan
+          password: ${{ secrets.GHCR_LEGACY_TOKEN }}
+
+      - name: Mirror self-host image to legacy GHCR namespace
+        if: env.HAS_LEGACY_TOKEN == 'true'
+        shell: bash
+        env:
+          SOURCE_IMAGE: ${{ steps.image.outputs.image }}@${{ steps.build.outputs.digest }}
+          LEGACY_TAGS: ${{ steps.image.outputs.legacy_tags }}
+        run: |
+          set -euo pipefail
+
+          tag_args=()
+          while IFS= read -r tag; do
+            [[ -n "$tag" ]] || continue
+            tag_args+=("-t" "$tag")
+          done <<< "$LEGACY_TAGS"
+
+          docker buildx imagetools create "${tag_args[@]}" "$SOURCE_IMAGE"

.github/workflows/release.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       actions: write
       contents: write