Merge branch 'main' into feat/typst-annotation-filename

Author: mcanouil

.claude/rules/filters/lua-development.md

@@ -142,6 +142,25 @@ if quarto.log.debug then
 end
 ```
 
+## External Command Execution
+
+Use `pandoc.pipe()` instead of `io.popen()` for calling external programs:
+
+```lua
+-- ✅ Correct - pandoc.pipe passes args as array, no shell interpretation
+local ok, result = pcall(pandoc.pipe, command, {"arg1", "arg2"}, "")
+if not ok then
+  quarto.log.error("Command failed: " .. tostring(result))
+end
+
+-- ❌ Wrong - io.popen uses shell, breaks on paths with spaces
+local handle = io.popen(command .. " arg1 arg2", "r")
+```
+
+`io.popen()` passes a string to the shell, which breaks when paths contain spaces (e.g., `C:\Program Files\...`). `pandoc.pipe()` calls the executable directly with arguments as an array — no shell, no quoting issues.
+
+Reference: `quarto-pre/shiny.lua`, `quarto-post/pdf-images.lua`
+
 ## Filter Return Values
 
 ```lua

.github/actions/cache-typst/action.yml

@@ -41,7 +41,7 @@ runs:
 
     - name: Cache Typst package folder
       id: cache-typst-restore
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ${{ env.TYPST_CACHE }}
         key: ${{ runner.os }}-typst-1

.github/actions/merge-extension-tests/action.yml

@@ -0,0 +1,16 @@
+name: "Merge extension tests into test tree"
+description: >
+  Copies test files from extension subtrees into the main test directories
+  so they are discovered by the test runner and bucket creation.
+  Extension tests live in their own repos (single source of truth) and are
+  pulled in via git subtree — this step avoids duplicating them.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Merge julia-engine tests
+      shell: bash
+      run: |
+        SUBTREE=src/resources/extension-subtrees/julia-engine/tests
+        cp -r "$SUBTREE/docs/julia-engine" tests/docs/julia-engine
+        cp -r "$SUBTREE/smoke/julia-engine" tests/smoke/julia-engine

.github/workflows/actions/launcher/action.yml

@@ -5,15 +5,15 @@ runs:
   using: "composite"
   steps:
     - name: Cache deno std deps
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ./src/resources/deno_std/cache
         key: ${{ runner.os }}-deno_std-2-${{ hashFiles('./src/resources/deno_std/deno_std.lock', './package/scripts/deno_std/deno_std.ts') }}
         restore-keys: |
           ${{ runner.os }}-deno_std-2-
 
     - name: Cache Cargo dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cargo/registry

.github/workflows/actions/quarto-dev/action.yml

@@ -44,9 +44,43 @@ runs:
       run: |
         Write-Output "::group::Install smctl if needed"
         if (!(Get-Command smctl -ErrorAction SilentlyContinue)) {
-          curl -o smtools-windows-x64.msi "https://rstudio-buildtools.s3.amazonaws.com/posit-dev/smtools-windows-x64.msi"
-          msiexec /i smtools-windows-x64.msi /quiet /qn /log smtools-windows-x64.log
-          "C:/Program Files/DigiCert/DigiCert One Signing Manager Tools" | Out-File -FilePath $env:GITHUB_PATH -Append
+          # Download with retry (transient S3 failures cause silent install failures)
+          $maxRetries = 3
+          $downloaded = $false
+          for ($i = 1; $i -le $maxRetries; $i++) {
+            Write-Output "Downloading smtools MSI (attempt $i/$maxRetries)..."
+            curl -o smtools-windows-x64.msi "https://rstudio-buildtools.s3.amazonaws.com/posit-dev/smtools-windows-x64.msi"
+            if ($LASTEXITCODE -ne 0) {
+              Write-Output "::warning::curl failed with exit code $LASTEXITCODE"
+              continue
+            }
+            $fileSize = (Get-Item smtools-windows-x64.msi).Length
+            if ($fileSize -lt 1MB) {
+              Write-Output "::warning::Downloaded file is only $fileSize bytes, expected ~90MB"
+              continue
+            }
+            $downloaded = $true
+            Write-Output "Download successful ($fileSize bytes)"
+            break
+          }
+          if (-not $downloaded) {
+            Write-Output "::error title=Download Error::Failed to download smtools MSI after $maxRetries attempts"
+            exit 1
+          }
+          # Install synchronously (msiexec can return before install completes without -Wait)
+          $process = Start-Process msiexec -ArgumentList '/i', 'smtools-windows-x64.msi', '/quiet', '/qn', '/log', 'smtools-windows-x64.log' -Wait -PassThru
+          if ($process.ExitCode -ne 0) {
+            Write-Output "::error title=Install Error::msiexec failed with exit code $($process.ExitCode)"
+            if (Test-Path smtools-windows-x64.log) { Get-Content smtools-windows-x64.log -Tail 50 }
+            exit 1
+          }
+          # Verify smctl is actually on disk before declaring success
+          $smctlPath = "C:/Program Files/DigiCert/DigiCert One Signing Manager Tools"
+          if (!(Test-Path "$smctlPath/smctl.exe")) {
+            Write-Output "::error title=Install Error::smctl.exe not found at $smctlPath after install"
+            exit 1
+          }
+          $smctlPath | Out-File -FilePath $env:GITHUB_PATH -Append
           Write-Output "SMCTL installed and added on PATH"
         } else {
           Write-Output "SMCTL already installed and on PATH"