Remove "prioritize_full_name_in_ux"

.agents/skills

@@ -0,0 +1 @@
+../.skills/

.claude/skills

@@ -0,0 +1 @@
+../.skills

.devcontainer/devcontainer.json

@@ -5,7 +5,7 @@
   "workspaceFolder": "/workspace/discourse",
   "postStartCommand": "./.devcontainer/scripts/start.rb",
   "forwardPorts": [
-    9292, // bin/unicorn
+    9292, // bin/pitchfork
     3000, // bin/rails s
     4200, // ember-cli
     8025, // mailhog

.git-blame-ignore-revs

@@ -85,3 +85,6 @@ e41897a3066199f3b7f4c019fb638615dfe1f007
 
 # remove route-template usage
 88d4e242ead238b353f441533a0c4b8ce3fa1f7b
+
+# MT: Switch to nested module style across migrations/ (#38564)
+89f26da39d8c977c3dde7ef7e0a5c3f2a4b58e44

.github/dependabot.yml

@@ -16,7 +16,7 @@ updates:
       prefix: "DEPS"
     cooldown:
       default-days: 7
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 40
     versioning-strategy: lockfile-only
     allow:
       - dependency-type: direct
@@ -74,10 +74,9 @@ updates:
       prefix: "DEPS"
     cooldown:
       default-days: 7
-      exclude: [
-        "@discourse/*"
-      ]
-    open-pull-requests-limit: 20
+      exclude:
+        - "@discourse/*"
+    open-pull-requests-limit: 40
     versioning-strategy: increase
     ignore:
       - dependency-name: "webpack" # Recent versions have bugs with `/static` loading. We're working to move away from webpack anyway.

.github/workflows/dependabot-pnpm-dedupe.yml

@@ -23,10 +23,10 @@ jobs:
           token: ${{ secrets.GH_PUSH_TOKEN }}
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
 

.github/workflows/developer-docs-lint.yml

@@ -31,13 +31,14 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          cache: "pnpm"
-          cache-dependency-path: docs/developer-guides/pnpm-lock.yaml
+          node-version: 24
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/licenses.yml

@@ -32,7 +32,7 @@ jobs:
           git config --global user.name "Discourse CI"
 
       - name: Bundler cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: vendor/bundle
           key: ${{ runner.os }}-gem-${{ hashFiles('**/Gemfile.lock') }}

.github/workflows/linting.yml

@@ -72,7 +72,11 @@ jobs:
 
       - name: ESLint
         if: ${{ !cancelled() }}
-        run: pnpm lint:js
+        run: pnpm lint:js --max-warnings 0
+
+      - name: Types
+        if: ${{ !cancelled() }}
+        run: pnpm lint:types
 
       - name: Prettier
         if: ${{ !cancelled() }}
@@ -95,7 +99,3 @@ jobs:
       - name: English locale lint (core plugins)
         if: ${{ !cancelled() }}
         run: bundle exec ruby script/i18n_lint.rb "plugins/**/locales/{client,server}.en.yml"
-
-      - name: Types
-        if: ${{ !cancelled() }}
-        run: pnpm lint:types

.github/workflows/migration-tests.yml

@@ -77,7 +77,7 @@ jobs:
         run: echo "cpu-cores=$(nproc)" >> $GITHUB_OUTPUT
 
       - name: Fetch app state cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: app-cache
         with:
           path: tmp/app-cache
@@ -112,12 +112,35 @@ jobs:
 
       - name: Validate IntermediateDB schema
         run: |
+          # Show structured differences between DSL config and database
+          migrations/bin/cli schema diff --db=intermediate_db || true
+
+          # Regenerate schema from DSL config
           migrations/bin/cli schema generate --db=intermediate_db
 
-          if [ ! -z "$(git status --porcelain migrations/db/intermediate_db_schema/)" ]; then
+          # Check if generated output matches what's committed
+          if [ ! -z "$(git status --porcelain migrations/db/intermediate_db_schema/ migrations/lib/database/intermediate_db/ migrations/lib/database/intermediate_db/enums/)" ]; then
+            echo ""
+            echo "=========================================="
             echo "IntermediateDB schema is not up to date."
-            echo "---------------------------------------------"
-            git -c color.ui=always diff migrations/db/intermediate_db_schema/
+            echo "=========================================="
+            echo ""
+            echo "The generated schema files differ from what is committed."
+            echo "This usually means the schema DSL config or the database"
+            echo "structure changed without regenerating."
+            echo ""
+            echo "To fix:"
+            echo "  1. Run: migrations/bin/cli schema diff"
+            echo "     to see what changed between config and database"
+            echo "  2. Update config files in migrations/config/schema/intermediate_db/"
+            echo "     - New tables: migrations/bin/cli schema add <table>"
+            echo "     - Ignore tables: migrations/bin/cli schema ignore <table> --reason '...'"
+            echo "     - New columns: add to the table's include list or ignore with reason"
+            echo "  3. Run: migrations/bin/cli schema generate"
+            echo "  4. Commit the updated config and generated files"
+            echo ""
+            echo "Generated file diff:"
+            git -c color.ui=always diff -- migrations/db/intermediate_db_schema/ migrations/lib/database/intermediate_db/ migrations/lib/database/intermediate_db/enums/
             exit 1
           fi
 

.github/workflows/patch-triage.yml

@@ -0,0 +1,159 @@
+# Patch Triage
+#
+# Runs on every non-draft pull request. Fetches the PR diff and sends it to
+# the patch-triage VM for analysis. Results are posted back as a GitHub Check
+# Run — staff can click "Details" to see the full review in patch-triage
+# (login required).
+#
+# Also notifies the VM when a PR is closed (merged or not) so patch-triage
+# can auto-resolve the associated record.
+
+name: Patch Triage
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, closed]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to re-scan"
+        required: true
+        type: string
+
+permissions:
+  statuses: write
+  pull-requests: read
+
+jobs:
+  pr-closed:
+    if: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Notify patch-triage of PR close
+        env:
+          GITHUB_SCAN_SECRET: ${{ secrets.SCAN_SECRET }}
+          VM_SCAN_URL: ${{ secrets.VM_SCAN_URL }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          MERGED: ${{ github.event.pull_request.merged }}
+        shell: ruby {0}
+        run: |
+          require "json"
+          require "openssl"
+          require "net/http"
+
+          vm_url = ENV["VM_SCAN_URL"].to_s
+          secret = ENV["GITHUB_SCAN_SECRET"].to_s
+
+          if vm_url.empty? || secret.empty?
+            puts "Security scan not configured — skipping"
+            exit 0
+          end
+
+          payload = JSON.generate(
+            pr_number: ENV["PR_NUMBER"],
+            repo:      ENV["REPO"],
+            merged:    ENV["MERGED"] == "true",
+          )
+
+          sig = "sha256=" + OpenSSL::HMAC.hexdigest("SHA256", secret, payload)
+
+          uri = URI("#{vm_url}/pr-closed")
+          req = Net::HTTP::Post.new(uri)
+          req["Content-Type"]      = "application/json"
+          req["X-Scan-Signature"]  = sig
+          req.body = payload
+
+          res = Net::HTTP.start(uri.host, uri.port) { |h| h.request(req) }
+          abort "VM returned #{res.code}: #{res.body}" unless res.is_a?(Net::HTTPSuccess)
+
+  security-scan:
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.action != 'closed' && !github.event.pull_request.draft) }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Resolve PR metadata
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_PR_NUMBER: ${{ github.event.inputs.pr_number }}
+          EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+        shell: ruby {0}
+        run: |
+          require "json"
+          require "securerandom"
+
+          pr_number =
+            if ENV["GITHUB_EVENT_NAME"] == "workflow_dispatch"
+              ENV["INPUT_PR_NUMBER"]
+            else
+              ENV["EVENT_PR_NUMBER"]
+            end
+
+          pr = JSON.parse(
+            `gh pr view #{pr_number} --repo #{ENV["GITHUB_REPOSITORY"]} --json title,author,headRefOid,baseRefName`
+          )
+
+          d = SecureRandom.hex(8)
+          File.open(ENV["GITHUB_OUTPUT"], "a") do |f|
+            f.puts "number=#{pr_number}"
+            f.puts "title<<#{d}"; f.puts pr["title"]; f.puts d
+            f.puts "author<<#{d}"; f.puts pr.dig("author", "login"); f.puts d
+            f.puts "sha=#{pr["headRefOid"]}"
+            f.puts "base_branch=#{pr["baseRefName"]}"
+          end
+
+      - name: Fetch PR diff
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh pr diff ${{ steps.pr.outputs.number }} \
+            --repo ${{ github.repository }} > pr.diff
+
+          echo "Diff size: $(wc -c < pr.diff) bytes"
+
+      - name: Send to security scan
+        env:
+          GITHUB_SCAN_SECRET: ${{ secrets.SCAN_SECRET }}
+          VM_SCAN_URL: ${{ secrets.VM_SCAN_URL }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          PR_TITLE: ${{ steps.pr.outputs.title }}
+          PR_AUTHOR: ${{ steps.pr.outputs.author }}
+          PR_SHA: ${{ steps.pr.outputs.sha }}
+          BASE_BRANCH: ${{ steps.pr.outputs.base_branch }}
+          REPO: ${{ github.repository }}
+        shell: ruby {0}
+        run: |
+          require "json"
+          require "openssl"
+          require "net/http"
+
+          vm_url = ENV["VM_SCAN_URL"].to_s
+          secret = ENV["GITHUB_SCAN_SECRET"].to_s
+
+          if vm_url.empty? || secret.empty?
+            puts "Security scan not configured — skipping"
+            exit 0
+          end
+
+          payload = JSON.generate(
+            pr_number:   ENV["PR_NUMBER"],
+            title:       ENV["PR_TITLE"],
+            diff:        File.read("pr.diff"),
+            author:      ENV["PR_AUTHOR"],
+            repo:        ENV["REPO"],
+            sha:         ENV["PR_SHA"],
+            base_branch: ENV["BASE_BRANCH"],
+          )
+
+          sig = "sha256=" + OpenSSL::HMAC.hexdigest("SHA256", secret, payload)
+
+          uri = URI("#{vm_url}/scan-pr")
+          req = Net::HTTP::Post.new(uri)
+          req["Content-Type"]     = "application/json"
+          req["X-Scan-Signature"] = sig
+          req.body = payload
+
+          res = Net::HTTP.start(uri.host, uri.port) { |h| h.request(req) }
+          abort "VM returned #{res.code}: #{res.body}" unless res.is_a?(Net::HTTPSuccess)

.github/workflows/publish-assets.yml

@@ -6,6 +6,7 @@ on:
       - main
       - stable
       - release/*
+      - precompile-asset-improvements
     tags:
       - beta
       - v*
@@ -20,7 +21,7 @@ jobs:
     runs-on: 'cdck-linux-8-core'
     container: discourse/discourse_test:release
     timeout-minutes: 30
-  
+
     steps:
       - name: Install gh cli
         run: |
@@ -46,6 +47,18 @@ jobs:
           git config --global user.email "ci@ci.invalid"
           git config --global user.name "Discourse CI"
 
+      - name: Symlink vendor/bundle from image
+        run: |
+          ln -s /var/www/discourse/vendor/bundle vendor/bundle
+
+      - name: Setup gems
+        run: |
+          bundle config --local path vendor/bundle
+          bundle config --local deployment true
+          bundle config --local without development
+          bundle install --jobs $(($(nproc) - 1))
+          bundle clean
+
       - name: pnpm install
         run: pnpm install --frozen-lockfile