Merge origin/master into e2e/05-downloads

Resolve harness/hook conflicts by keeping merged #3855 changes.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yasserfaraazkhan

.github/workflows/cmt-provisioner.yml

@@ -1,44 +1,21 @@
 name: CMT Provisioner
 
-# Lightweight trigger workflow for Compatibility Matrix Testing (CMT).
-#
-# Matterwick listens for this workflow's workflow_run:requested event, then provisions one
-# Mattermost cloud instance per version in its hardcoded CMT version set (Matterwick's
-# CMTServerVersions config / CMTVersions, e.g. the active ESR plus the current feature
-# release) and dispatches compatibility-matrix-testing.yml with the CMT_MATRIX input.
-# When compatibility-matrix-testing.yml completes, Matterwick destroys the provisioned
-# instances (cleanup is keyed off the completed workflow_run, matched by commit SHA).
-#
-# The server-version set lives in Matterwick config (managed via gitops), so this workflow
-# takes no inputs. Run it manually from the Actions tab, or let it fire automatically on
-# release branches (below).
-#
-# NOTE (intentional duplicate coverage): a release-v* push ALSO triggers Matterwick's normal
-# release E2E flow (whole suite against the single latest server version). CMT additionally
-# runs the whole suite against its multi-version matrix, whose set includes the latest server.
-# So on a release push the latest server version gets the suite run twice (once by the normal
-# release flow, once by the CMT latest-version leg). This is expected and accepted.
+# Lightweight signal workflow for Compatibility Matrix Testing (CMT).
+# When this runs, matterwick detects the workflow_run:requested event, provisions one
+# cloud server per version in its CMT set, and dispatches compatibility-matrix-testing.yml.
+# Triggers: RC tag pushes (e.g. v6.2.2-rc.1) and manual workflow_dispatch.
 
 on:
-  # Run CMT when a release branch is cut and on every subsequent push to it. The first push
-  # that creates release-v* is the "cut"; later pushes to it re-run CMT.
   push:
-    branches:
-      - "release-v*"
-  # Manual runs from the Actions tab (against any branch).
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+"
   workflow_dispatch: {}
 
-# This workflow does not use GITHUB_TOKEN. Its only purpose is to emit a workflow_run event
-# that Matterwick reacts to; it does not check out the repo or call the GitHub API. Drop all
-# GITHUB_TOKEN scopes so the runner-issued token cannot modify the repo if a step is added later.
 permissions: {}
 
 jobs:
-  signal:
+  trigger-matterwick:
     runs-on: ubuntu-22.04
     steps:
-      - name: Signal Matterwick to provision CMT servers
-        run: |
-          echo "CMT trigger started."
-          echo "Matterwick provisions one server per configured version and then"
-          echo "dispatches compatibility-matrix-testing.yml automatically."
+      - name: Signal matterwick
+        run: echo "CMT provisioning requested — matterwick will handle provisioning and dispatch."

.github/workflows/compatibility-matrix-testing.yml

@@ -13,7 +13,8 @@ on:
 
 # Supersede an in-flight CMT run for the same ref (e.g. rapid release-branch pushes) so we don't
 # pay for overlapping multi-version matrices. Matterwick reaps the cancelled run's provisioned
-# servers on its workflow_run "completed" (cancelled) event, matched by commit SHA.
+# servers on its workflow_run "completed" (cancelled) event, matched by the dispatched test
+# workflow run id (not commit SHA).
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/e2e-functional-template.yml

@@ -243,13 +243,7 @@ jobs:
 
       - name: e2e/use-gnu-tar-macos
         if: runner.os == 'macOS'
-        run: |
-          # BSD tar on macOS can corrupt actions/cache v5 archives; prefer GNU tar when present.
-          if [ -x /opt/homebrew/opt/gnu-tar/libexec/gnubin/gtar ]; then
-            echo "/opt/homebrew/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-          elif [ -x /usr/local/opt/gnu-tar/libexec/gnubin/gtar ]; then
-            echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-          fi
+        run: echo "/opt/homebrew/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
 
       - name: e2e/cache-node-modules
         id: cache-node-modules
@@ -272,25 +266,18 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-electron-gyp-v7-${{ hashFiles('**/package-lock.json') }}
 
-      # Clear pip's HTTP cache on macOS-26 runners before setup-python. The pre-baked
-      # image cache contains entries serialized by an older pip that the newer pip
-      # shipped with Python 3.10 cannot deserialize, producing the noisy
-      # "WARNING: Cache entry deserialization failed, entry ignored" lines in CI.
-      # See actions/setup-python#1317.
-      - name: e2e/clear-pip-cache-macos
-        if: runner.os == 'macOS'
-        run: |
-          rm -rf "${HOME}/Library/Caches/pip" || true
-          python3 -m pip cache purge >/dev/null 2>&1 || true
-
       - name: e2e/setup-python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         env:
           # Bypass pip's on-disk HTTP cache entirely so a stale/corrupt entry on the
-          # runner image cannot trigger deserialization warnings.
+          # runner image cannot trigger deserialization warnings (actions/setup-python#1317).
           PIP_NO_CACHE_DIR: "1"
         with:
-          python-version: "3.10"
+          # Use a version pre-installed on macOS-26 (3.13 is in its toolcache), so
+          # setup-python doesn't install a mismatched interpreter whose pip can't
+          # deserialize the image's pre-baked cache. PIP_NO_CACHE_DIR above is the
+          # remaining guard for non-macOS runners.
+          python-version: "3.13"
           # Omit `cache` — setup-python only accepts pip/pipenv/poetry, not `false`.
 
       - name: e2e/install-os-dependencies

.github/workflows/e2e-functional.yml

@@ -247,10 +247,10 @@ jobs:
         if: runner.os == 'macOS'
         run: |
           # BSD tar on macOS can corrupt actions/cache v5 archives; prefer GNU tar when present.
+          # All current macOS runners are arm64 (Homebrew under /opt/homebrew); keep the
+          # -x guard so a future non-arm64 matrix entry falls back to BSD tar safely.
           if [ -x /opt/homebrew/opt/gnu-tar/libexec/gnubin/gtar ]; then
             echo "/opt/homebrew/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-          elif [ -x /usr/local/opt/gnu-tar/libexec/gnubin/gtar ]; then
-            echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
           fi
 
       - name: e2e/cache-node-modules
@@ -274,25 +274,18 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-electron-gyp-v7-${{ hashFiles('**/package-lock.json') }}
 
-      # Clear pip's HTTP cache on macOS-26 runners before setup-python. The pre-baked
-      # image cache contains entries serialized by an older pip that the newer pip
-      # shipped with Python 3.10 cannot deserialize, producing the noisy
-      # "WARNING: Cache entry deserialization failed, entry ignored" lines in CI.
-      # See actions/setup-python#1317.
-      - name: e2e/clear-pip-cache-macos
-        if: runner.os == 'macOS'
-        run: |
-          rm -rf "${HOME}/Library/Caches/pip" || true
-          python3 -m pip cache purge >/dev/null 2>&1 || true
-
       - name: e2e/setup-python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         env:
           # Bypass pip's on-disk HTTP cache entirely so a stale/corrupt entry on the
-          # runner image cannot trigger deserialization warnings.
+          # runner image cannot trigger deserialization warnings (actions/setup-python#1317).
           PIP_NO_CACHE_DIR: "1"
         with:
-          python-version: "3.10"
+          # Use a version pre-installed on macOS-26 (3.13 is in its toolcache), so
+          # setup-python doesn't install a mismatched interpreter whose pip can't
+          # deserialize the image's pre-baked cache. PIP_NO_CACHE_DIR above is the
+          # remaining guard for non-macOS runners.
+          python-version: "3.13"
           # Omit `cache` — setup-python only accepts pip/pipenv/poetry, not `false`.
 
       - name: e2e/install-os-dependencies

e2e/fixtures/index.ts

@@ -61,10 +61,20 @@ type WorkerFixtures = {
 export const test = base.extend<Fixtures, WorkerFixtures>({
     workerElectronCleanup: [async ({}, use) => {
         await use();
-        await Promise.race([
-            cleanupRegisteredElectronProcesses(),
-            new Promise<void>((resolve) => setTimeout(resolve, 20_000)),
-        ]);
+        let timeoutHandle: NodeJS.Timeout | undefined;
+        try {
+            await Promise.race([
+                cleanupRegisteredElectronProcesses(),
+                new Promise<void>((resolve) => {
+                    timeoutHandle = setTimeout(resolve, 20_000);
+                    timeoutHandle.unref?.();
+                }),
+            ]);
+        } finally {
+            if (timeoutHandle) {
+                clearTimeout(timeoutHandle);
+            }
+        }
     }, {scope: 'worker'}],
 
     appConfig: async ({}, use) => {

e2e/helpers/cleanup.ts

@@ -31,7 +31,7 @@ export async function waitForLockFileRelease(userDataDir: string): Promise<void>
             },
         ).toBe(true);
     } catch {
-        if (fs.existsSync(lockFile)) {
+        if (process.platform === 'win32' && fs.existsSync(lockFile)) {
             try {
                 fs.unlinkSync(lockFile);
             } catch {

e2e/helpers/electronApp.ts

@@ -180,6 +180,17 @@ async function reapPids(pids: number[]): Promise<void> {
         }
         await sleep(200);
     }
+
+    // SIGTERM alone can leave a blocked macOS process alive past the poll,
+    // leaking orphans across runs. Linux already SIGKILL'd above; Windows used
+    // taskkill /F. Escalate survivors on macOS to SIGKILL.
+    if (process.platform === 'darwin') {
+        for (const pid of alive) {
+            if (isProcessAlive(pid)) {
+                signalProcessGroup(pid, 'SIGKILL');
+            }
+        }
+    }
 }
 
 function sleep(ms: number) {
@@ -227,10 +238,14 @@ function forceKillLinuxProcessTree(pid: number): void {
     signalProcessGroup(pid, 'SIGKILL');
 }
 
-async function drainPlaywrightClose(closePromise: Promise<void>): Promise<void> {
+async function drainPlaywrightClose(closePromise: Promise<void>, remainingMs: number): Promise<void> {
     // Playwright keeps a gracefullyClose entry until app.close() settles (#29431).
-    // Cap the wait so worker teardown does not hang for 90s when close never settles.
-    await Promise.race([closePromise, sleep(3_000)]);
+    // Drain within the remaining budget so teardown never exceeds the caller's
+    // timeout (previously +3s on top of the race budget).
+    if (remainingMs <= 0) {
+        return;
+    }
+    await Promise.race([closePromise, sleep(remainingMs)]);
 }
 
 async function forceShutdownLinux(pid: number): Promise<void> {
@@ -266,11 +281,15 @@ function signalShutdownAndReturn(pid: number): void {
 
 async function attemptClose(app: ElectronApplication, timeoutMs: number): Promise<boolean> {
     let closed = false;
-    const closePromise = app.close().catch(() => {}).then(() => {
+
+    // Only mark closed on successful resolve; a rejected close() must leave
+    // closed=false so the caller's SIGTERM/SIGKILL fallback runs.
+    const closePromise = app.close().then(() => {
         closed = true;
-    });
+    }, () => {});
+    const start = Date.now();
     await Promise.race([closePromise, sleep(timeoutMs)]);
-    await drainPlaywrightClose(closePromise);
+    await drainPlaywrightClose(closePromise, timeoutMs - (Date.now() - start));
     return closed;
 }
 

e2e/helpers/login.ts

@@ -3,35 +3,47 @@
 
 import {expect} from '@playwright/test';
 
+import {isTransientEvaluateError} from './testRefs';
 import type {ServerView} from './serverView';
 
 async function isMattermostServerUrl(win: ServerView): Promise<boolean> {
     const url = await win.url().catch(() => '');
     return url.startsWith('http://') || url.startsWith('https://');
 }
 
+async function runRendererProbe(win: ServerView, body: string): Promise<boolean> {
+    try {
+        return await win.runInRenderer<boolean>(body);
+    } catch (error) {
+        if (isTransientEvaluateError(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+
 async function hasAppShell(win: ServerView): Promise<boolean> {
     if (!(await isMattermostServerUrl(win))) {
         return false;
     }
 
-    return win.runInRenderer<boolean>(`
+    return runRendererProbe(win, `
         return Boolean(
             document.querySelector('#post_textbox')
             || document.querySelector('#channelHeaderTitle')
             || document.querySelector('input.search-bar.form-control'),
         );
-    `).catch(() => false);
+    `);
 }
 
 async function hasLoginForm(win: ServerView): Promise<boolean> {
     if (!(await isMattermostServerUrl(win))) {
         return false;
     }
 
-    return win.runInRenderer<boolean>(`
+    return runRendererProbe(win, `
         return Boolean(document.querySelector('#input_loginId'));
-    `).catch(() => false);
+    `);
 }
 
 /**

e2e/helpers/notificationEffects.ts

@@ -10,11 +10,11 @@ import type {ElectronApplication} from 'playwright';
  * often emits `failed` without `show`), so flash_taskbar and dock_bounce tests
  * exercise the same flashFrame() gate the notification `show` handler calls.
  */
-export async function triggerFlashEffects(app: ElectronApplication, flash = true): Promise<void> {
+export async function triggerNotificationEffects(app: ElectronApplication, flash = true): Promise<void> {
     await app.evaluate((_, shouldFlash: boolean) => {
-        const trigger = (global as any).__e2eFlashEffects as ((value: boolean) => void) | undefined;
+        const trigger = (global as any).__e2eNotificationEffects as ((value: boolean) => void) | undefined;
         if (!trigger) {
-            throw new Error('__e2eFlashEffects not exposed (NODE_ENV must be test)');
+            throw new Error('__e2eNotificationEffects not exposed (NODE_ENV must be test)');
         }
         trigger(shouldFlash);
     }, flash);

e2e/helpers/testRefs.ts

@@ -82,11 +82,7 @@ export async function getMainWindowId(app: ElectronApplication): Promise<number>
             });
             return mainWindowId;
         } catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (
-                message.includes('Execution context was destroyed') ||
-                message.includes('Target page, context or browser has been closed')
-            ) {
+            if (isTransientEvaluateError(error)) {
                 return null;
             }
             throw error;
@@ -104,7 +100,7 @@ export async function getMainWindowId(app: ElectronApplication): Promise<number>
 }
 
 export async function getActiveServerWebContentsId(app: ElectronApplication): Promise<number> {
-    const id = await app.evaluate(() => {
+    const id = await evaluateInMainProcess(app, () => {
         const refs = (global as any).__e2eTestRefs;
         const view = refs?.TabManager?.getCurrentActiveTabView?.();
         return view?.webContentsId ?? null;