Merge branch 'master' into dependabot/go_modules/v3/examples/gin-example/go_modules-ec38730807

Author: taliesin-ai

.coderabbit.yaml

@@ -21,7 +21,7 @@ reviews:
     ignore_title_keywords: []
     labels: []
     drafts: false
-    base_branches: ['v3-alpha', 'master']
+    base_branches: ['master']
   tools:
     shellcheck:
       enabled: true

.fossa.yml

@@ -7,6 +7,10 @@ version: 3
 # site locally; it is not distributed with the Wails Go module or the
 # @wailsio/runtime npm package, so it is out of scope for the license
 # compliance posture we want FOSSA to enforce.
+# Example-app frontends are demo/development tooling; they are not
+# distributed as part of the Wails Go module or @wailsio/runtime and
+# are excluded to keep the compliance posture focused on distributed
+# artifacts.
 #
 # The Astro-based docs site (docs/) carries the same pattern: sharp pulls in
 # @img/sharp-libvips-* (LGPL-3.0-or-later) and astro-d2 pulls in
@@ -16,5 +20,7 @@ targets:
   exclude:
     - type: npm
       path: website
+    - type: npm
+      path: v3/examples
     - type: npm
       path: docs

.github/workflows/auto-changelog-v3.yml

@@ -20,14 +20,16 @@ jobs:
 
     permissions:
       contents: write
+      pull-requests: read   # GET /pulls/{n} and /pulls/{n}/files
+      issues: read          # GET /issues/{n}/comments (CodeRabbit summary)
 
     steps:
-    - name: Checkout v3-alpha
+    - name: Checkout master
       uses: actions/checkout@v4
       with:
         ref: master
         fetch-depth: 0
-        token: ${{ secrets.CHANGELOG_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
+        token: ${{ secrets.WAILS_REPO_TOKEN || secrets.GITHUB_TOKEN }}
 
     - name: Resolve PR number
       id: pr
@@ -81,5 +83,11 @@ jobs:
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
         git add v3/UNRELEASED_CHANGELOG.md
+        # The auto-fill step intentionally writes nothing for internal-only PRs
+        # (ci/chore/build/test/style). Skip cleanly so the merge doesn't go red.
+        if git diff --cached --quiet; then
+          echo "ℹ️ No changelog entry to commit (internal PR or no change) — skipping."
+          exit 0
+        fi
         git commit -m "chore(changelog): auto-add entry for PR #${PR_NUMBER} — ${PR_TITLE}"
-        git push https://x-access-token:${{ secrets.CHANGELOG_PUSH_TOKEN || secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git master
+        git push https://x-access-token:${{ secrets.WAILS_REPO_TOKEN || secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git master

.github/workflows/build-and-test-v3.yml

@@ -7,6 +7,9 @@ on:
       - master
     paths:
       - 'v3/**'
+      - 'webview2/**'
+      - 'go.work'
+      - 'go.work.sum'
       - '.github/workflows/build-and-test-v3.yml'
   pull_request_review:
     types: [submitted]
@@ -95,8 +98,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     if: github.base_ref == 'master'
     timeout-minutes: 25
-    env:
-      GOWORK: "off"
     strategy:
       fail-fast: false
       matrix:
@@ -126,7 +127,10 @@ jobs:
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
-          cache-dependency-path: "v3/go.sum"
+          cache-dependency-path: |
+            v3/go.sum
+            webview2/go.sum
+            go.work.sum
 
       - name: Install Task
         uses: arduino/setup-task@v2
@@ -200,25 +204,19 @@ jobs:
     needs: [test_js, test_go]
     runs-on: ${{ matrix.os }}
     if: github.base_ref == 'master'
-    env:
-      GOWORK: "off"
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
         template:
-          - svelte
-          - svelte-ts
-          - vue
-          - vue-ts
-          - react
-          - react-ts
-          - preact
-          - preact-ts
-          - lit
-          - lit-ts
           - vanilla
-          - vanilla-ts
+          - vanilla-js
+          - react
+          - react-js
+          - vue
+          - vue-js
+          - svelte
+          - svelte-js
         go-version: [1.25]
     steps:
       - name: Checkout
@@ -243,7 +241,10 @@ jobs:
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
-          cache-dependency-path: "v3/go.sum"
+          cache-dependency-path: |
+            v3/go.sum
+            webview2/go.sum
+            go.work.sum
 
       - name: Install Task
         uses: arduino/setup-task@v2
@@ -279,6 +280,9 @@ jobs:
           # Replace @wailsio/runtime version with local tarball
           npm pkg set dependencies.@wailsio/runtime="file://$RUNTIME_TGZ"
           cd ..
+          # Register the generated project in the workspace so Go 1.25 workspace
+          # mode does not reject packages in a module not listed in go.work.
+          go work use .
           wails3 build
 
       # GTK3 legacy template builds are covered by the Go example compilation tests above.

.github/workflows/build-cross-image.yml

@@ -30,18 +30,21 @@ on:
     paths:
       - 'v3/internal/commands/build_assets/docker/Dockerfile.cross'
 
+permissions:
+  contents: read
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: wailsapp/wails-cross
 
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:
-      GOWORK: "off"
     permissions:
       contents: read
       packages: write
+    env:
+      GOWORK: "off"
     outputs:
       image_tag: ${{ steps.vars.outputs.image_version }}
 
@@ -114,6 +117,9 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GOWORK: "off"
+    permissions:
+      contents: read
+      packages: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/bump-webview2-v3.yml

@@ -30,9 +30,9 @@ jobs:
         fetch-depth: 0
         token: ${{ secrets.GITHUB_TOKEN || github.token }}
 
-    - name: Get REAL validation script from v3-alpha
+    - name: Get validation script from master
       run: |
-        echo "Fetching the REAL validation script from v3-alpha branch..."
+        echo "Fetching the validation script from master branch..."
         git fetch origin master
         git checkout origin/master -- v3/scripts/validate-changelog.go
         
@@ -121,9 +121,9 @@ jobs:
             echo "🔍 PR source branch: $BRANCH_NAME"
             echo "🔍 Head repository: $HEAD_REPO"
             
-            # Don't push if this is from a fork or if branch is v3-alpha (main branch)
+            # Don't push if this is from a fork or if branch is master (main branch)
             if [ "$HEAD_REPO" != "wails" ] || [ "$BRANCH_NAME" = "master" ]; then
-              echo "⚠️ Cannot push - either fork or direct v3-alpha branch. Manual fix required."
+              echo "⚠️ Cannot push - either fork or master branch. Manual fix required."
               echo "committed=false" >> $GITHUB_OUTPUT
               exit 0
             fi

.github/workflows/changelog-v3.yml

@@ -7,6 +7,9 @@ on:
       - master
     paths:
       - 'v3/**'
+      - 'webview2/**'
+      - 'go.work'
+      - 'go.work.sum'
       - '.github/workflows/cross-compile-test-v3.yml'
   workflow_dispatch:
     inputs:
@@ -77,7 +80,10 @@ jobs:
         with:
           go-version: '1.25'
           cache: true
-          cache-dependency-path: "v3/go.sum"
+          cache-dependency-path: |
+            v3/go.sum
+            webview2/go.sum
+            go.work.sum
 
       - name: Install Task
         uses: arduino/setup-task@v2

.github/workflows/cross-compile-test-v3.yml

@@ -10,31 +10,34 @@ jobs:
     name: Update Sponsors
     runs-on: ubuntu-latest
     if: github.repository == 'wailsapp/wails'
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          # Use the bypass-capable token so the auto-commit can push directly
+          # to the protected master branch (same pattern as publish-npm.yml).
+          token: ${{ secrets.WAILS_REPO_TOKEN || github.token }}
 
       - name: Set Node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: "22"
 
       - name: Update Sponsors
         run: cd scripts/sponsors && chmod 755 ./generate-sponsor-image.sh && ./generate-sponsor-image.sh
         env:
           SPONSORKIT_GITHUB_TOKEN: ${{ secrets.SPONSORS_TOKEN }}
           SPONSORKIT_GITHUB_LOGIN: wailsapp
 
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          commit-message: "chore: update sponsors.svg"
-          add-paths: "website/static/img/sponsors.svg"
-          title: "chore: update sponsors.svg"
-          body: |
-            Auto-generated by the sponsor image workflow
-            
-            [skip ci] [skip actions]
-          branch: update-sponsors
-          base: master
-          delete-branch: true
-          draft: false
+      - name: Commit updated sponsor image
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git diff --quiet -- website/static/img/sponsors.svg; then
+            echo "No sponsor changes to commit."
+            exit 0
+          fi
+          git add website/static/img/sponsors.svg
+          git commit -m "chore: update sponsors.svg [skip ci]"
+          git push