Text and Markdown syntax highlighting consolidation

.github/scripts/check_companion_release_tag_absent.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 from __future__ import annotations
 
 import argparse

.github/scripts/cleanup_companion_releases.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Delete obsolete Companion GitHub Releases after validating every feed marker."""
 
 from __future__ import annotations

.github/scripts/cleanup_test_container_versions.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 from __future__ import annotations
 
 import argparse

.github/scripts/companion_build_required.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Decide whether a pull request needs the expensive companion package build."""
 
 from __future__ import annotations

.github/scripts/manage_companion_artifact_manifest.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Create and verify immutable Companion package artifact manifests."""
 
 from __future__ import annotations

.github/scripts/prepare_release_candidate.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Reserve or resolve the immutable source commit for a publishable build."""
 
 from __future__ import annotations

.github/scripts/promote_companion_release.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 from __future__ import annotations
 
 import argparse
@@ -176,6 +174,8 @@ def request_asset_bytes(asset: dict, token: str | None = None) -> bytes:
                 with urllib.request.urlopen(request) as response:
                     return response.read()
             except urllib.error.URLError as error:
+                if isinstance(error, urllib.error.HTTPError):
+                    error.close()
                 if (
                     not is_retryable_asset_download_error(error)
                     or attempt == ASSET_DOWNLOAD_MAX_ATTEMPTS - 1

.github/scripts/resolve_companion_release_state.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Resolve the immutable publication state for a Companion release tag."""
 
 from __future__ import annotations

.github/scripts/reuse_release_ci_tests.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Reuse successful source checks from CI on the exact release commit."""
 
 from __future__ import annotations
@@ -15,6 +14,9 @@
 CI_WORKFLOW = "test.yml"
 API_TIMEOUT_SECONDS = 10
 JOBS_PER_PAGE = 100
+FRONTEND_REQUIRED_STEPS = frozenset(
+    {"Run browser correctness contracts", "Verify frontend type correctness"}
+)
 
 
 def github_get(url: str, token: str) -> dict[str, Any]:
@@ -63,17 +65,27 @@ def reusable_jobs(api_url: str, repository: str, sha: str, token: str) -> set[st
     successful: set[str] = set()
     page = 1
     while True:
-        jobs_url = (
-            f"{api_url}/repos/{repository}/actions/runs/{run_id}/jobs?"
-            f"filter=latest&per_page={JOBS_PER_PAGE}&page={page}"
-        )
+        jobs_url = f"{api_url}/repos/{repository}/actions/runs/{run_id}/jobs?filter=latest&per_page={JOBS_PER_PAGE}&page={page}"
         jobs = github_get(jobs_url, token).get("jobs")
         if not isinstance(jobs, list):
             raise ValueError("CI workflow jobs response is missing jobs")
         for job in jobs:
             if not isinstance(job, dict):
                 raise ValueError("CI workflow job is not an object")
             if job.get("name") in COMPONENTS and job.get("conclusion") == "success":
+                if job["name"] == "frontend":
+                    steps = job.get("steps", [])
+                    if not isinstance(steps, list):
+                        raise ValueError("Frontend CI job steps are not a list")
+                    successful_steps = {
+                        step.get("name")
+                        for step in steps
+                        if isinstance(step, dict)
+                        and step.get("conclusion") == "success"
+                        and isinstance(step.get("name"), str)
+                    }
+                    if not FRONTEND_REQUIRED_STEPS <= successful_steps:
+                        continue
                 successful.add(job["name"])
         if len(jobs) < JOBS_PER_PAGE:
             return successful

.github/scripts/should_promote_beta_tag.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 from __future__ import annotations
 
 import argparse

.github/scripts/validate_release_scope.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 """Validate a public Sambee release's component-promotion scope."""
 
 from __future__ import annotations

.github/workflows/devcontainer-validate.yml

@@ -33,7 +33,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       os_packages_refresh_key: ${{ steps.metadata.outputs.os_packages_refresh_key }}
     steps:
@@ -44,7 +44,7 @@ jobs:
 
   validate-devcontainer:
     needs: prepare
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
     - name: Checkout code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/docker-image-preview-publish.yml

@@ -222,14 +222,36 @@ jobs:
       if: steps.source-ci.outputs.frontend != 'true'
       run: cd frontend && npm ci --prefer-offline
 
-    - name: Run frontend type checks
+    - name: Verify frontend type correctness
       if: steps.source-ci.outputs.frontend != 'true'
-      run: cd frontend && npx tsc --noEmit
+      id: frontend-types
+      run: cd frontend && npm run typecheck
 
     - name: Run frontend tests
       if: steps.source-ci.outputs.frontend != 'true'
       run: cd frontend && npm run test:ci
 
+    - name: Build production frontend for browser checks
+      if: steps.source-ci.outputs.frontend != 'true'
+      run: cd frontend && npm run build
+
+    - name: Install browser dependencies
+      if: steps.source-ci.outputs.frontend != 'true'
+      run: cd frontend && npm run test:e2e:install -- --with-deps
+
+    - name: Run browser correctness contracts
+      if: steps.source-ci.outputs.frontend != 'true'
+      run: cd frontend && npm run test:browser:ci
+
+    - name: Upload browser correctness reports
+      if: ${{ !cancelled() && steps.source-ci.outputs.frontend != 'true' }}
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: release-browser-correctness
+        path: frontend/test-results/ci/
+        retention-days: 7
+        if-no-files-found: warn
+
   build-and-validate-platforms:
     needs: [prepare, validate-tests]
     if: ${{ needs.prepare.outputs.publication_state == 'build' }}
@@ -243,10 +265,10 @@ jobs:
         include:
           - docker_platform: linux/amd64
             platform_id: amd64
-            runner_label: ubuntu-24.04
+            runner_label: ubuntu-latest
           - docker_platform: linux/arm64
             platform_id: arm64
-            runner_label: ubuntu-24.04-arm
+            runner_label: ubuntu-26.04-arm
     steps:
     - name: Checkout source code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -564,10 +586,10 @@ jobs:
         include:
           - docker_platform: linux/amd64
             platform_id: amd64
-            runner_label: ubuntu-24.04
+            runner_label: ubuntu-latest
           - docker_platform: linux/arm64
             platform_id: arm64
-            runner_label: ubuntu-24.04-arm
+            runner_label: ubuntu-26.04-arm
     steps:
     - name: Checkout source code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/docker-image-publish.yml

@@ -23,7 +23,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       checkout_ref: ${{ steps.metadata.outputs.checkout_ref }}
       release_type: ${{ steps.metadata.outputs.release_type }}

.github/workflows/docker-image-security-scan.yml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       created: ${{ steps.metadata.outputs.created }}
       os_packages_refresh_key: ${{ steps.metadata.outputs.os_packages_refresh_key }}
@@ -39,10 +39,10 @@ jobs:
         include:
           - docker_platform: linux/amd64
             platform_id: amd64
-            runner_label: ubuntu-24.04
+            runner_label: ubuntu-latest
           - docker_platform: linux/arm64
             platform_id: arm64
-            runner_label: ubuntu-24.04-arm
+            runner_label: ubuntu-26.04-arm
     steps:
     - name: Checkout main
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/docker-image-validate.yml

@@ -81,7 +81,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       created: ${{ steps.metadata.outputs.created }}
       os_packages_refresh_key: ${{ steps.metadata.outputs.os_packages_refresh_key }}
@@ -103,10 +103,10 @@ jobs:
         include:
           - docker_platform: linux/amd64
             platform_id: amd64
-            runner_label: ubuntu-24.04
+            runner_label: ubuntu-latest
           - docker_platform: linux/arm64
             platform_id: arm64
-            runner_label: ubuntu-24.04-arm
+            runner_label: ubuntu-26.04-arm
     steps:
     - name: Checkout code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/lint.yml

@@ -10,6 +10,10 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # ─────────────────────────────────────────────────────────────────────
   # Detect which components changed
@@ -42,6 +46,8 @@ jobs:
         }
         backend_extras = {
           "Dockerfile",
+          ".github/workflows/lint.yml",
+          "scripts/test",
           "scripts/verify-backend-lockfiles.py",
           "scripts/verify-python-runtime-image.py",
           ".github/actions/setup-runtime-python/action.yml",
@@ -117,7 +123,7 @@ jobs:
         else:
             raise SystemExit(f"Unsupported event for change detection: {event_name}")
 
-        backend = any(name.startswith("backend/") or name in backend_extras for name in filenames)
+        backend = any(name.startswith("backend/") or name.endswith(".py") or name in backend_extras for name in filenames)
         frontend = any(name.startswith("frontend/") or name in frontend_extras for name in filenames)
         companion = any(name.startswith("companion/") or name in companion_extras for name in filenames)
 
@@ -152,6 +158,9 @@ jobs:
     - name: Ruff check
       run: cd backend && ruff check app tests/test_verify_backend_lockfiles_script.py ../scripts/verify-backend-lockfiles.py
 
+    - name: Ruff executable-script check
+      run: python -m ruff check --select EXE . .github
+
     - name: Ruff format check
       run: cd backend && ruff format --check app tests/test_verify_backend_lockfiles_script.py ../scripts/verify-backend-lockfiles.py
 

.github/workflows/test.yml

@@ -10,6 +10,10 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # ──────────────────────────────────────────────
   # Detect which components changed
@@ -76,7 +80,7 @@ jobs:
   backend:
     needs: changes
     if: needs.changes.outputs.backend == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
     - name: Checkout code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -148,6 +152,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.frontend == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
     - name: Checkout code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -176,12 +181,31 @@ jobs:
     - name: Install dependencies
       run: cd frontend && npm ci --prefer-offline
 
-    - name: TypeScript type check
-      run: cd frontend && npx tsc --noEmit
+    - name: Verify frontend type correctness
+      id: frontend-types
+      run: cd frontend && npm run typecheck
 
     - name: Run tests
       run: cd frontend && npm run test:ci
 
+    - name: Build production frontend
+      run: cd frontend && npm run build
+
+    - name: Install browser dependencies
+      run: cd frontend && npm run test:e2e:install -- --with-deps
+
+    - name: Run browser correctness contracts
+      run: cd frontend && npm run test:browser:ci
+
+    - name: Upload browser correctness reports
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: frontend-browser-correctness
+        path: frontend/test-results/ci/
+        retention-days: 7
+        if-no-files-found: warn
+
   # ──────────────────────────────────────────────
   # Companion: Node.js + Rust + Tauri tests
   # ──────────────────────────────────────────────
@@ -241,17 +265,12 @@ jobs:
     needs: [changes, backend, frontend, companion, website-docs]
     runs-on: ubuntu-latest
     steps:
+    - name: Checkout gate script
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
     - name: Check results
+      env:
+        NEEDS_JSON: ${{ toJSON(needs) }}
+        EVENT_NAME: ${{ github.event_name }}
       run: |
-        if [[ "${{ needs.changes.result }}" != "success" ]]; then
-          echo "Change detection failed or was cancelled: ${{ needs.changes.result }}"
-          exit 1
-        fi
-        results="${{ needs.backend.result }} ${{ needs.frontend.result }} ${{ needs.companion.result }} ${{ needs.website-docs.result }}"
-        for r in $results; do
-          if [[ "$r" != "success" && "$r" != "skipped" ]]; then
-            echo "Job failed or was cancelled: $r"
-            exit 1
-          fi
-        done
-        echo "All tests passed or were skipped."
+        python3 scripts/check_ci_test_gate.py