Move RovingTabIndex to shared component and use it in ActionBarView (#33263 )

* Create a new shared component and a wrapper in app/web * Move unit tests and add new for better coverage * Refactor ActionBarView to use the RovingTabIndexProvider * Clean up the interface and adjust callers * Added documentation and renamed type for better readabililty * Reverting the clean up of IContext * Fix Sonar issues * More Sonar issus fixed
Add CI to detect stale vis screenshots (#33274 )
2026-04-23 09:33:32 +00:00 · 2026-04-23 09:24:31 +00:00 · 2026-04-23 08:26:48 +00:00 · 2026-04-23 07:51:39 +00:00 · 2026-04-22 20:05:31 +00:00 · 2026-04-22 19:50:54 +00:00
1854 changed files with 98230 additions and 37896 deletions
@@ -1,15 +1,16 @@
 *                         @element-hq/element-web-reviewers
 /.github/workflows/**     @element-hq/element-web-team
-package.json              @element-hq/element-web-team
+**/package.json           @element-hq/element-web-team
 /pnpm-lock.yaml           @element-hq/element-web-team

 /apps/web/src/SecurityManager.ts                                                 @element-hq/element-crypto-web-reviewers
-/apps/web/test/SecurityManager-test.ts                                           @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/SecurityManager-test.ts                                @element-hq/element-crypto-web-reviewers
 /apps/web/src/async-components/views/dialogs/security/                           @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/async-components/dialogs/security/                     @element-hq/element-crypto-web-reviewers
 /apps/web/src/components/views/dialogs/security/                                 @element-hq/element-crypto-web-reviewers
-/apps/web/test/components/views/dialogs/security/                                @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/components/views/dialogs/security/                     @element-hq/element-crypto-web-reviewers
 /apps/web/src/stores/SetupEncryptionStore.ts                                     @element-hq/element-crypto-web-reviewers
-/apps/web/test/stores/SetupEncryptionStore-test.ts                               @element-hq/element-crypto-web-reviewers
+/apps/web/test/unit-tests/stores/SetupEncryptionStore-test.ts                    @element-hq/element-crypto-web-reviewers
 /apps/web/src/components/views/settings/tabs/user/EncryptionUserSettingsTab.tsx  @element-hq/element-crypto-web-reviewers
 /apps/web/src/components/views/settings/encryption/                              @element-hq/element-crypto-web-reviewers
 /apps/web/test/unit-tests/components/views/settings/encryption/                  @element-hq/element-crypto-web-reviewers
@@ -26,8 +27,10 @@ package.json              @element-hq/element-web-team

 # Ignore translations as those will be updated by GHA for Localazy download
 /apps/web/src/i18n/strings
+/apps/desktop/src/i18n/strings
 /packages/shared-components/src/i18n/strings
 /apps/web/src/i18n/strings/en_EN.json                    @element-hq/element-web-reviewers
+/apps/desktop/src/i18n/strings/en_EN.json                @element-hq/element-web-reviewers
 /packages/shared-components/src/i18n/strings/en_EN.json  @element-hq/element-web-reviewers

 # Ignore the synapse & mas plugins as this is updated by GHA for docker image updating
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgIIaI6ivggL++4wDQYJKoZIhvcNAQELBQAwgZAxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
+CgwPU1NMIENvcnBvcmF0aW9uMUUwQwYDVQQDDDxTU0wuY29tIEVWIFJvb3QgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyIC0gRGV2ZWxvcG1lbnQwHhcNMTgw
+MTE2MTIxNjM2WhcNNDMwMTE1MTIxNjM2WjCBkDELMAkGA1UEBhMCVVMxDjAMBgNV
+BAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9y
+YXRpb24xRTBDBgNVBAMMPFNTTC5jb20gRVYgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1
+dGhvcml0eSBSU0EgUjIgLSBEZXZlbG9wbWVudDCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAK/qcD65JCkueKp0+KXG2kAw8euDHuraLR3lJoUFz4ilGK1M
+t+RjSuY6dHQw8ku7TnW9ejWoSFjCBSDx7tP/fzOwOxmBW6+F1NDuV/IaUtn3G2lk
+CZglVk9z3n1HuWDN10xNiLoo5nzeIlvNAoDbXDGhI4Y6Z0qouAIS607JpJMWHOqZ
+OUiiOuM11gI5Kz9GtVttXCjRmwlkU8WiJVIUuVedQAQt2FChrzNQewGFFi0uIau/
+wFRclx6hd4JRIImC6VMJd9lcitWsqMcM94pD3fX2ozNgWX+MVlmcDYFSN9Sv8tG4
+yCj4ONS8HZGzbxeyQXJhEJSi2FnBi0j6MD/d4DNFj0hCg9wz3fgVLDGCO0pNMO0Y
+oXdrzfoj1/zEv0Ibgh7zKG2JHkPfapn3ExFI5d6xi66u5tPVI8cvLxqrgybRPs7Z
+y1dQA7ew3LyTPAHoGtbTMvewtx1TkTtRxxhRRm0l58owqSVbSYrixFtosNobCERo
+uiknaQqoY1ZDsdKsaqFoZDbntNRYhN3Ea4OPWVqDUU5ZPz9MTIRAi3MIq854yyQo
+BjX9nv+kYa+Esr19pxUW0z7BWFhbXsMVpt0QMVyhwgzXvEreaZHFwHHaGb9d5x5P
+VBDhsigMmtzBk9NlbCsy+uGXWHgZA/DVefueEq0sv38VoU30uYa5Tj0FLm09AgMB
+AAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUI9PCucv3G9fRoTDu
+ZQ4Hw6g4PkIwHQYDVR0OBBYEFCPTwrnL9xvX0aEw7mUOB8OoOD5CMA4GA1UdDwEB
+/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAk43CCrC0Zbvi7YUsSePKi+KzvyQ9
+mjKa5NBU/A5/sLeZS3R+wqCX7l5euYVDsUuNgNVD/QL9jNIonuHBrvKaxkmqxE1r
+IcDEaUdjy2lQ0uqD7UDoS3ctrjGkPpUahrTdr3gaKcQBtUhn9v4Y2OBm6J1hDVwI
+CIKcxIzRv6AUpApOtk+++m5tzDU48t8+GzrVl1hkspSYcumA+zuHllbPDL1ADdo5
+kK/bBQtZrGqzPqKzeqaB1A5Wm0Igwf++7nyzdKNdjxtv907D9vg8EB4Swavuv/Ne
+5/jbpI32pz0NIzzSl5ARAHuFhILsO/cEAlloDoTHzibHqFDIeU9/59HMUsJYMOtD
+Ii0/LmQ6dBE4TeukCCLJwtkFYZ2eBgDjF/LHBB+z/UBs4milRgwx+Pe5UDUEjtGe
+G/XMVnTSKZTy9jMaXJD5EmfP+Cfh8EEgFgjg4AmLUbEo9gXzPxyXSLgd8JGSsjg8
+EV/Ri4Mmmt4XUwlSVvEOezxxDGd17gwbottCIC+rqPHonHkGmKpLMH80Bk0uOOCs
+ui1oVwSifMyIcudgCcOfRLUf/f2j2NW7N7E7Vw/Zqfn+pqp/EG0KCqOM2vfJAc0s
+u3rSrOJZGtB6txgtmTjoadxApWf4U/FCi3uArt6gS5MJqZjuiRNXs/K3SlSAqLGl
+5UiG52ew+VdBHzE=
+-----END CERTIFICATE-----
@@ -11,7 +11,7 @@ runs:
    using: composite
    steps:
        - name: Download release tarball
-          uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1
+          uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1
          with:
              tag: ${{ inputs.tag }}
              fileName: element-*.tar.gz*
@@ -31,7 +31,9 @@ runs:

        - name: Move webapp to out-file-path
          shell: bash
-          run: mv ${{ runner.temp }}/download-verify-element-tarball/webapp ${{ inputs.out-file-path }}
+          run: mv ${{ runner.temp }}/download-verify-element-tarball/webapp "$OUT_PATH"
+          env:
+              OUT_PATH: ${{ inputs.out-file-path }}

        - name: Clean up temp directory
          shell: bash
@@ -0,0 +1,49 @@
+name: Setup playwright
+description: Installs playwright browsers and sets up a cache
+inputs:
+    needs-webkit:
+        description: Whether to install the additional dependencies for webkit
+        required: false
+        default: "false"
+    write-cache:
+        description: Whether to write the cache back
+        required: true
+runs:
+    using: composite
+    steps:
+        - name: Calculate cache key
+          id: key
+          run: |
+              PW_VERSION=$(pnpm --silent -- playwright --version | awk '{print $2}')
+              echo "key=${PREFIX}-playwright-${PW_VERSION}" >> $GITHUB_OUTPUT
+          shell: bash
+          env:
+              PREFIX: ${{ runner.os }}-${{ runner.arch }}
+
+        - name: Cache playwright binaries
+          uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+          if: inputs.write-cache == 'true'
+          id: cache
+          with:
+              path: ~/.cache/ms-playwright
+              key: ${{ steps.key.outputs.key }}
+
+        # When running in merge queue only restore the cache, never write it
+        - name: Restore playwright binaries cache
+          uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+          if: inputs.write-cache != 'true'
+          id: cache-restore
+          with:
+              path: ~/.cache/ms-playwright
+              key: ${{ steps.key.outputs.key }}
+
+        - name: Install Playwright browsers
+          if: (steps.cache.outputs.cache-hit || steps.cache-restore.outputs.cache-hit) != 'true'
+          shell: bash
+          run: pnpm playwright install --with-deps
+
+        # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
+        - name: Install system dependencies for WebKit
+          if: inputs.needs-webkit == 'true' && (steps.cache.outputs.cache-hit || steps.cache-restore.outputs.cache-hit) == 'true'
+          shell: bash
+          run: pnpm playwright install-deps webkit
@@ -2,14 +2,45 @@
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": ["github>matrix-org/renovate-config-element-web"],
    "postUpdateOptions": ["pnpmDedupe"],
+    "stopUpdatingLabel": "X-Blocked",
+    "packageRules": [
+        {
+            "description": "Group all testcontainers docker digests",
+            "groupName": "testcontainers docker digests",
+            "groupSlug": "testcontainers-docker",
+            "matchDepTypes": ["testcontainers-docker"],
+            "matchPackageNames": ["*"]
+        },
+        {
+            "description": "Separate updates to overrides from other groups",
+            "matchDepTypes": ["pnpm.overrides"],
+            "groupSlug": null
+        },
+        {
+            "description": "Disable any major updates to overrides as this almost always is wrong",
+            "matchDepTypes": ["pnpm.overrides"],
+            "matchUpdateTypes": ["major"],
+            "enabled": false
+        }
+    ],
    "customManagers": [
        {
+            "description": "Update testcontainers docker digests",
            "customType": "regex",
            "datasourceTemplate": "docker",
            "versioningTemplate": "loose",
-            "description": "Update testcontainers docker digests",
            "managerFilePatterns": ["**/testcontainers/*.ts"],
-            "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""]
+            "matchStrings": ["\\s+\"(?<depName>[^@]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""],
+            "depTypeTemplate": "testcontainers-docker"
+        },
+        {
+            "description": "Update element-desktop hakDependencies",
+            "customType": "jsonata",
+            "managerFilePatterns": ["/(^|/)package\\.json$/"],
+            "fileFormat": "json",
+            "matchStrings": ["hakDependencies.$each(function($v, $k) { { 'packageName': $k, 'currentValue': $v } })"],
+            "datasourceTemplate": "npm",
+            "depTypeTemplate": "hak"
        }
    ]
 }
@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types:
            - closed
            - labeled
@@ -2,8 +2,10 @@
 # taking the artifact and uploading it to Netlify for easier viewing
 name: Upload End to End Test report to Netlify
 on:
-    workflow_run:
-        workflows: ["End to End Tests"]
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
+        workflows: ["Build & Test"]
        types:
            - completed

@@ -25,7 +27,7 @@ jobs:
            actions: read
        steps:
            - name: Download HTML report
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -1,7 +1,13 @@
-# Produce a build of element-web with this version of react-sdk
-# and any matching branches of element-web and js-sdk, output it
-# as an artifact and run end-to-end tests.
-name: End to End Tests
+# builds Element Web
+# runs Playwright tests against the built Element Web
+# builds Element Desktop using the built Element Web
+#
+# Tries to use a matching js-sdk branch for the build.
+#
+# Produces a `webapp` artifact
+# Produces multiple Desktop artifacts
+# Produces multiple Playwright report artifacts
+name: Build & Test
 on:
    # CRON to run all Projects at 6am UTC
    schedule:
@@ -10,9 +16,8 @@ on:
    merge_group:
        types: [checks_requested]
    push:
-        branches: [develop, master]
-    repository_dispatch:
-        types: [element-web-notify]
+        # We do not build on push to develop as the merge_group check handles that
+        branches: [staging, master]

    # support triggering from other workflows
    workflow_call:
@@ -35,28 +40,31 @@ concurrency:
 env:
    # fetchdep.sh needs to know our PR number
    PR_NUMBER: ${{ github.event.pull_request.number }}
-    # Use 6 runners in the default case, but 4 when running on a schedule where we run all 5 projects (20 runners total)
-    NUM_RUNNERS: ${{ github.event_name == 'schedule' && 4 || 6 }}
+    # Use 4 runners in the default case, but only 1 when running on a schedule where we run all 5 projects
+    NUM_RUNNERS: ${{ github.event_name == 'schedule' && 1 || 4 }}
    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 permissions: {} # No permissions required

 jobs:
-    build:
-        name: "Build Element-Web"
+    build_ew:
+        name: "Build Element Web"
        runs-on: ubuntu-24.04
        if: inputs.skip != true
        outputs:
            num-runners: ${{ env.NUM_RUNNERS }}
            runners-matrix: ${{ steps.runner-vars.outputs.matrix }}
+            # Skip pull_request runs on renovate PRs to speed up CI time, delegating to the full run in merge queue
+            skip: ${{ inputs.skip || (github.event_name == 'pull_request' && startsWith(github.head_ref, 'renovate/')) }}
        steps:
            - name: Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -75,10 +83,10 @@ jobs:
              env:
                  CI_PACKAGE: true
              working-directory: apps/web
-              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build

            - name: Upload Artifact
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: webapp
                  path: apps/web/webapp
@@ -86,17 +94,17 @@ jobs:

            - name: Calculate runner variables
              id: runner-vars
-              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              with:
                  script: |
                      const numRunners = parseInt(process.env.NUM_RUNNERS, 10);
                      const matrix = Array.from({ length: numRunners }, (_, i) => i + 1);
                      core.setOutput("matrix", JSON.stringify(matrix));

-    playwright:
-        name: "Run Tests [${{ matrix.project }}] ${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}"
-        needs: build
-        if: inputs.skip != true
+    playwright_ew:
+        name: "Run Tests [${{ matrix.project }}] ${{ matrix.runner }}/${{ needs.build_ew.outputs.num-runners }}"
+        needs: build_ew
+        if: needs.build_ew.outputs.skip == 'false'
        runs-on: ubuntu-24.04
        permissions:
            actions: read
@@ -106,7 +114,7 @@ jobs:
            fail-fast: false
            matrix:
                # Run multiple instances in parallel to speed up the tests
-                runner: ${{ fromJSON(needs.build.outputs.runners-matrix) }}
+                runner: ${{ fromJSON(needs.build_ew.outputs.runners-matrix) }}
                project:
                    - Chrome
                    - Firefox
@@ -132,13 +140,13 @@ jobs:
                  repository: element-hq/element-web

            - name: 📥 Download artifact
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: webapp
                  path: apps/web/webapp

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  cache-dependency-path: pnpm-lock.yaml
@@ -147,100 +155,157 @@ jobs:
            - name: Install dependencies
              run: pnpm install --frozen-lockfile

-            - name: Get installed Playwright version
-              id: playwright
-              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
-
-            - name: Cache playwright binaries
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-              id: playwright-cache
+            - name: Setup playwright
+              uses: ./.github/actions/setup-playwright
              with:
-                  path: ~/.cache/ms-playwright
-                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}
-
-            - name: Install Playwright browsers
-              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: pnpm playwright install --with-deps --no-shell
-
-            - name: Install system dependencies for WebKit
-              # Some WebKit dependencies seem to lay outside the cache and will need to be installed separately
-              if: matrix.project == 'WebKit' && steps.playwright-cache.outputs.cache-hit == 'true'
-              run: pnpm playwright install-deps webkit
+                  needs-webkit: ${{ matrix.project == 'WebKit' }}
+                  write-cache: ${{ github.event_name != 'merge_group' }}

            # We skip tests tagged with @mergequeue when running on PRs, but run them in MQ and everywhere else
            - name: Run Playwright tests
              working-directory: apps/web
              run: |
-                  pnpm playwright test \
-                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                  pnpm test:playwright \
+                      --shard "$SHARD" \
                      --project="${{ matrix.project }}" \
                      ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+              env:
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build_ew.outputs.num-runners) }}

            - name: Upload blob report to GitHub Actions Artifacts
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
-                  name: all-blob-reports-${{ matrix.project }}-${{ matrix.runner }}
+                  name: blob-report-${{ matrix.project }}-${{ matrix.runner }}
                  path: apps/web/blob-report
                  retention-days: 1
+                  if-no-files-found: error

    downstream-modules:
        name: Downstream Playwright tests [element-modules]
-        needs: build
-        if: inputs.skip != true && github.event_name == 'merge_group'
-        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
+        needs: build_ew
+        if: needs.build_ew.outputs.skip == 'false' && github.event_name == 'merge_group'
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
        with:
            webapp-artifact: webapp
+            reporter: blob
+
+    prepare_ed:
+        name: "Prepare Element Desktop"
+        uses: ./.github/workflows/build_desktop_prepare.yaml
+        needs: build_ew
+        if: needs.build_ew.outputs.skip == 'false'
+        permissions:
+            contents: read
+        with:
+            config: ${{ (github.event.pull_request.base.ref || github.ref_name) == 'develop' && 'element.io/nightly' || 'element.io/release' }}
+            version: ${{ case((github.event.pull_request.base.ref || github.ref_name) == 'develop' || github.event_name == 'merge_group', 'develop', '') }}
+            webapp-artifact: webapp
+
+    build_ed_windows:
+        needs: prepare_ed
+        name: "Desktop Windows"
+        uses: ./.github/workflows/build_desktop_windows.yaml
+        # Skip Windows builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
+        if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
+        strategy:
+            matrix:
+                arch: [x64, ia32, arm64]
+        with:
+            arch: ${{ matrix.arch }}
+            blob_report: true
+
+    build_ed_linux:
+        needs: prepare_ed
+        name: "Desktop Linux"
+        uses: ./.github/workflows/build_desktop_linux.yaml
+        strategy:
+            matrix:
+                sqlcipher: [system, static]
+                arch: [amd64, arm64]
+                runAllTests:
+                    - ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests') }}
+                exclude:
+                    # We ship static sqlcipher builds, so delegate testing the system builds to the merge queue
+                    - runAllTests: false
+                      sqlcipher: system
+                    # Additionally skip arm64 system builds on PRs, as the amd64 test is enough for a smoke test and includes the screenshot tests
+                    - runAllTests: false
+                      arch: arm64
+        with:
+            sqlcipher: ${{ matrix.sqlcipher }}
+            arch: ${{ matrix.arch }}
+            blob_report: true
+
+    build_ed_macos:
+        needs: prepare_ed
+        name: "Desktop macOS"
+        uses: ./.github/workflows/build_desktop_macos.yaml
+        # Skip macOS builds on PRs, as the Linux amd64 build is enough of a smoke test and includes the screenshot tests
+        # and we have a very low limit of concurrent macos runners (5) across the Github org.
+        if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'X-Run-All-Tests')
+        with:
+            blob_report: true

    complete:
        name: end-to-end-tests
        needs:
-            - playwright
+            - build_ew
+            - playwright_ew
            - downstream-modules
+            - prepare_ed
+            - build_ed_windows
+            - build_ed_linux
+            - build_ed_macos
        if: always()
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              if: inputs.skip != true
+              if: needs.build_ew.outputs.skip == 'false'
              with:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-              if: inputs.skip != true
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
-              if: inputs.skip != true
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+              if: needs.build_ew.outputs.skip == 'false'
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              if: needs.build_ew.outputs.skip == 'false'
              with:
                  cache: "pnpm"
                  node-version: "lts/*"

            - name: Install dependencies
-              if: inputs.skip != true
+              if: needs.build_ew.outputs.skip == 'false'
              run: pnpm install --frozen-lockfile

            - name: Download blob reports from GitHub Actions Artifacts
-              if: inputs.skip != true
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              if: needs.build_ew.outputs.skip == 'false'
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
-                  pattern: all-blob-reports-*
+                  pattern: blob-report-*
                  path: all-blob-reports
                  merge-multiple: true

            - name: Merge into HTML Report
-              if: inputs.skip != true
-              run: pnpm playwright merge-reports --reporter=html,./apps/web/playwright/flaky-reporter.ts,@element-hq/element-web-playwright-common/lib/stale-screenshot-reporter.js ./all-blob-reports
+              if: needs.build_ew.outputs.skip == 'false'
+              run: |
+                  pnpm playwright merge-reports \
+                      --config=playwright-merge.config.ts \
+                      ./all-blob-reports
              env:
                  # Only pass creds to the flaky-reporter on main branch runs
                  GITHUB_TOKEN: ${{ github.ref_name == 'develop' && secrets.ELEMENT_BOT_TOKEN || '' }}
+                  PLAYWRIGHT_HTML_TITLE: ${{ case(github.event_name == 'pull_request', format('Playwright Report PR-{0}', env.PR_NUMBER), 'Playwright Report') }}

            # Upload the HTML report even if one of our reporters fails, this can happen when stale screenshots are detected
            - name: Upload HTML report
-              if: always() && inputs.skip != true
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              if: always() && needs.build_ew.outputs.skip == 'false'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: html-report
                  path: playwright-report
                  retention-days: 14
+                  if-no-files-found: error

            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
              run: exit 1
@@ -44,9 +44,11 @@ jobs:
                shell: bash
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  # Disable cache on Windows as it is slower than not caching
                  # https://github.com/actions/setup-node/issues/975
@@ -64,10 +66,10 @@ jobs:
              working-directory: apps/web
              env:
                  CI_PACKAGE: true
-              run: VERSION=$(scripts/get-version-from-git.sh) pnpm build
+              run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build

            - name: Upload Artifact
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: webapp-${{ matrix.image }}
                  path: apps/web/webapp
@@ -15,6 +15,8 @@ jobs:
            VERSION: ${{ github.ref_name }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Download package
              working-directory: apps/web
@@ -67,7 +69,7 @@ jobs:
                  dpkg-gencontrol -v"$VERSION" -ldebian/tmp/DEBIAN/changelog
                  dpkg-deb -Zxz --root-owner-group --build debian/tmp element-web.deb

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: element-web.deb
                  path: apps/web/element-web.deb
@@ -75,7 +77,7 @@ jobs:

            - name: Publish to packages.element.io
              if: github.event.release.prerelease == false
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
              with:
                  file: apps/web/element-web.deb
                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -0,0 +1,313 @@
+name: Build and Deploy
+on:
+    # Nightly build
+    schedule:
+        - cron: "0 9 * * *"
+    # Release build
+    release:
+        types: [published]
+    # Manual nightly & release
+    workflow_dispatch:
+        inputs:
+            mode:
+                description: What type of build to trigger. Release builds MUST be ran from the `master` branch.
+                required: true
+                default: nightly
+                type: choice
+                options:
+                    - nightly
+                    - release
+            macos:
+                description: Build macOS
+                required: true
+                type: boolean
+                default: true
+            windows:
+                description: Build Windows
+                required: true
+                type: boolean
+                default: true
+            linux:
+                description: Build Linux
+                required: true
+                type: boolean
+                default: true
+            deploy:
+                description: Deploy artifacts
+                required: true
+                type: boolean
+                default: true
+run-name: Element ${{ inputs.mode != 'release' && github.event_name != 'release' && 'Nightly' || 'Desktop' }}
+concurrency: ${{ github.workflow }}
+env:
+    R2_BUCKET: ${{ vars.R2_BUCKET }}
+permissions: {} # Uses ELEMENT_BOT_TOKEN
+jobs:
+    prepare:
+        uses: ./.github/workflows/build_desktop_prepare.yaml
+        permissions:
+            contents: read
+        with:
+            config: element.io/${{ inputs.mode || (github.event_name == 'release' && 'release') || 'nightly' }}
+            version: ${{ (inputs.mode != 'release' && github.event_name != 'release') && 'develop' || '' }}
+            nightly: ${{ inputs.mode != 'release' && github.event_name != 'release' }}
+            deploy: ${{ inputs.deploy || (github.event_name != 'workflow_dispatch' && github.event.release.prerelease != true) }}
+        secrets:
+            CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+            CF_R2_TOKEN: ${{ secrets.CF_R2_TOKEN }}
+
+    trigger-pro-pipeline:
+        name: Trigger Pro pipeline
+        needs: prepare
+        runs-on: ubuntu-24.04
+        steps:
+            - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
+              with:
+                  repository: element-hq/element-web-pro
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  event-type: trigger-pipeline
+                  client-payload: |-
+                      {
+                          "base-ref": "${{ github.ref_name }}"
+                      }
+
+    windows:
+        if: github.event_name != 'workflow_dispatch' || inputs.windows
+        needs: prepare
+        name: Windows ${{ matrix.arch }}
+        strategy:
+            matrix:
+                arch: [x64, arm64]
+        uses: ./.github/workflows/build_desktop_windows.yaml
+        secrets: inherit # zizmor: ignore[secrets-inherit]
+        with:
+            sign: true
+            arch: ${{ matrix.arch }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    macos:
+        if: github.event_name != 'workflow_dispatch' || inputs.macos
+        needs: prepare
+        name: macOS
+        uses: ./.github/workflows/build_desktop_macos.yaml
+        secrets: inherit # zizmor: ignore[secrets-inherit]
+        with:
+            sign: true
+            base-url: https://packages.element.io/${{ needs.prepare.outputs.packages-dir }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    linux:
+        if: github.event_name != 'workflow_dispatch' || inputs.linux
+        needs: prepare
+        name: Linux ${{ matrix.arch }} (sqlcipher ${{ matrix.sqlcipher }})
+        strategy:
+            matrix:
+                arch: [amd64, arm64]
+                sqlcipher: [static]
+        uses: ./.github/workflows/build_desktop_linux.yaml
+        with:
+            arch: ${{ matrix.arch }}
+            sqlcipher: ${{ matrix.sqlcipher }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    deploy:
+        needs:
+            - prepare
+            - macos
+            - linux
+            - windows
+        runs-on: ubuntu-24.04
+        name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
+        if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
+        environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
+        steps:
+            - name: Download artifacts
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+
+            - name: Prepare artifacts for deployment
+              run: |
+                  set -ex
+
+                  # Windows
+                  for arch in x64 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          mkdir -p packages.element.io/{install,update}/win32/$arch
+                          mv win-$arch/squirrel-windows*/*.exe "packages.element.io/install/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/*.nupkg "packages.element.io/update/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/RELEASES "packages.element.io/update/win32/$arch/"
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      mkdir -p packages.element.io/{install,update}/macos
+                      mv macos/*.dmg packages.element.io/install/macos/
+                      mv macos/*-mac.zip packages.element.io/update/macos/
+                      mv macos/*.json packages.element.io/update/macos/
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-x86-64
+                      mv linux-amd64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-x86-64
+                  fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-aarch64
+                      mv linux-arm64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-aarch64
+                  fi
+
+            # We don't wish to store the installer for every nightly ever, so we only keep the latest
+            - name: "[Nightly] Strip version from installer file"
+              if: needs.prepare.outputs.nightly-version != ''
+              run: |
+                  set -ex
+
+                  # Windows
+                  for arch in x64 arm64
+                  do
+                      if [ -d "win-$arch" ]; then mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe; fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg; fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz; fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz; fi
+
+            - name: "[Release] Prepare release latest symlink"
+              if: needs.prepare.outputs.nightly-version == ''
+              run: |
+                  set -ex
+
+                  # Windows
+                  for arch in x64 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          pushd packages.element.io/install/win32/$arch
+                          ln -s "$(find . -type f -iname "*.exe" | xargs -0 -n1 -- basename)" "Element Setup.exe"
+                          popd
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      pushd packages.element.io/install/macos
+                      ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"
+                      popd
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-x86-64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-aarch64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+
+            - name: Stash packages.element.io
+              if: needs.prepare.outputs.deploy == 'false'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: packages.element.io
+                  path: packages.element.io
+
+            # Checksum algorithm specified as per https://developers.cloudflare.com/r2/examples/aws/aws-cli/
+            - name: Deploy artifacts
+              if: needs.prepare.outputs.deploy == 'true'
+              run: |
+                  set -x
+                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto --checksum-algorithm CRC32
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+                  R2_URL: ${{ vars.CF_R2_S3_API }}
+                  DEPLOYMENT_DIR: ${{ needs.prepare.outputs.packages-dir }}
+
+            - name: Notify packages.element.io of new files
+              if: needs.prepare.outputs.deploy == 'true'
+              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
+              with:
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  repository: element-hq/packages.element.io
+                  event-type: packages-index
+
+            - name: Find debs
+              id: deb
+              if: needs.linux.result == 'success'
+              run: |
+                  set -x
+
+                  for arch in amd64 arm64
+                  do
+                      echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
+                  done
+
+            - name: Stash debs
+              if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: debs
+                  path: |
+                      ${{ steps.deb.outputs.amd64 }}
+                      ${{ steps.deb.outputs.arm64 }}
+
+            - name: Publish amd64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.amd64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+            - name: Publish arm64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.arm64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+    deploy-ess:
+        needs: deploy
+        runs-on: ubuntu-24.04
+        name: Deploy builds to ESS
+        if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
+        env:
+            BUCKET_NAME: "element-desktop-msi.onprem.element.io"
+            AWS_REGION: "eu-central-1"
+        permissions:
+            id-token: write # This is required for requesting the JWT
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
+              with:
+                  role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
+                  role-session-name: githubaction-run-${{ github.run_id }}
+                  aws-region: ${{ env.AWS_REGION }}
+
+            - name: Download artifacts
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  pattern: win-*
+
+            - name: Copy files to S3
+              run: |
+                  set -x
+
+                  PREFIX="${VERSION%.*}"
+                  for file in win-*/*.msi; do
+                      filename=$(basename "$file")
+                      aws s3 cp "$file" "s3://${{ env.BUCKET_NAME }}/$PREFIX/$filename"
+                  done
+              env:
+                  VERSION: ${{ github.event.release.tag_name }}
@@ -0,0 +1,265 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
+            arch:
+                type: string
+                required: true
+                description: "The architecture to build for, one of 'amd64' | 'arm64'"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sqlcipher:
+                type: string
+                required: true
+                description: "How to link sqlcipher, one of 'system' | 'static'"
+            blob_report:
+                type: boolean
+                required: false
+                description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'desktop-prepare'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + changelog.Debian - the changelog file to embed in the Debian package
+                    + variant.json - the variant configuration to use for the build
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "desktop-prepare"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            runs-on:
+                type: string
+                required: false
+                description: "The runner image to use, normally set for you, may be needed for running in private repos."
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "tar.gz deb"
+env:
+    SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
+    MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: Build Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
+        # We build on native infrastructure as matrix-seshat fails to cross-compile properly
+        # https://github.com/matrix-org/seshat/issues/135
+        runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+        env:
+            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env:${{ case(github.event_name == 'push', inputs.ref || github.ref_name, github.event_name == 'release', 'staging', 'develop') }}
+        steps:
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
+              id: config
+              with:
+                  key: "${{ inputs.arch }}"
+                  export_to: output
+                  map: |
+                      {
+                        "amd64": {
+                          "arch": "x86-64"
+                        },
+                        "arm64": {
+                          "arch": "aarch64",
+                          "build-args": "--arm64"
+                        }
+                      }
+
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  ref: ${{ inputs.ref }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
+                  path: apps/desktop
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+              with:
+                  key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion', 'apps/desktop/dockerbuild/*') }}
+                  path: |
+                      apps/desktop/.hak
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+              env:
+                  # Workaround for https://github.com/actions/setup-node/issues/317
+                  FORCE_COLOR: 0
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile --filter element-desktop"
+
+            - name: "Get modified files"
+              id: changed_files
+              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-web'
+              uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47
+              with:
+                  files: |
+                      apps/desktop/dockerbuild/**
+
+            # This allows contributors to test changes to the dockerbuild image within a pull request
+            - name: Build docker image
+              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+              if: steps.changed_files.outputs.any_modified == 'true'
+              with:
+                  file: apps/desktop/dockerbuild/Dockerfile
+                  context: apps/desktop
+                  load: true
+                  platforms: linux/${{ inputs.arch }}
+                  tags: ${{ env.HAK_DOCKER_IMAGE }}
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  docker run \
+                    -v ${{ github.workspace }}:/work -w /work \
+                    -e SQLCIPHER_BUNDLED \
+                    -e CI=1 \
+                    $HAK_DOCKER_IMAGE \
+                    pnpm -C apps/desktop run build:native
+
+            - name: Fix permissions
+              run: |
+                  # For .hak
+                  sudo chown -R $USER:$USER apps/desktop/.hak
+                  # For node_modules pnpm strict security
+                  sudo chmod +x node_modules/7zip-bin/linux/*/7za
+
+            - name: Check native libraries in hak dependencies
+              working-directory: apps/desktop
+              run: |
+                  shopt -s globstar
+
+                  for filename in ./.hak/hakModules/**/*.node; do
+                      ./scripts/glibc-check.sh $filename
+                  done
+
+            - name: Generate debian files and arguments
+              working-directory: apps/desktop
+              run: |
+                  if [ -f changelog.Debian ]; then
+                      echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
+                  fi
+
+            - name: Build App
+              working-directory: apps/desktop
+              run: pnpm run build --publish never $BUILD_ARGS -l $TARGETS
+              env:
+                  VARIANT_PATH: variant.json
+                  # Only set for Nightly builds
+                  VERSION: ${{ inputs.version }}
+                  # Workaround for https://github.com/electron-userland/electron-builder/issues/5721
+                  USE_HARD_LINKS: false
+                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Check native libraries
+              working-directory: apps/desktop
+              run: |
+                  set -x
+                  shopt -s globstar
+
+                  FILES=$(file dist/**/*.node)
+                  echo $FILES
+
+                  ! echo "$FILES" | grep -v "$ARCH"
+
+                  LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
+                  echo "$LIBS"
+
+                  set +x
+                  assert_contains_string() { [[ "$1" == *"$2"* ]]; }
+                  ! assert_contains_string "$LIBS" "libcrypto.so.1.1"
+                  if [ "$SQLCIPHER_BUNDLED" == "1" ]; then
+                      ! assert_contains_string "$LIBS" "libsqlcipher.so.0"
+                  else
+                      assert_contains_string "$LIBS" "libsqlcipher.so.0"
+                  fi
+
+                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
+              env:
+                  ARCH: ${{ steps.config.outputs.arch }}
+
+            # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+                  path: |
+                      apps/desktop/dist
+                      !apps/desktop/dist/*-unpacked/**
+                  retention-days: 1
+
+            - name: Assert deb is present and valid
+              if: contains(inputs.targets, 'deb')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/element-desktop*$ARCH.deb
+
+                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
+                  echo "deb listing: "
+                  echo "$DEB_LISTING"
+                  ! echo "$DEB_LISTING" | grep '^h'
+              env:
+                  ARCH: ${{ inputs.arch }}
+
+            - name: Assert tar.gz is present
+              if: contains(inputs.targets, 'tar.gz')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/element-desktop*.tar.gz
+
+                  TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
+                  echo "tar.gz listing: "
+                  echo "$TAR_GZ_LISTING"
+                  ! echo "$TAR_GZ_LISTING" | grep '^h'
+
+    test:
+        name: Test Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
+        needs: build
+        if: inputs.test && contains(inputs.targets, 'deb')
+        uses: ./.github/workflows/build_desktop_test.yaml
+        with:
+            project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+            artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+            runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+            executable: /opt/Element*/element-desktop*
+            prepare_cmd: |
+                sudo apt-get -qq update
+                sudo apt install ./dist/*.deb
+            blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}
@@ -0,0 +1,234 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        secrets:
+            APPLE_ID:
+                required: false
+            APPLE_ID_PASSWORD:
+                required: false
+            APPLE_CSC_KEY_PASSWORD:
+                required: false
+            APPLE_CSC_LINK:
+                required: false
+        inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sign:
+                type: string
+                required: false
+                description: "Whether to sign & notarise the build, requires 'Desktop Apple' environment"
+            base-url:
+                type: string
+                required: false
+                description: "The URL to which the output will be deployed."
+            blob_report:
+                type: boolean
+                required: false
+                description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'desktop-prepare'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + variant.json - the variant configuration to use for the build
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "desktop-prepare"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "dmg zip"
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: Build macOS Universal
+        runs-on: macos-15 # M1
+        environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
+        steps:
+            - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
+              with:
+                  xcode-version: latest-stable
+
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  ref: ${{ inputs.ref }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
+                  path: apps/desktop
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+              with:
+                  key: ${{ runner.os }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion') }}
+                  path: |
+                      apps/desktop/.hak
+
+            - name: Install Rust
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  rustup toolchain install stable --profile minimal --no-self-update
+                  rustup default stable
+                  rustup target add aarch64-apple-darwin
+                  rustup target add x86_64-apple-darwin
+
+            # M1 macos-14 comes without Python preinstalled
+            - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+              with:
+                  python-version: "3.13"
+
+            # Install Quartz for DMG badges
+            # https://github.com/electron-userland/electron-builder/issues/9511#issuecomment-3774092888
+            - run: sudo pip3 install pyobjc-framework-Quartz
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile --filter element-desktop"
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              working-directory: apps/desktop
+              run: pnpm run build:native:universal
+
+            # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
+            - name: "[Signed] Build App"
+              if: inputs.sign != ''
+              working-directory: apps/desktop
+              run: |
+                  pnpm run build:universal --publish never -m ${TARGETS}
+              env:
+                  APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+                  APPLE_ID: ${{ secrets.APPLE_ID }}
+                  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
+                  CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
+                  VARIANT_PATH: variant.json
+                  # Only set for Nightly builds
+                  VERSION: ${{ inputs.version }}
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Check app was signed & notarised successfully
+              if: inputs.sign != ''
+              working-directory: apps/desktop
+              run: |
+                  hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
+                  codesign -dv --verbose=4 /Volumes/Element/*.app
+                  spctl -a -vvv -t install /Volumes/Element/*.app
+                  hdiutil detach /Volumes/Element
+
+            - name: "[Unsigned] Build App"
+              if: inputs.sign == ''
+              working-directory: apps/desktop
+              run: |
+                  pnpm run build:universal --publish never -m ${TARGETS}
+              env:
+                  CSC_IDENTITY_AUTO_DISCOVERY: false
+                  VARIANT_PATH: variant.json
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Generate releases.json
+              if: inputs.base-url
+              working-directory: apps/desktop
+              run: |
+                  PKG_JSON_VERSION=$(cat package.json | jq -r .version)
+                  LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
+                  # Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
+                  URL="${BASE_URL}/update/macos/${LATEST// /%20}"
+
+                  jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
+                    {
+                      currentRelease: $version,
+                      releases: [{
+                        version: $version,
+                        updateTo: {
+                          version: $version,
+                          url: $url,
+                        },
+                      }],
+                    }
+                  ' > dist/releases.json
+                  jq -n --arg url "$URL" '
+                    { url: $url }
+                  ' > dist/releases-legacy.json
+              env:
+                  VERSION: ${{ inputs.version }}
+                  BASE_URL: ${{ inputs.base-url }}
+
+            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: ${{ inputs.artifact-prefix }}macos
+                  path: |
+                      apps/desktop/dist
+                      !apps/desktop/dist/mac-universal/**
+                  retention-days: 1
+
+            - name: Assert zip is present
+              if: contains(inputs.targets, 'zip')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/Element*-mac.zip
+
+            - name: Assert dmg is present
+              if: contains(inputs.targets, 'dmg')
+              working-directory: apps/desktop
+              run: |
+                  test -f ./dist/Element*.dmg
+
+    test:
+        name: Test macOS Universal
+        needs: build
+        if: inputs.test && contains(inputs.targets, 'dmg')
+        uses: ./.github/workflows/build_desktop_test.yaml
+        with:
+            project: macos
+            artifact: ${{ inputs.artifact-prefix }}macos
+            runs-on: macos-14
+            executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
+            # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
+            # read-only and thus would not allow us to override the fuses as is required for Playwright.
+            prepare_cmd: |
+                hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
+                rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
+                hdiutil detach /Volumes/Element
+            blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}
@@ -0,0 +1,197 @@
+# This action helps perform common actions before the build_* actions are started in parallel.
+on:
+    workflow_call:
+        inputs:
+            config:
+                type: string
+                required: true
+                description: "The config directory to use"
+            version:
+                type: string
+                required: false
+                description: "The version tag to fetch, or 'develop', will pick automatically if not passed"
+            nightly:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build is a Nightly and to calculate the version strings new builds should use"
+            deploy:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build should be deployed to production"
+            webapp-artifact:
+                type: string
+                required: false
+                description: "Name of the webapp artifact that should be used, will fetch a relevant build if omitted"
+        secrets:
+            # Required if `nightly` is set
+            CF_R2_ACCESS_KEY_ID:
+                required: false
+            # Required if `nightly` is set
+            CF_R2_TOKEN:
+                required: false
+        outputs:
+            nightly-version:
+                description: "The version string the next Nightly should use, only output for nightly"
+                value: ${{ jobs.prepare.outputs.nightly-version }}
+            packages-dir:
+                description: "The directory non-deb packages for this run should live in within packages.element.io"
+                value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
+            # This is just a simple pass-through of the input to simplify reuse of complex inline conditions
+            deploy:
+                description: "Whether the build should be deployed to production"
+                value: ${{ inputs.deploy }}
+permissions: {}
+jobs:
+    prepare:
+        name: Prepare
+        environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: read
+        outputs:
+            nightly-version: ${{ steps.versions.outputs.nightly }}
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+                  repository: element-hq/element-web
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile --filter element-desktop"
+
+            - name: Fetch Element Web (from artifact)
+              if: inputs.webapp-artifact != ''
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.webapp-artifact }}
+                  path: apps/desktop/webapp
+
+            - name: Build webapp.asar (from artifact)
+              if: inputs.webapp-artifact != ''
+              working-directory: apps/desktop
+              run: |
+                  cp -f "$CONFIG_DIR/config.json" webapp/config.json
+                  pnpm run asar-webapp
+              env:
+                  CONFIG_DIR: ${{ inputs.config }}
+
+            - name: Fetch Element Web (${{ inputs.version }})
+              if: inputs.webapp-artifact == ''
+              working-directory: apps/desktop
+              run: pnpm run fetch --noverify -d ${CONFIG} ${VERSION}
+              env:
+                  CONFIG: ${{ inputs.config }}
+                  VERSION: ${{ inputs.version }}
+
+            - name: Copy variant config
+              working-directory: apps/desktop
+              run: cp "$CONFIG_DIR/build.json" variant.json
+              env:
+                  CONFIG_DIR: ${{ inputs.config }}
+
+            # We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
+            - name: Generate cache hash files
+              working-directory: apps/desktop
+              run: |
+                  set -ex
+                  # Add --no-sandbox as otherwise it fails because the helper isn't setuid root. It's only getting the version.
+                  pnpm --silent electron --no-sandbox --version > electronVersion
+                  cat package.json | jq -c .hakDependencies | sha1sum > hakHash
+                  find hak -type f -print0 | xargs -0 sha1sum >> hakHash
+                  find scripts/hak -type f -print0 | xargs -0 sha1sum >> hakHash
+
+            - name: "[Nightly] Calculate version"
+              id: versions
+              if: inputs.nightly
+              working-directory: apps/desktop
+              run: |
+                  set -e
+
+                  # Find all latest Nightly versions
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/macos/releases.json - --endpoint-url $R2_URL --region auto | jq -r .currentRelease >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-amd64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-arm64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/x64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/arm64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+
+                  # Pick the greatest one
+                  VERSION=$(cat VERSIONS | sort -uf | tail -n1)
+                  echo "Found latest nightly version $VERSION"
+                  # Increment it
+                  echo "nightly=$(scripts/generate-nightly-version.ts --latest $VERSION)" >> $GITHUB_OUTPUT
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+                  R2_BUCKET: ${{ vars.R2_BUCKET }}
+                  R2_URL: ${{ vars.CF_R2_S3_API }}
+
+            - name: Check version
+              id: package
+              working-directory: apps/desktop
+              run: |
+                  echo "version=$(cat package.json | jq -r .version)" >> $GITHUB_OUTPUT
+
+            - name: "[Release] Fetch release"
+              id: release
+              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
+              uses: cardinalby/git-get-release-action@5172c3a026600b1d459b117738c605fabc9e4e44 # 1.2.5
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+              with:
+                  tag: v${{ steps.package.outputs.version }}
+
+            - name: "[Release] Write changelog"
+              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
+              working-directory: apps/desktop
+              run: |
+                  TIME=$(date -d "$PUBLISHED_AT" -R)
+                  echo "element-desktop ($VERSION) default; urgency=medium" >> changelog.Debian
+                  echo "$BODY" | sed 's/^##/\n  */g;s/^\*/  */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g' >> changelog.Debian
+                  echo "" >> changelog.Debian
+                  echo " -- $ACTOR <support@element.io>  $TIME" >> changelog.Debian
+              env:
+                  ACTOR: ${{ github.actor }}
+                  VERSION: v${{ steps.package.outputs.version }}
+                  BODY: ${{ steps.release.outputs.body }}
+                  PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
+
+            - name: "[Nightly] Write summary"
+              if: inputs.nightly
+              working-directory: apps/desktop
+              run: |
+                  set -e
+
+                  BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
+                  WEBAPP_VERSION=$(./scripts/get-version.ts)
+                  WEB_VERSION=${WEBAPP_VERSION:0:12}
+                  JS_VERSION=${WEBAPP_VERSION:16:12}
+
+                  echo "### Nightly build ${NIGHTLY_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "" >> $GITHUB_STEP_SUMMARY
+                  echo "| Component   | Version |" >> $GITHUB_STEP_SUMMARY
+                  echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
+                  echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
+              env:
+                  NIGHTLY_VERSION: ${{ steps.versions.outputs.nightly }}
+
+            - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: desktop-prepare
+                  retention-days: 1
+                  path: |
+                      apps/desktop/webapp.asar
+                      apps/desktop/electronVersion
+                      apps/desktop/hakHash
+                      apps/desktop/changelog.Debian
+                      apps/desktop/variant.json
@@ -0,0 +1,118 @@
+# This action helps run Playwright tests within one of the build_* stages.
+on:
+    workflow_call:
+        inputs:
+            runs-on:
+                type: string
+                required: true
+                description: "The runner image to use"
+            artifact:
+                type: string
+                required: true
+                description: "The name of the artifact to download"
+            project:
+                type: string
+                required: true
+                description: "The Playwright project to use for testing"
+            executable:
+                type: string
+                required: true
+                description: "Path to the executable to test"
+            prepare_cmd:
+                type: string
+                required: false
+                description: "Command to run to prepare the executable or environment for testing"
+            blob_report:
+                type: boolean
+                default: false
+                description: "Whether to upload a blob report instead of the HTML report"
+            args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright, for e.g. skipping specific tests"
+permissions: {}
+jobs:
+    test:
+        name: Test ${{ inputs.project }}
+        runs-on: ${{ inputs.runs-on }}
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  persist-credentials: false
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              run: "pnpm install --frozen-lockfile --filter element-desktop"
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.artifact }}
+                  path: apps/desktop/dist
+
+            - name: Prepare for tests
+              working-directory: apps/desktop
+              # This is set by the caller of the reusable workflow, they have the ability to run the command they specify
+              # directly without our help so this is fine.
+              run: ${{ inputs.prepare_cmd }} # zizmor: ignore[template-injection]
+              if: inputs.prepare_cmd
+
+            - name: Expand executable path
+              id: executable
+              working-directory: apps/desktop
+              shell: bash
+              env:
+                  EXECUTABLE: ${{ inputs.executable }}
+              run: |
+                  FILES=($EXECUTABLE)
+                  echo "path=${FILES[0]}" >> $GITHUB_OUTPUT
+
+            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
+            # it to be enabled to test Electron apps, so turn it back on.
+            - name: Set EnableNodeCliInspectArguments fuse enabled
+              run: $RUN_AS npx @electron/fuses write --app "$EXECUTABLE" EnableNodeCliInspectArguments=on
+              working-directory: apps/desktop
+              shell: bash
+              env:
+                  # We need sudo on Linux as it is installed in /opt/
+                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
+                  EXECUTABLE: ${{ steps.executable.outputs.path }}
+
+            - name: Run tests
+              timeout-minutes: 20
+              shell: bash
+              working-directory: apps/desktop
+              run: |
+                  $PREFIX pnpm playwright test \
+                      ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} \
+                      ${{ inputs.blob_report == false && '--reporter=html' || '' }} \
+                      $ARGS
+              env:
+                  PREFIX: ${{ runner.os == 'Linux' && 'xvfb-run' || '' }}
+                  PW_TAG: ${{ inputs.project }}
+                  ELEMENT_DESKTOP_EXECUTABLE: ${{ steps.executable.outputs.path }}
+                  ARGS: ${{ inputs.args }}
+                  DEBUG: pw:browser
+
+            - name: Upload blob report
+              if: always() && inputs.blob_report
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: blob-report-${{ inputs.artifact }}
+                  path: apps/desktop/blob-report
+                  retention-days: 1
+                  if-no-files-found: error
+
+            - name: Upload HTML report
+              if: always() && inputs.blob_report == false
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: ${{ inputs.artifact }}-test
+                  path: apps/desktop/playwright-report
+                  retention-days: 14
+                  if-no-files-found: error
@@ -0,0 +1,314 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+
+# Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
+# We always sign using eSignerCKA to ensure it keeps working, but aside from release & nightlies we use demo credentials
+# which do not yield trusted signatures.
+defaults:
+    run:
+        shell: powershell
+on:
+    workflow_call:
+        secrets:
+            ESIGNER_USER_NAME:
+                required: false
+            ESIGNER_USER_PASSWORD:
+                required: false
+            ESIGNER_USER_TOTP:
+                required: false
+        inputs:
+            ref:
+                type: string
+                required: false
+                description: "The git ref to checkout, defaults to the default branch"
+            arch:
+                type: string
+                required: true
+                description: "The architecture to build for, one of 'x64' | 'ia32' | 'arm64'"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sign:
+                type: string
+                required: false
+                description: "Whether to sign & notarise the build, requires 'Desktop eSigner' environment"
+            blob_report:
+                type: boolean
+                required: false
+                description: "Whether to run the blob report"
+            prepare-artifact-name:
+                type: string
+                required: false
+                description: |
+                    The name of the prepare artifact to use, defaults to 'desktop-prepare'.
+                    The artifact must contain the following:
+                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
+                    + electronVersion - the version of electron to use for cache keying
+                    + hakHash - the hash of the .hak directory to use for cache keying
+                    + variant.json - the variant configuration to use for the build
+
+
+                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
+                    for example icons in the `build/` directory to override the app icons.
+                default: "desktop-prepare"
+            test:
+                type: boolean
+                required: false
+                default: true
+                description: "Whether to run the test stage after building"
+            test-runs-on:
+                type: string
+                required: false
+                description: "The runner image to use for testing, normally set for you, may be needed for running in private repos."
+            test-args:
+                type: string
+                required: false
+                description: "Additional arguments to pass to playwright"
+            artifact-prefix:
+                type: string
+                required: false
+                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
+                default: ""
+            targets:
+                type: string
+                required: false
+                description: "List of targets to build"
+                default: "squirrel msi"
+permissions: {} # No permissions required
+jobs:
+    build:
+        name: Build Windows ${{ inputs.arch }}
+        runs-on: windows-2025
+        environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
+        env:
+            SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
+        steps:
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
+              id: config
+              with:
+                  key: "${{ inputs.arch }}"
+                  export_to: output
+                  map: |
+                      {
+                        "x64": {
+                          "target": "x86_64-pc-windows-msvc"
+                        },
+                        "arm64": {
+                          "target": "aarch64-pc-windows-msvc",
+                          "build-args": "--arm64",
+                          "arch": "amd64_arm64"
+                        },
+                        "ia32": {
+                          "target": "i686-pc-windows-msvc",
+                          "build-args": "--ia32",
+                          "arch": "x86",
+                          "extra_config": "{\"user_notice\": {\"title\": \"Your desktop environment is unsupported.\",\"description\": \"Support for 32-bit Windows installations has ended. Transition to the web or mobile app for continued access.\"}}"
+                        }
+                      }
+
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  repository: element-hq/element-web
+                  ref: ${{ inputs.ref }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+              with:
+                  name: ${{ inputs.prepare-artifact-name }}
+                  path: apps/desktop/
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+              with:
+                  key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion') }}
+                  path: |
+                      apps/desktop/.hak
+
+            # ActiveTCL package on choco is from 2015,
+            # this one is newer but includes more than we need
+            - name: Choco install tclsh
+              if: steps.cache.outputs.cache-hit != 'true'
+              shell: pwsh
+              run: |
+                  choco install -y magicsplat-tcl-tk --no-progress
+                  echo "${HOME}/AppData/Local/Apps/Tcl86/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+            - name: Choco install NetWide Assembler
+              if: steps.cache.outputs.cache-hit != 'true'
+              shell: pwsh
+              run: |
+                  choco install -y nasm --no-progress
+                  echo "C:/Program Files/NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+            - name: Install Rust
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  rustup toolchain install stable --profile minimal --no-self-update
+                  rustup default stable
+                  rustup target add $env:TARGET
+              env:
+                  TARGET: ${{ steps.config.outputs.target }}
+
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              with:
+                  node-version-file: apps/desktop/.node-version
+                  cache: "pnpm"
+
+            - name: Install Deps
+              working-directory: apps/desktop
+              run: "pnpm install --frozen-lockfile --filter element-desktop"
+
+            - name: Insert config snippet
+              if: steps.config.outputs.extra_config != ''
+              working-directory: apps/desktop
+              shell: bash
+              run: |
+                  mkdir config-edit
+                  pnpm asar extract webapp.asar config-edit
+                  cd config-edit
+                  mv config.json old-config.json
+                  echo '${{ steps.config.outputs.extra_config }}' | jq -s '.[0] * .[1]' old-config.json - > config.json
+                  rm old-config.json
+                  cd ..
+                  rm webapp.asar
+                  pnpm asar pack config-edit/ webapp.asar
+
+            - name: Set up sqlcipher macros
+              if: steps.cache.outputs.cache-hit != 'true' && contains(inputs.arch, 'arm')
+              shell: pwsh
+              run: |
+                  echo "NCC=${{ github.workspace }}\scripts\cl.bat" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+            - name: Set up build tools
+              if: steps.cache.outputs.cache-hit != 'true'
+              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+              with:
+                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              working-directory: apps/desktop
+              run: |
+                  refreshenv
+                  pnpm run build:native --target $env:TARGET
+              env:
+                  TARGET: ${{ steps.config.outputs.target }}
+
+            - name: Install and configure eSigner CKA
+              run: |
+                  Set-StrictMode -Version 'Latest'
+
+                  # Download, extract, and rename
+                  Invoke-WebRequest -OutFile eSigner_CKA.zip "$env:ESIGNER_URL"
+                  Expand-Archive -Path eSigner_CKA.zip -DestinationPath .
+                  Get-ChildItem -Path * -Include "*_build_*.exe" | Rename-Item -NewName eSigner_CKA.exe
+
+                  # Install
+                  New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
+                  ./eSigner_CKA.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="${{ env.INSTALL_DIR }}" | Out-Null
+
+                  # Disable logger
+                  $LogConfig = Get-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
+                  $LogConfig[0] = '<log4net threshold="OFF">'
+                  $LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
+
+                  # Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
+                      -mode "$env:ESIGNER_MODE" `
+                      -user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
+                      -pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
+                      -totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
+                      -key "${{ env.MASTER_KEY_FILE }}" -r
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe load
+
+                  # Find certificate
+                  $CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
+                  echo Certificate: $CodeSigningCert
+
+                  # Extract thumbprint and subject name
+                  $Thumbprint = $CodeSigningCert.Thumbprint
+                  $SubjectName = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
+
+                  echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
+                  echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
+              env:
+                  ESIGNER_MODE: ${{ vars.ESIGNER_MODE || 'sandbox' }}
+                  ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
+                  INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
+                  MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
+
+            - name: Build App
+              working-directory: apps/desktop
+              run: pnpm run build --publish never $BUILD_ARGS -w $TARGETS
+              shell: bash
+              env:
+                  VARIANT_PATH: variant.json
+                  # Only set for Nightly builds
+                  # The windows packager relies on parsing this as semver, so we have to make it look like one.
+                  # This will give our update packages really stupid names, but we probably can't change that either
+                  # because squirrel windows parses them for the version too. We don't really care: nobody sees them.
+                  # We just give the installer a static name, so you'll just see this in the 'about' dialog.
+                  # Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
+                  VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
+                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
+                  TARGETS: ${{ inputs.targets }}
+
+            - name: Trust eSigner sandbox cert
+              if: inputs.sign == ''
+              run: |
+                  Set-StrictMode -Version 'Latest'
+                  Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root -FilePath .github/SSLcom-sandbox.crt
+
+            - name: Check app was signed successfully
+              working-directory: apps/desktop
+              run: |
+                  Set-StrictMode -Version 'Latest'
+                  Get-ChildItem `
+                      -Recurse dist `
+                      -Include *.exe, *.msi `
+                  | ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
+
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
+                  path: |
+                      apps/desktop/dist
+                  retention-days: 1
+
+            - name: Assert executable is present
+              working-directory: apps/desktop
+              run: |
+                  Test-Path './dist/win-*unpacked/Element*.exe'
+
+            - name: Assert all Squirrel files are present
+              if: contains(inputs.targets, 'squirrel')
+              working-directory: apps/desktop
+              run: |
+                  Test-Path './dist/squirrel-windows*/Element Setup*.exe'
+                  Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
+                  Test-Path './dist/squirrel-windows*/RELEASES'
+
+            - name: Assert MSI is present
+              if: contains(inputs.targets, 'msi')
+              working-directory: apps/desktop
+              run: |
+                  Test-Path './dist/Element*.msi'
+
+    test:
+        name: Test Windows ${{ inputs.arch }}
+        needs: build
+        if: inputs.test
+        uses: ./.github/workflows/build_desktop_test.yaml
+        with:
+            project: win-${{ inputs.arch }}
+            artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
+            runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
+            executable: ./dist/win*-unpacked/Element*.exe
+            blob_report: ${{ inputs.blob_report }}
+            args: ${{ inputs.test-args }}
@@ -29,9 +29,11 @@ jobs:
            R2_PUBLIC_URL: "https://element-web-develop.element.io"
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -58,7 +60,7 @@ jobs:
            - run: mv dist/element-*.tar.gz dist/develop.tar.gz
              working-directory: apps/web

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: webapp
                  path: apps/web/dist/develop.tar.gz
@@ -109,7 +111,7 @@ jobs:
                  running-workflow-name: "Build & Deploy develop.element.io"
                  repo-token: ${{ secrets.GITHUB_TOKEN }}
                  wait-interval: 10
-                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages|Upload).)*$
+                  check-regexp: ^((?!SonarCloud|SonarQube|issue|board|label|Release|prepare|GitHub Pages|Upload|Netlify|Report).)*$

            # We keep the latest develop.tar.gz on R2 instead of relying on the github artifact uploaded earlier
            # as the expires after 24h and requires auth to download.
@@ -134,4 +136,6 @@ jobs:
                  gitHubToken: ${{ secrets.GITHUB_TOKEN }}

            - run: |
-                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
+                  echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
+              env:
+                  STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
@@ -1,12 +1,19 @@
 name: CD # Continuous Delivery
 on:
    push:
-        branches: [develop]
+        branches: [master, staging, develop]
+        paths:
+            - "**/Dockerfile"
+            - "**/dockerbuild"
+            - "**/docker"
+            - "**/docker-*"
+            - "pnpm-lock.yaml"
+
 concurrency: ${{ github.workflow }}-${{ github.ref_name }}

 permissions: {}
 env:
-    NX_DEFAULT_OUTPUT_STYLE: static
+    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

 jobs:
    docker:
@@ -19,31 +26,22 @@ jobs:
            contents: read
            actions: read
        steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
-                  fetch-depth: 0
-                  # reduce the size of the checkout with tree filtering,
-                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
-                  filter: tree:0
-
-            - name: Prepare nx
-              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
-              with:
-                  main-branch-name: develop
+                  persist-credentials: false

            - name: Install Cosign
-              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

            - name: Set up Docker Buildx
              id: builder
-              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"
@@ -52,13 +50,14 @@ jobs:
              run: "pnpm install --frozen-lockfile"

            - name: Login to GitHub Container Registry
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
              with:
                  registry: ghcr.io
                  username: ${{ github.repository_owner }}
                  password: ${{ secrets.GITHUB_TOKEN }}

-            - run: pnpm nx affected -t docker:build
+            - run: pnpm nx run-many --nxBail -t docker:build
+              id: build
              env:
                  INPUT_PUSH: true
                  INPUT_LOAD: false
@@ -66,13 +65,11 @@ jobs:
                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}

            - name: Sign the images with GitHub OIDC token
-              env:
-                  PATTERN: "^ghcr.io/element-hq/element-web*"
              run: |
-                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
-                    # Check if digest is valid (not <none>)
-                    if [[ "$TARGET" != *"@<none>"* ]]; then
+                  shopt -s globstar
+
+                  for FILE in ./node_modules/.cache/nx-container/**/metadata; do
+                      TARGET=$(jq -r '(.["image.name"] | split(",") | last) + "@" + .["containerimage.digest"]' "$FILE")
                      echo "Signing $TARGET..."
                      cosign sign --yes "$TARGET"
-                    fi
                  done
@@ -35,6 +35,8 @@ jobs:
            SITE: ${{ inputs.site || 'staging.element.io' }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - name: Load GPG key
              run: |
@@ -23,22 +23,23 @@ jobs:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  fetch-depth: 0 # needed for docker-package to be able to calculate the version
+                  persist-credentials: false

            - name: Install Cosign
-              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
              if: github.event_name != 'pull_request'

            - name: Set up QEMU
-              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
              with:
                  install: true

            - name: Build and load
              id: test-build
-              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
              with:
                  context: .
                  file: apps/web/Dockerfile
@@ -82,7 +83,7 @@ jobs:

            - name: Docker meta
              id: meta
-              uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+              uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
              if: github.event_name != 'pull_request'
              with:
                  images: |
@@ -96,14 +97,14 @@ jobs:
                      latest=${{ contains(github.ref_name, '-rc.') && 'false' || 'auto' }}

            - name: Login to Docker Hub
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
              if: github.event_name != 'pull_request'
              with:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Login to GitHub Container Registry
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
              if: github.event_name != 'pull_request'
              with:
                  registry: ghcr.io
@@ -111,7 +112,7 @@ jobs:
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Connect to Tailscale
-              uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4
+              uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4
              if: github.event_name != 'pull_request'
              with:
                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
@@ -139,7 +140,7 @@ jobs:
                      services/web-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;

            - name: Login to oci.element.io Registry
-              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
              if: github.event_name != 'pull_request'
              with:
                  registry: oci-push.vpn.infra.element.io
@@ -148,7 +149,7 @@ jobs:

            - name: Build and push
              id: build-and-push
-              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
              if: github.event_name != 'pull_request'
              with:
                  context: .
@@ -16,84 +16,29 @@ jobs:
        name: GitHub Pages
        runs-on: ubuntu-24.04
        steps:
-            - name: Fetch element-desktop
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
-                  repository: element-hq/element-desktop
-                  path: element-desktop
+                  persist-credentials: false

-            - name: Fetch element-web
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
              with:
-                  path: element-web
-
-            - name: Fetch matrix-js-sdk
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              with:
-                  repository: matrix-org/matrix-js-sdk
-                  path: matrix-js-sdk
-
-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-              with:
-                  package_json_file: element-web/package.json
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+                  package_json_file: package.json
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
-                  cache-dependency-path: element-web/pnpm-lock.yaml
+                  cache-dependency-path: pnpm-lock.yaml
                  node-version: "lts/*"

-            - name: Generate automations docs
-              working-directory: element-web
-              run: |
-                  pnpm install --frozen-lockfile
-                  pnpm node ./scripts/gen-workflow-mermaid.ts ../element-desktop ../element-web ../matrix-js-sdk > docs/automations.md
-                  echo "-   [Automations](automations.md)" >> docs/SUMMARY.md
-
-            - name: Setup mdBook
-              uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2
-              with:
-                  mdbook-version: "0.5.1"
-
-            - name: Install mdbook extensions
-              run: cargo install mdbook-combiner mdbook-mermaid
-
-            - name: Prepare docs
-              run: |
-                  mkdir docs
-
-                  mv element-desktop/README.md element-desktop/docs/
-                  mv element-desktop/docs "docs/Element Desktop"
-
-                  mv element-web/README.md element-web/docs/
-                  mv element-web/docs/lib docs/
-                  mv element-web/docs "docs/Element Web"
-
-                  mv matrix-js-sdk/README.md matrix-js-sdk/docs/
-                  mv matrix-js-sdk/docs "docs/Matrix JS SDK"
-
-                  sed -i -e 's/\.\.\/README.md/README.md/' docs/**/SUMMARY.md
-
-                  mdbook-combiner -m docs
-                  sed -i -E 's/^\t# (.+)$/- [\1]()/gm;t' SUMMARY.md
-                  sed -i -E 's/^- \[(.+)]\(<>\)$/---\n# \1/gm;t' SUMMARY.md
-                  sed -i -E 's/\t- \[Introduction]/- [Introduction]/gm;t' SUMMARY.md
-
-                  cat <<EOF > docs/SUMMARY.md
-                  # Summary
-                  - [Introduction](<Element Web/README.md>)
-
-                  EOF
-                  cat SUMMARY.md >> docs/SUMMARY.md
-
-                  mv element-web/book.toml .
+            - name: Fetch layered build
+              run: ./scripts/layered.sh

            - name: Build docs
-              run: mdbook build
+              run: pnpm run docs:build

            - name: Upload artifact
-              uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+              uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
              with:
-                  path: ./book
+                  path: ./docs/.vitepress/dist

    deploy:
        environment:
@@ -107,4 +52,4 @@ jobs:
        steps:
            - name: Deploy to GitHub Pages
              id: deployment
-              uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+              uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
@@ -10,7 +10,7 @@ jobs:
        name: Tidy closed issues
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              id: main
              with:
                  # PAT needed as the GITHUB_TOKEN won't be able to see cross-references from other orgs (matrix-org)
@@ -142,7 +142,7 @@ jobs:
                          });
                        }
                      }
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              name: Close duplicate as Not Planned
              if: steps.main.outputs.closeAsNotPlanned
              with:
@@ -7,7 +7,7 @@ permissions:
    pull-requests: write # needed to auto-approve PRs
 jobs:
    download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        with:
            packageManager: pnpm
        secrets:
@@ -9,6 +9,6 @@ on:
 permissions: {} # No permissions needed
 jobs:
    upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        secrets:
            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
@@ -0,0 +1,29 @@
+# Tweaks the behaviour of Merge Queue to skip certain checks
+name: Merge Queue tweaks
+on:
+    merge_group:
+        types: [checks_requested]
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+    cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+    run:
+        runs-on: ubuntu-24.04
+        permissions:
+            statuses: write
+        steps:
+            # This is only needed as license/cla at time of writing seems to be extraordinarily flaky
+            # and Github doesn't support conditional checks between PR & merge queue.
+            # This is fine to do as a PR won't make it to merge queue until it has license/cla passing.
+            - name: Skip license/cla on merge queues
+              uses: guibranco/github-status-action-v2@9bfa8773cdbdc6c185747fd43cd7faa9d7c32f09
+              with:
+                  authToken: ${{ secrets.GITHUB_TOKEN }}
+                  state: success
+                  context: license/cla
+                  sha: ${{ github.sha }}
+                  target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -2,7 +2,9 @@
 # and uploading it to netlify
 name: Upload Preview Build to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Build"]
        types:
            - completed
@@ -28,7 +30,7 @@ jobs:
                      Exercise caution. Use test accounts.

            - name: 📥 Download artifact
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -1,6 +1,16 @@
-name: Publish shared component npm package
+name: Publish npm package
+run-name: Publish ${{ inputs.package }}
 on:
-    workflow_dispatch: {}
+    workflow_dispatch:
+        inputs:
+            package:
+                description: Which package to release
+                required: true
+                type: choice
+                options:
+                    - playwright-common
+                    - shared-components
+                    - module-api

 concurrency: release
 jobs:
@@ -14,10 +24,12 @@ jobs:
        steps:
            - name: 🧮 Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: 🔧 Set up node environment
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version-file: ".node-version"
@@ -27,10 +39,9 @@ jobs:
            - name: Update npm
              run: npm install -g npm@latest

-            # Need to setup element web too as it needs the translations
-            - name: 🛠️ Setup EW
+            - name: 🛠️ Install dependencies
              run: pnpm install --frozen-lockfile

            - name: 🚀 Publish to npm
-              working-directory: packages/shared-components
+              working-directory: packages/${{ inputs.package }}
              run: npm publish --access public --provenance
@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types: [opened, edited, labeled, unlabeled, synchronize]
    merge_group:
        types: [checks_requested]
 permissions: {}
 jobs:
    action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            pull-requests: write
        secrets:
@@ -8,7 +8,7 @@ jobs:
        name: Check PR base branch
        runs-on: ubuntu-24.04
        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              with:
                  script: |
                      const baseBranch = context.payload.pull_request.base.ref;
@@ -9,4 +9,4 @@ jobs:
    draft:
        permissions:
            contents: write
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
@@ -7,10 +7,11 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # We use ELEMENT_BOT_TOKEN instead
 jobs:
    merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
+            # This relates to the directory in which to reset dependencies, only web needs this
            dir: apps/web
            dependencies: |
                matrix-js-sdk
@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
    release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            contents: write
            issues: write
@@ -29,21 +29,9 @@ jobs:
            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
            asset-path: dist/*.tar.gz
            expected-asset-count: 3
-            dir: apps/web
-
-    notify-downstream:
-        name: Trigger release drafter downstream
-        needs: release
-        runs-on: ubuntu-24.04
-        steps:
-            - name: Notify element-desktop repo that element-web release has completed to re-trigger release-drafter
-              uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1
-              with:
-                  workflow: release-drafter.yml
-                  repo: element-hq/element-desktop
-                  ref: staging
-                  # Required when using the `repo` option. Either a PAT or a token generated from the GitHub app or CLI
-                  token: "${{ secrets.ELEMENT_BOT_TOKEN }}"
+            # Desktop has no dist script so we only target web here
+            dist-dir: apps/web
+            version-dirs: apps/web apps/desktop

    check:
        name: Post release checks
@@ -69,3 +57,12 @@ jobs:
                  wait-interval: 10
                  check-name: Build package
                  allowed-conclusions: success
+
+            - name: Wait for desktop packaging
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: master
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-regexp: Prepare|Linux|macOS|Windows|Deploy|deploy
+                  allowed-conclusions: success
@@ -2,11 +2,6 @@ name: Cut branches
 on:
    workflow_dispatch:
        inputs:
-            element-desktop:
-                description: Prepare element-desktop
-                required: true
-                type: boolean
-                default: true
            element-web:
                description: Prepare element-web
                required: true
@@ -26,8 +21,7 @@ jobs:
                repo:
                    - matrix-org/matrix-js-sdk
                    - element-hq/element-web
-                    - element-hq/element-desktop
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
        secrets:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
@@ -38,18 +32,8 @@ jobs:
        needs: checks
        env:
            # The order is specified bottom-up to avoid any races for allchange
-            REPOS: matrix-js-sdk element-web element-desktop
+            REPOS: matrix-js-sdk element-web
        steps:
-            - name: Checkout Element Desktop
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              if: inputs.element-desktop
-              with:
-                  repository: element-hq/element-desktop
-                  path: element-desktop
-                  ref: staging
-                  fetch-depth: 0
-                  fetch-tags: true
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
            - name: Checkout Element Web
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.element-web
@@ -60,6 +44,7 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
            - name: Checkout Matrix JS SDK
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              if: inputs.matrix-js-sdk
@@ -70,16 +55,13 @@ jobs:
                  fetch-depth: 0
                  fetch-tags: true
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true

            - name: Prepare Git
              run: |
                  git config --global user.email "releases@riot.im"
                  git config --global user.name "RiotRobot"

-            - name: Merge Element Desktop
-              if: inputs.element-desktop
-              run: |
-                  git -C "element-desktop" merge origin/develop
            - name: Merge Element Web
              if: inputs.element-web
              run: |
@@ -113,14 +95,3 @@ jobs:
                  wait-interval: 10
                  check-name: "draft / draft"
                  allowed-conclusions: success
-
-            - name: Wait for element-desktop draft
-              if: inputs.element-desktop
-              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
-              with:
-                  ref: staging
-                  repo: element-hq/element-desktop
-                  repo-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  wait-interval: 10
-                  check-name: "draft / draft"
-                  allowed-conclusions: success
@@ -13,10 +13,12 @@ jobs:
        steps:
            - name: 🧮 Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: 🔧 Pnpm cache
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version-file: package.json
@@ -29,7 +31,7 @@ jobs:
              working-directory: packages/shared-components
              run: pnpm build:storybook

-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: shared-components-storybook
                  path: packages/shared-components/storybook-static
@@ -20,13 +20,13 @@ jobs:
        needs: build
        environment: SharedComponents
        steps:
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: shared-components-storybook
                  path: storybook-static

            - name: 🚀 Deploy to Cloudflare Pages
-              uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
+              uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
              with:
                  apiToken: ${{ secrets.CF_PAGES_TOKEN }}
                  accountId: ${{ secrets.CF_PAGES_ACCOUNT_ID }}
@@ -2,7 +2,9 @@
 # It uploads the received images and diffs to netlify, printing the URLs to the console
 name: Upload Shared Component Visual Test Diffs
 on:
-    workflow_run:
+    # Privilege escalation necessary to deploy to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Shared Component Visual Tests"]
        types:
            - completed
@@ -23,11 +25,8 @@ jobs:
            actions: read
            deployments: write
        steps:
-            - name: Install tree
-              run: "sudo apt-get install -y tree"
-
            - name: Download Diffs
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  run-id: ${{ github.event.workflow_run.id }}
@@ -26,8 +26,8 @@ jobs:
                  persist-credentials: false
                  repository: element-hq/element-web

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -36,36 +36,25 @@ jobs:
              working-directory: packages/shared-components
              run: pnpm install --frozen-lockfile

-            - name: Get installed Playwright version
-              working-directory: packages/shared-components
-              id: playwright
-              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
-
-            - name: Cache playwright binaries
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-              id: playwright-cache
+            - name: Setup playwright
+              uses: ./.github/actions/setup-playwright
              with:
-                  path: ~/.cache/ms-playwright
-                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}-onlyshell
-
-            - name: Install Playwright browsers
-              working-directory: packages/shared-components
-              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: "pnpm playwright install --with-deps --only-shell"
+                  write-cache: ${{ github.event_name != 'merge_group' }}

            - name: Run Visual tests
              working-directory: packages/shared-components
              run: "pnpm test:storybook --run"

-            # Workaround for vis silently adding new baselines if they didn't exist
-            # Can be removed once https://github.com/repobuddy/visual-testing/issues/516 is released
-            - run: |
-                  git add -N .
-                  git diff --exit-code
+            - name: Detect stale screenshots
+              run: |
+                  if diff -rq __baselines__ __results__ | grep "^Only in __baselines__"; then
+                      exit 1
+                  fi
+              working-directory: packages/shared-components/__vis__/linux

            - name: Upload received images & diffs
              if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: received-images
                  path: packages/shared-components/__vis__/linux
@@ -1,6 +1,8 @@
 name: SonarQube
 on:
-    workflow_run:
+    # Privilege escalation necessary to call upon SonarCloud
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
        workflows: ["Tests"]
        types:
            - completed
@@ -12,7 +14,7 @@ jobs:
    sonarqube:
        name: 🩻 SonarQube
        if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
-        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            actions: read
            statuses: write
@@ -22,3 +24,4 @@ jobs:
            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
        with:
            sharded: true
+            version-pkg-json-dir: ./apps/web
@@ -5,8 +5,6 @@ on:
        branches: [develop, master]
    merge_group:
        types: [checks_requested]
-    repository_dispatch:
-        types: [element-web-notify]
 concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
    cancel-in-progress: true
@@ -45,13 +43,18 @@ jobs:
                    - name: Rethemendex Check
                      command: "rethemendex"
                      assert-diff: true
+                    - name: Docs
+                      install: layered
+                      command: "docs:build"
        name: ${{ matrix.name }}
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              if: matrix.install != ''
              with:
                  cache: "pnpm"
@@ -73,6 +76,19 @@ jobs:
              run: git diff --exit-code
              if: matrix.assert-diff

+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+
    i18n:
        strategy:
            fail-fast: false
@@ -87,15 +103,17 @@ jobs:
                          voip|element_call
                          error|invalid_json
                          error|misconfigured
-                          welcome_to_element
+                          welcome|title_element
                          devtools|settings|elementCallUrl
                          labs|sliding_sync_description
                          settings|voip|noise_suppression_description
                          settings|voip|echo_cancellation_description
+                    - name: Element Desktop
+                      path: "apps/desktop"
                    - name: Shared Components
                      path: "packages/shared-components"
        name: "i18n Check (${{ matrix.name }})"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        permissions:
            pull-requests: read
        with:
@@ -107,7 +125,9 @@ jobs:
    # Dummy job to simplify branch protections
    ci:
        name: Static Analysis
-        needs: [lint, i18n]
+        needs: [lint, i18n, zizmor]
+        if: always()
        runs-on: ubuntu-24.04
        steps:
-            - run: echo "Ok"
+            - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+              run: exit 1
@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead

 jobs:
    sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@7f2f93fb9b52ece7a0998f60e64862aa203c1746
        with:
            LABELS: |
                element-hq/element-meta
@@ -5,8 +5,6 @@ on:
        types: [checks_requested]
    push:
        branches: [develop, master]
-    repository_dispatch:
-        types: [element-web-notify]
    workflow_call:
        inputs:
            disable_coverage:
@@ -43,10 +41,11 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: pnpm cache
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version: "lts/*"
                  cache: "pnpm"
@@ -57,7 +56,7 @@ jobs:
                  JS_SDK_GITHUB_BASE_REF: ${{ inputs.matrix-js-sdk-sha }}

            - name: Jest Cache
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
              with:
                  path: /tmp/jest_cache
                  key: ${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -70,25 +69,29 @@ jobs:
              working-directory: apps/web
              run: |
                  pnpm test \
-                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                      --coverage=$ENABLE_COVERAGE \
                      --ci \
-                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
-                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --max-workers $MAX_WORKERS \
+                      --shard "$SHARD" \
                      --cacheDirectory /tmp/jest_cache
              env:
                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true

                  # tell jest to use coloured output
                  FORCE_COLOR: true
+                  MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}

            - name: Move coverage files into place
              if: env.ENABLE_COVERAGE == 'true'
              working-directory: apps/web
-              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+              run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
+              env:
+                  NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: coverage-${{ matrix.runner }}
                  path: |
@@ -97,7 +100,7 @@ jobs:

    complete:
        name: jest-tests
-        needs: [jest_ew, vitest_sc]
+        needs: [jest_ew, vitest]
        if: always()
        runs-on: ubuntu-24.04
        permissions:
@@ -117,60 +120,59 @@ jobs:
                  sha: ${{ github.sha }}
                  target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

-    vitest_sc:
-        name: Vitest (Shared Components)
+    vitest:
+        name: Vitest
+        strategy:
+            matrix:
+                package:
+                    - shared-components
+                    - module-api
        runs-on: ubuntu-24.04
        steps:
            - name: Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - name: pnpm cache
-              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version: "lts/*"
                  cache: "pnpm"

-            - name: Install Shared Component Deps
-              working-directory: "packages/shared-components"
+            - name: Install Deps
              run: "pnpm install"

            - name: Cache storybook & vitest
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
              with:
                  path: |
-                      packages/shared-components/node_modules/.cache
-                      packages/shared-components/node_modules/.vite/vitest
+                      packages/${{ matrix.package }}/node_modules/.cache
+                      packages/${{ matrix.package }}/node_modules/.vite/vitest
                  key: ${{ hashFiles('pnpm-lock.yaml') }}

-            - name: Get installed Playwright version
-              working-directory: packages/shared-components
-              id: playwright
-              run: echo "version=$(pnpm list @playwright/test --depth=0 --json | jq -r '.[].devDependencies["@playwright/test"].version')" >> $GITHUB_OUTPUT
-
-            - name: Cache playwright binaries
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-              id: playwright-cache
+            - name: Setup playwright
+              uses: ./.github/actions/setup-playwright
+              if: matrix.package == 'shared-components'
              with:
-                  path: ~/.cache/ms-playwright
-                  key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright.outputs.version }}-onlyshell
-
-            - name: Install Playwright browsers
-              working-directory: packages/shared-components
-              if: steps.playwright-cache.outputs.cache-hit != 'true'
-              run: "pnpm playwright install --with-deps --only-shell"
+                  write-cache: ${{ github.event_name != 'merge_group' }}

            - name: Run tests
-              working-directory: "packages/shared-components"
-              run: pnpm test:unit --coverage=${{ env.ENABLE_COVERAGE }}
+              working-directory: "packages/${{ matrix.package }}"
+              run: pnpm test:unit --coverage=$ENABLE_COVERAGE
+
+            # Dump the disk usage on failure, because this job seems to fail with disk fills sometimes
+            - name: df
+              run: df
+              if: ${{ failure() }}

            - name: Upload Artifact
              if: env.ENABLE_COVERAGE == 'true'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
-                  name: coverage-sharedcomponents
+                  name: coverage-${{ matrix.package }}
                  path: |
-                      packages/shared-components/coverage
-                      !packages/shared-components/coverage/lcov-report
+                      packages/${{ matrix.package }}/coverage
+                      !packages/${{ matrix.package }}/coverage/lcov-report
@@ -27,7 +27,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor') ||
            contains(github.event.issue.labels.*.name, 'A-Element-Call')
        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              with:
                  script: |
                      github.rest.issues.addLabels({
@@ -44,7 +44,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'good first issue') ||
            contains(github.event.issue.labels.*.name, 'Hacktoberfest')
        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              with:
                  script: |
                      github.rest.issues.addLabels({
@@ -43,7 +43,7 @@ jobs:
            contains(github.event.issue.labels.*.name, 'A-Element-Call')) &&
            contains(github.event.issue.labels.*.name, 'Z-Labs')
        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              with:
                  script: |
                      github.rest.issues.removeLabel({
@@ -10,9 +10,11 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

-            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
@@ -25,7 +27,7 @@ jobs:
              run: "pnpm vendor:jitsi"

            - name: Create Pull Request
-              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
+              uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  branch: actions/jitsi-update
@@ -22,7 +22,7 @@ jobs:
        runs-on: ubuntu-24.04
        environment: Matrix
        steps:
-            - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+            - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
              env:
                  HS_URL: ${{ secrets.BETABOT_HS_URL }}
                  LOBBY_ROOM_ID: ${{ secrets.ROOM_ID }}
@@ -16,7 +16,6 @@ package-lock.json
 .env
 .env.*
 coverage
-/book
 /index.html
 # version file and tarball created by `npm pack` / `yarn pack`
 /git-revision.txt
@@ -28,6 +27,7 @@ storybook-static
 /packages/shared-components/node_modules
 /packages/shared-components/dist
 /packages/shared-components/src/i18nKeys.d.ts
+/packages/shared-components/.vitest-attachments

 # TSC incremental compilation information
 *.tsbuildinfo
@@ -38,3 +38,7 @@ storybook-static
 .nx/workspace-data

 .pnpm-store
+
+# vitepress
+/docs/.vitepress/dist
+/docs/.vitepress/cache
@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname "$0")/_/husky.sh"
-
 npx lint-staged --concurrent false
@@ -1,3 +1,3 @@
 {
-    "*": "prettier --write"
+    "*": "prettier --write --ignore-unknown"
 }
@@ -14,11 +14,12 @@ webpack-stats.json
 .vscode/
 .env
 coverage
-# Auto-generated file
+# Auto-generated files
+*.api.md
 /apps/web/src/modules.ts
 /apps/web/src/modules.js
 src/i18n/strings
-/apps/web//build_config.yaml
+/apps/web/build_config.yaml
 # Raises an error because it contains a template var breaking the script tag
 /apps/web/src/vector/index.html
 /apps/web/src/vector/modernizr.cjs
@@ -29,7 +30,7 @@ debian/tmp
 package-lock.json

 # This file is owned, parsed, and generated by allchange, which doesn't comply with prettier
-/CHANGELOG.md
+CHANGELOG.md
 /docs/changelogs

 # Legacy skinning file that some people might still have
@@ -45,6 +46,16 @@ package-lock.json
 /apps/web/playwright/logs/
 /apps/web/playwright/snapshots/

+/apps/desktop/.hak/
+/apps/desktop/dist/
+/apps/desktop/build/
+/apps/desktop/dockerbuild/
+/apps/desktop/deploys/
+/apps/desktop/lib/
+/apps/desktop/webapp
+/apps/desktop/playwright/html-report
+/apps/desktop/playwright/test-results
+
 # Shared components generated files
 /packages/shared-components/dist/
 /packages/shared-components/src/i18n/i18nKeys.d.ts
@@ -1,3 +1,91 @@
+Changes in [1.12.15](https://github.com/element-hq/element-web/releases/tag/v1.12.15) (2026-04-08)
+==================================================================================================
+Fixes Desktop release workflow.
+
+This release is identical to v1.12.14 otherwise.
+
+Changes in [1.12.14](https://github.com/element-hq/element-web/releases/tag/v1.12.14) (2026-04-07)
+==================================================================================================
+## ✨ Features
+
+* Add analytics tracking for URL previews ([#32659](https://github.com/element-hq/element-web/pull/32659)). Contributed by @Half-Shot.
+* Collapsible Room List - Clicking on separator should expand to last set width ([#32909](https://github.com/element-hq/element-web/pull/32909)). Contributed by @MidhunSureshR.
+* RoomList: improve performance ([#32919](https://github.com/element-hq/element-web/pull/32919)). Contributed by @florianduros.
+* Implement collapsible panels for the new room list ([#32742](https://github.com/element-hq/element-web/pull/32742)). Contributed by @MidhunSureshR.
+* Hide the names of banned users behind a spoiler tag (attempt 2) ([#32636](https://github.com/element-hq/element-web/pull/32636)). Contributed by @andybalaam.
+
+## 🐛 Bug Fixes
+
+* Use the code signing Subject Name as basis for Tray GUID on Windows ([#32939](https://github.com/element-hq/element-web/pull/32939)). Contributed by @t3chguy.
+* Ensure the incoming verification request appears above the please verify prompt ([#32931](https://github.com/element-hq/element-web/pull/32931)). Contributed by @andybalaam.
+* Collapsible Room List - Prevent any interaction with the separator when the panel is expanded ([#32910](https://github.com/element-hq/element-web/pull/32910)). Contributed by @MidhunSureshR.
+* Fix icon size of badges in right panel ([#32952](https://github.com/element-hq/element-web/pull/32952)). Contributed by @florianduros.
+* Fix room list often showing the wrong icons for calls ([#32881](https://github.com/element-hq/element-web/pull/32881)). Contributed by @robintown.
+* Fix emoticon slash commands including stale buffers ([#32928](https://github.com/element-hq/element-web/pull/32928)). Contributed by @t3chguy.
+* Fix presence indicators not showing without cache   ([#32880](https://github.com/element-hq/element-web/pull/32880)). Contributed by @DLCSharp.
+* Show space name instead of 'Empty room' after creation ([#32886](https://github.com/element-hq/element-web/pull/32886)). Contributed by @gugaribeiro05.
+* Strip ephemeral query params from OIDC redirect URI ([#32875](https://github.com/element-hq/element-web/pull/32875)). Contributed by @azmeuk.
+
+
+Changes in [1.12.13](https://github.com/element-hq/element-web/releases/tag/v1.12.13) (2026-03-24)
+==================================================================================================
+## 🦖 Deprecations
+
+* Remove automatic rageshakes on UTD labs feature ([#32778](https://github.com/element-hq/element-web/pull/32778)). Contributed by @Half-Shot.
+* Remove automaticErrorReporting labs feature ([#32781](https://github.com/element-hq/element-web/pull/32781)). Contributed by @Half-Shot.
+
+## ✨ Features
+
+* Upgrade Element Call for new picture-in-picture designs ([#32816](https://github.com/element-hq/element-web/pull/32816)). Contributed by @robintown.
+* Room list: add sections to shared components ([#32735](https://github.com/element-hq/element-web/pull/32735)). Contributed by @florianduros.
+* feat: Devtool for sticky events MSC4354 ([#32741](https://github.com/element-hq/element-web/pull/32741)). Contributed by @BillCarsonFr.
+* Port URL Preview components to MVVM ([#32525](https://github.com/element-hq/element-web/pull/32525)). Contributed by @Half-Shot.
+* Add support for Widget \& Room Header Buttons module APIs ([#32734](https://github.com/element-hq/element-web/pull/32734)). Contributed by @dbkr.
+* Port over linkifyJS to shared-components. ([#32731](https://github.com/element-hq/element-web/pull/32731)). Contributed by @Half-Shot.
+* Redesign widget pip and move into shared component ([#32654](https://github.com/element-hq/element-web/pull/32654)). Contributed by @toger5.
+* Implement customisations \& login component Module API 1.11.0 ([#32687](https://github.com/element-hq/element-web/pull/32687)). Contributed by @t3chguy.
+* Realign MessageActionBar to Figma designs ([#32722](https://github.com/element-hq/element-web/pull/32722)). Contributed by @t3chguy.
+* Implement new widget permissions module api ([#32565](https://github.com/element-hq/element-web/pull/32565)). Contributed by @langleyd.
+
+## 🐛 Bug Fixes
+
+* [Backport staging] Fix soft crash of room list when trying to open a room ([#32872](https://github.com/element-hq/element-web/pull/32872)). Contributed by @RiotRobot.
+* Fix "key storage out of sync" appearing when key storage is actually fine ([#32811](https://github.com/element-hq/element-web/pull/32811)). Contributed by @andybalaam.
+* Fix remove button styling in local address list of room settings ([#32798](https://github.com/element-hq/element-web/pull/32798)). Contributed by @florianduros.
+* Always check \& update the users timezone on their profile on startup ([#32764](https://github.com/element-hq/element-web/pull/32764)). Contributed by @Half-Shot.
+* Fix nx configuration to actually run type linter ([#32776](https://github.com/element-hq/element-web/pull/32776)). Contributed by @richvdh.
+* Fix expand space panel button not being shown on keyboard focus ([#32746](https://github.com/element-hq/element-web/pull/32746)). Contributed by @t3chguy.
+* Reset key storage if restoring from Recovery encounters the wrong decryption key ([#32668](https://github.com/element-hq/element-web/pull/32668)). Contributed by @andybalaam.
+
+
+Changes in [1.12.12](https://github.com/element-hq/element-web/releases/tag/v1.12.12) (2026-03-10)
+==================================================================================================
+## ✨ Features
+
+* Add stable support for MSC4380 invite blocking ([#31966](https://github.com/element-hq/element-web/pull/31966)). Contributed by @richvdh.
+* Hide the names of banned users behind a spoiler tag ([#32424](https://github.com/element-hq/element-web/pull/32424)). Contributed by @andybalaam.
+* Room list: remove bold effect on selected room ([#32593](https://github.com/element-hq/element-web/pull/32593)). Contributed by @florianduros.
+* Use Compound buttons in auth screens ([#32562](https://github.com/element-hq/element-web/pull/32562)). Contributed by @t3chguy.
+* Track room list sorting algorithm changes ([#32556](https://github.com/element-hq/element-web/pull/32556)). Contributed by @MidhunSureshR.
+* Update `sso_redirect_options` to work for Native OIDC ([#32537](https://github.com/element-hq/element-web/pull/32537)). Contributed by @t3chguy.
+
+## 🐛 Bug Fixes
+
+* Room list: avoid excessive re-renders on room list store update or filter change ([#32663](https://github.com/element-hq/element-web/pull/32663)). Contributed by @florianduros.
+* Room list: listen to call event to check number of participants ([#32677](https://github.com/element-hq/element-web/pull/32677)). Contributed by @florianduros.
+* Fix invite-specific join errors not being shown ([#32621](https://github.com/element-hq/element-web/pull/32621)). Contributed by @Half-Shot.
+* Prevent logging lots of "Browser unsupported" lines ([#32647](https://github.com/element-hq/element-web/pull/32647)). Contributed by @Half-Shot.
+* Update critical gradient for room status bar ([#32575](https://github.com/element-hq/element-web/pull/32575)). Contributed by @Half-Shot.
+* Room list: avoid header overflowing when too long ([#32645](https://github.com/element-hq/element-web/pull/32645)). Contributed by @florianduros.
+* Room list: center focus outline of room list item ([#32637](https://github.com/element-hq/element-web/pull/32637)). Contributed by @florianduros.
+* Fix misaligned cross in complete security dialog ([#32614](https://github.com/element-hq/element-web/pull/32614)). Contributed by @dbkr.
+* Room list: fix keyboard navigation ([#32585](https://github.com/element-hq/element-web/pull/32585)). Contributed by @florianduros.
+* Don't show empty privacy section ([#32582](https://github.com/element-hq/element-web/pull/32582)). Contributed by @dbkr.
+* Disable room list image dragging ([#32590](https://github.com/element-hq/element-web/pull/32590)). Contributed by @florianduros.
+* Update UserMenu theme toggle to use IconButton ([#32591](https://github.com/element-hq/element-web/pull/32591)). Contributed by @t3chguy.
+* Room list: make room list item scales with large font size ([#32523](https://github.com/element-hq/element-web/pull/32523)). Contributed by @florianduros.
+
+
 Changes in [1.12.11](https://github.com/element-hq/element-web/releases/tag/v1.12.11) (2026-02-24)
 ==================================================================================================
 ## 🦖 Deprecations
@@ -46,6 +46,24 @@ As for your PR description, it should include these things:
 - Add comments to the diff for the reviewer that might help them to understand
  why the change is necessary or how they might better understand and review it.

+Please **_do not use force push_** in your PRs. Doing so means we can't see what
+has changed. We use squash merge to get a "clean" git history.
+
+### Adding a new feature or enhancement
+
+To make a great product with a great user experience, all the small efforts need to go in the same direction and be aligned and consistent with each other.
+
+Before making your contribution, please consider the following:
+
+- One product can’t do everything well. Element is focusing on private end-to-end encrypted messaging and voice - this can either be for consumers (e.g. friends and family) or for professional teams and organizations. Public forums and other types of chats without E2EE remain supported but are not the primary use case in case UX compromises need to be made.
+- There are 3 platforms - Web/Desktop, [Android](https://github.com/element-hq/element-x-android) and [iOS](https://github.com/element-hq/element-x-ios). These platforms need to have feature parity and design consistency. For some features, supporting all platforms is a must have, in some cases exceptions can be made to have it on one platform only.
+- To make sure your idea fits both from a design/solution and use case perspective, please open a new issue (or find an existing issue) in [element-meta](https://github.com/element-hq/element-meta/issues) repository describing the use case and how you plan to tackle it. Do not just describe what feature is missing, explain why the users need it with a couple of real life examples from the field.
+    - In case of an existing issue, please comment that you're planning to contribute. If you create a new issue, please specify that in the issue. In such a case we will try to review the issue ASAP and provide you with initial feedback so you can be confident if and at which conditions your contributions will be accepted.
+
+Once we know that you want to contribute and have confirmed that the new feature is overall aligned with the product direction, the designers of the core team will help you with the designs and any other type of guidance when it comes to the user experience. We will try to unblock you as quickly as we can, but it may not be instant. Having a clear understanding of the use case and the impact of the feature will help us with the prioritization and faster responses.
+
+Only once all of the above is met should you open a PR with your proposed changes.
+
 ### Changelogs

 There's no need to manually add Changelog entries: we use information in the
@@ -68,25 +86,6 @@ the default for PRs labelled with `T-Task`):

 _Remove outdated comment from `Ungulates.ts`_

-```
-Notes: none
-```
-
-Sometimes, you're fixing a bug in a downstream project, in which case you want
-an entry in that project's changelog. You can do that too:
-
-_Fix another herding bug_
-
-```
-Notes: Fix a bug where the `herd()` function would only work on Tuesdays
-element-web notes: Fix a bug where the 'Herd' button only worked on Tuesdays
-```
-
-This example is for Element Web. You can specify:
-
- element-web
- element-desktop
-
 If your PR introduces a breaking change, use the `Notes` section in the same
 way, additionally adding the `X-Breaking-Change` label (see below). There's no need
 to specify in the notes that it's a breaking change - this will be added
@@ -72,7 +72,7 @@ Element can also be run as a desktop app, wrapped in Electron. You can download
 pre-built version from <https://element.io/get-started> or, if you prefer,
 build it yourself.

-To build it yourself, follow the instructions at <https://github.com/element-hq/element-desktop>.
+To build it yourself, follow the instructions at <https://github.com/element-hq/element-web/tree/develop/apps/desktop>.

 Many thanks to @aviraldg for the initial work on the Electron integration.

@@ -0,0 +1,90 @@
+module.exports = {
+    plugins: ["matrix-org", "n"],
+    extends: ["plugin:matrix-org/javascript"],
+    parserOptions: {
+        ecmaVersion: 2021,
+        project: ["tsconfig.json"],
+    },
+    env: {
+        es6: true,
+        node: true,
+        // we also have some browser code (ie. the preload script)
+        browser: true,
+    },
+    // NOTE: These rules are frozen and new rules should not be added here.
+    // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
+    rules: {
+        "quotes": "off",
+        "indent": "off",
+        "prefer-promise-reject-errors": "off",
+        "no-async-promise-executor": "off",
+
+        "n/file-extension-in-import": ["error", "always"],
+        "unicorn/prefer-node-protocol": ["error"],
+    },
+    overrides: [
+        {
+            files: ["src/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+        {
+            files: ["hak/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            parserOptions: {
+                project: ["hak/tsconfig.json"],
+            },
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+                "n/file-extension-in-import": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+        {
+            files: ["scripts/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            parserOptions: {
+                project: ["scripts/tsconfig.json"],
+            },
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+                "n/file-extension-in-import": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+        {
+            files: ["playwright/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            parserOptions: {
+                project: ["playwright/tsconfig.json"],
+            },
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};
@@ -0,0 +1,22 @@
+/dist
+/lib
+/webapp
+/webapp.asar
+/packages
+/deploys
+node_modules/
+/pkg/control
+/.hak
+/.yarnrc
+/docker
+/.npmrc
+.vscode
+.vscode/
+/test_artifacts/
+/coverage/
+yarn-error.log
+/hak/**/*.js
+/scripts/hak/**/*.js
+.DS_Store
+/playwright-report
+.pnpm-store
@@ -0,0 +1,4 @@
+{
+    "*": "prettier --write --ignore-unknown",
+    "*.(ts|tsx)": ["eslint --fix"]
+}
@@ -0,0 +1 @@
+24.15.0
@@ -0,0 +1 @@
+module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");
@@ -0,0 +1,173 @@
+![Build](https://github.com/vector-im/element-desktop/actions/workflows/build_desktop_and_deploy.yaml/badge.svg)
+![Static Analysis](https://github.com/vector-im/element-desktop/actions/workflows/static_analysis.yaml/badge.svg)
+[![Localazy](https://img.shields.io/endpoint?url=https%3A%2F%2Fconnect.localazy.com%2Fstatus%2Felement-web%2Fdata%3Fcontent%3Dall%26title%3Dlocalazy%26logo%3Dtrue)](https://localazy.com/p/element-web)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+[![Bugs](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=bugs)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+
+# Element Desktop
+
+Element Desktop is a Matrix client for desktop platforms with Element Web at its core.
+
+# First Steps
+
+Before you do anything else, fetch the dependencies:
+
+```
+pnpm install
+```
+
+# Fetching Element
+
+Since this package is just the Electron wrapper for Element Web, it doesn't contain any of the Element Web code,
+so the first step is to get a working copy of Element Web. There are a few ways of doing this:
+
+```
+# Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
+# fetched will be the same as the local element-desktop package.
+# We're explicitly asking for no config, so the packaged Element will have no config.json.
+pnpm run fetch --noverify --cfgdir ""
+```
+
+...or if you'd like to use GPG to verify the downloaded package:
+
+```
+# Fetch the Element public key from the element.io web server over a secure connection and import
+# it into your local GPG keychain (you'll need GPG installed). You only need to to do this
+# once.
+pnpm run fetch --importkey
+# Fetch the package and verify the signature
+pnpm run fetch --cfgdir ""
+```
+
+...or either of the above, but fetching a specific version of Element:
+
+```
+# Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
+# fetched will be the same as the local element-desktop package.
+pnpm run fetch --noverify --cfgdir "" v1.5.6
+```
+
+If you only want to run the app locally and don't need to build packages, you can
+provide the `webapp` directory directly:
+
+```
+ln -s ../web/webapp ./
+```
+
+[TODO: add support for fetching develop builds, arbitrary URLs and arbitrary paths]
+
+# Building
+
+## Native Build
+
+TODO: List native pre-requisites
+
+Optionally, [build the native modules](https://github.com/vector-im/element-desktop/blob/develop/docs/native-node-modules.md),
+which include support for searching in encrypted rooms and secure storage. Skipping this step is fine, you just won't have those features.
+
+Then, run
+
+```
+pnpm run build
+```
+
+This will do a couple of things:
+
+- Run the `setversion` script to set the local package version to match whatever
+  version of Element you installed above.
+- Run electron-builder to build a package. The package built will match the operating system
+  you're running the build process on.
+
+## Docker
+
+Alternatively, you can also build using docker, which will always produce the linux package:
+
+```
+# Run this once to make the docker image
+pnpm run docker:setup
+
+pnpm run docker:install
+# if you want to build the native modules (this will take a while)
+pnpm run docker:build:native
+pnpm run docker:build
+```
+
+After running, the packages should be in `dist/`.
+
+# Starting
+
+If you'd just like to run the electron app locally for development:
+
+```
+pnpm start
+```
+
+# Config
+
+If you'd like the packaged Element to have a configuration file, you can create a
+config directory and place `config.json` in there, then specify this directory
+with the `--cfgdir` option to `pnpm run fetch`, eg:
+
+```
+mkdir myconfig
+cp /path/to/my/config.json myconfig/
+pnpm run fetch --cfgdir myconfig
+```
+
+The config dir for the official Element app is in `element.io`. If you use this,
+your app will auto-update itself using builds from element.io.
+
+# Profiles
+
+To run multiple instances of the desktop app for different accounts, you can
+launch the executable with the `--profile` argument followed by a unique
+identifier, e.g `element-desktop --profile Work` for it to run a separate profile and
+not interfere with the default one.
+
+Alternatively, a custom location for the profile data can be specified using the
+`--profile-dir` flag followed by the desired path.
+
+# User-specified config.json
+
+- `%APPDATA%\$NAME\config.json` on Windows
+- `$XDG_CONFIG_HOME/$NAME/config.json` or `~/.config/$NAME/config.json` on Linux
+- `~/Library/Application Support/$NAME/config.json` on macOS
+
+In the paths above, `$NAME` is typically `Element`, unless you use `--profile
+$PROFILE` in which case it becomes `Element-$PROFILE`, or it is using one of
+the above created by a pre-1.7 install, in which case it will be `Riot` or
+`Riot-$PROFILE`.
+
+You may also specify a different path entirely for the `config.json` file by
+providing the `--config $YOUR_CONFIG_JSON_FILE` to the process, or via the
+`ELEMENT_DESKTOP_CONFIG_JSON` environment variable.
+
+# Translations
+
+To add a new translation, head to the [translating doc](https://github.com/vector-im/element-web/blob/develop/docs/translating.md).
+
+For a developer guide, see the [translating dev doc](https://github.com/vector-im/element-web/blob/develop/docs/translating-dev.md).
+
+# Report bugs & give feedback
+
+If you run into any bugs or have feedback you'd like to share, please let us know on GitHub.
+
+To help avoid duplicate issues, please [view existing issues](https://github.com/vector-im/element-web/issues?q=is%3Aopen+is%3Aissue+sort%3Areactions-%2B1-desc) first (and add a +1) or [create a new issue](https://github.com/vector-im/element-web/issues/new/choose) if you can't find it. Please note that this issue tracker is associated with the [element-web](https://github.com/vector-im/element-web) repo, but is also applied to the code in this repo as well.
+
+## Copyright & License
+
+Copyright (c) 2016-2017 OpenMarket Ltd
+
+Copyright (c) 2017 Vector Creations Ltd
+
+Copyright (c) 2017-2025 New Vector Ltd
+
+This software is multi licensed by New Vector Ltd (Element). It can be used either:
+
+(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
+
+(2) for free under the terms of the GNU General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
+
+(3) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
+Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
@@ -0,0 +1,3 @@
+module.exports = {
+    presets: [["@babel/preset-env", { targets: { node: "current" } }], "@babel/preset-typescript"],
+};
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Entitlements from electron-builder's defaults
+         (https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/templates/entitlements.mac.plist)
+         nb. This does *not* include the app sandbox: at the time of adding this file,
+         we were using electron-builder 21.2.0 which does not have the sandbox entitlement.
+         Latest electron-builder does, but it appears to be causing issues:
+         (https://github.com/electron-userland/electron-builder/issues/4390)
+    -->
+
+    <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+
+    <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+
+    <!-- Our own additional entitlements (we need to access the camera and
+        mic for VoIP calls -->
+    <key>com.apple.security.device.camera</key>
+    <true/>
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+</dict>
+</plist>
@@ -0,0 +1,27 @@
+{
+    "fill": "automatic",
+    "groups": [
+        {
+            "layers": [
+                {
+                    "glass": false,
+                    "image-name": "element.png",
+                    "name": "element"
+                }
+            ],
+            "name": "Figma",
+            "shadow": {
+                "kind": "none",
+                "opacity": 0.5
+            },
+            "specular": false,
+            "translucency": {
+                "enabled": false,
+                "value": 0.5
+            }
+        }
+    ],
+    "supported-platforms": {
+        "squares": ["macOS"]
+    }
+}
@@ -0,0 +1,25 @@
+# Docker image to facilitate building Element Desktop's native bits using a glibc version (2.31)
+# with broader compatibility, down to Debian bullseye & Ubuntu focal.
+
+FROM rust:bullseye@sha256:949b0903defbfc4e374dc85f947b153859e9ee0104e425cd9a74d94474a9a335
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get -qq update && apt-get -y -qq dist-upgrade && \
+  apt-get -y -qq install --no-install-recommends \
+  # tclsh is required for building SQLite as part of SQLCipher
+  tcl \
+  # Used by seshat (when not SQLCIPHER_STATIC) \
+  libsqlcipher-dev && \
+  apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
+RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip
+
+ENV DEBUG_COLORS=true
+ENV FORCE_COLOR=true
+
+WORKDIR /project
+
+ARG TARGETOS
+ARG TARGETARCH
+COPY .node-version dockerbuild/setup.sh /
+RUN /setup.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -x
+declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
+ARCH="${archMap["$TARGETARCH"]}"
+# The .node-version file generally doesn't have the 'v' (renovate does not put the 'v' and will
+# strip it on upgrade if it's there) but the 'v' is also widely supported so we probably ought
+# to just work either way.
+NODE_VERSION=$(cat /.node-version | sed -e 's/^v//')
+curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md
+corepack enable
@@ -0,0 +1,234 @@
+import * as os from "node:os";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { type Configuration as BaseConfiguration } from "electron-builder";
+
+/**
+ * This script has different outputs depending on your os platform.
+ *
+ * On Windows:
+ *  Passes $ED_SIGNTOOL_THUMBPRINT and $ED_SIGNTOOL_SUBJECT_NAME to
+ *      build.win.signtoolOptions.signingHashAlgorithms and build.win.signtoolOptions.certificateSubjectName respectively if specified.
+ *
+ * On Linux:
+ *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
+ *  Removes libsqlcipher0 recommended dependency if env SQLCIPHER_BUNDLED is asserted.
+ *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
+ */
+
+/**
+ * Interface describing relevant fields of the package.json file.
+ */
+interface Pkg {
+    version: string;
+}
+
+/**
+ * Base metadata fields, used in both package.json and the variant configuration.
+ */
+interface Metadata {
+    name: string;
+    productName: string;
+    description: string;
+}
+
+/**
+ * Extra metadata fields that are injected into the build to pass to the app at runtime.
+ */
+interface ExtraMetadata extends Metadata {
+    electron_appId: string;
+    electron_protocol: string;
+    electron_windows_cert_sn?: string;
+}
+
+/**
+ * Interface describing the variant configuration format.
+ */
+interface Variant extends Metadata {
+    "appId": string;
+    "linux.executableName"?: string;
+    "linux.deb.name"?: string;
+    "protocols": string[];
+}
+
+type Writable<T> = NonNullable<
+    T extends Function ? T : T extends object ? { -readonly [K in keyof T]: Writable<T[K]> } : T
+>;
+
+// Load the default variant as a base configuration
+const DEFAULT_VARIANT = path.join("element.io", "release", "build.json");
+let variant: Variant = JSON.parse(fs.readFileSync(DEFAULT_VARIANT, "utf8"));
+
+/**
+ * If a variant is specified, we will use it to override the build-specific values.
+ * This allows us to have different builds for different purposes (e.g. stable, nightly).
+ */
+if (process.env.VARIANT_PATH) {
+    console.log(`Using variant configuration from '${process.env.VARIANT_PATH}':`);
+    variant = {
+        ...variant,
+        ...JSON.parse(fs.readFileSync(`${process.env.VARIANT_PATH}`, "utf8")),
+    };
+} else {
+    console.warn(`No VARIANT_PATH specified, using default variant configuration '${DEFAULT_VARIANT}':`);
+}
+
+for (const key in variant) {
+    console.log(`${key}: ${variant[key]}`);
+}
+
+interface Configuration extends BaseConfiguration {
+    extraMetadata: Partial<Pick<Pkg, "version">> & ExtraMetadata;
+    linux: BaseConfiguration["linux"];
+    win: BaseConfiguration["win"];
+    mac: BaseConfiguration["mac"];
+    deb: {
+        fpm: string[];
+    } & BaseConfiguration["deb"];
+}
+
+/**
+ * @type {import('electron-builder').Configuration}
+ * @see https://www.electron.build/configuration/configuration
+ */
+const config: Omit<Writable<Configuration>, "electronFuses"> & {
+    // Make all fuses required to ensure they are all explicitly specified
+    electronFuses: Required<Configuration["electronFuses"]>;
+} = {
+    appId: variant.appId,
+    asarUnpack: "**/*.node",
+    electronFuses: {
+        enableCookieEncryption: true,
+        onlyLoadAppFromAsar: true,
+        grantFileProtocolExtraPrivileges: false,
+
+        runAsNode: false,
+        enableNodeOptionsEnvironmentVariable: false,
+        enableNodeCliInspectArguments: false,
+        // We need to reset the signature if we are not signing on darwin otherwise it won't launch
+        resetAdHocDarwinSignature: !process.env.APPLE_TEAM_ID,
+
+        loadBrowserProcessSpecificV8Snapshot: false,
+        enableEmbeddedAsarIntegrityValidation: true,
+    },
+    files: [
+        "package.json",
+        {
+            from: ".hak/hakModules",
+            to: "node_modules",
+        },
+        "lib/**",
+    ],
+    extraResources: ["build/icon.*", "webapp.asar"],
+    extraMetadata: {
+        name: variant.name,
+        productName: variant.productName,
+        description: variant.description,
+        electron_appId: variant.appId,
+        electron_protocol: variant.protocols[0],
+    },
+    linux: {
+        target: ["tar.gz", "deb"],
+        category: "Network;InstantMessaging;Chat",
+        icon: "icon.png",
+        executableName: variant.name, // element-desktop or element-desktop-nightly
+    },
+    deb: {
+        packageCategory: "net",
+        depends: [
+            "libgtk-3-0",
+            "libnotify4",
+            "libnss3",
+            "libxss1",
+            "libxtst6",
+            "xdg-utils",
+            "libatspi2.0-0",
+            "libuuid1",
+            "libsecret-1-0",
+            "libasound2",
+            "libgbm1",
+        ],
+        recommends: ["libsqlcipher0", "element-io-archive-keyring"],
+        fpm: ["--deb-pre-depends", "libc6 (>= 2.31)"],
+    },
+    mac: {
+        target: ["dmg", "zip"],
+        category: "public.app-category.social-networking",
+        darkModeSupport: true,
+        hardenedRuntime: true,
+        gatekeeperAssess: true,
+        strictVerify: true,
+        entitlements: "./build/entitlements.mac.plist",
+        icon: "build/icon.icon",
+        mergeASARs: true,
+        x64ArchFiles: "**/matrix-seshat/*.node", // hak already runs lipo
+    },
+    dmg: {
+        badgeIcon: "build/icon.icon",
+    },
+    win: {
+        target: ["squirrel", "msi"],
+        signtoolOptions: {
+            signingHashAlgorithms: ["sha256"],
+        },
+        icon: "build/icon.ico",
+    },
+    msi: {
+        perMachine: true,
+    },
+    directories: {
+        output: "dist",
+    },
+    protocols: {
+        name: variant.productName,
+        schemes: variant.protocols,
+    },
+    nativeRebuilder: "sequential",
+    nodeGypRebuild: false,
+    npmRebuild: true,
+};
+
+/**
+ * Allow specifying the version via env var.
+ * If unspecified, it will default to the version in package.json.
+ * @param {string} process.env.VERSION
+ */
+if (process.env.VERSION) {
+    config.extraMetadata.version = process.env.VERSION;
+}
+
+if (variant["linux.deb.name"]) {
+    config.deb.fpm.push("--name", variant["linux.deb.name"]);
+}
+
+/**
+ * Allow specifying windows signing cert via env vars
+ * @param {string} process.env.ED_SIGNTOOL_SUBJECT_NAME
+ * @param {string} process.env.ED_SIGNTOOL_THUMBPRINT
+ */
+if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT) {
+    config.win.signtoolOptions!.certificateSubjectName = process.env.ED_SIGNTOOL_SUBJECT_NAME;
+    config.win.signtoolOptions!.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
+    config.extraMetadata.electron_windows_cert_sn = config.win.signtoolOptions!.certificateSubjectName;
+}
+
+if (os.platform() === "linux") {
+    // Electron crashes on debian if there's a space in the path.
+    // https://github.com/vector-im/element-web/issues/13171
+    config.extraMetadata.productName = config.extraMetadata.productName.replace(/ /g, "-");
+
+    /**
+     * Allow specifying deb changelog via env var
+     * @param {string} process.env.ED_DEB_CHANGELOG
+     */
+    if (process.env.ED_DEBIAN_CHANGELOG) {
+        config.deb.fpm.push(`--deb-changelog=${process.env.ED_DEBIAN_CHANGELOG}`);
+    }
+
+    if (process.env.SQLCIPHER_BUNDLED) {
+        // Remove sqlcipher dependency when using bundled
+        config.deb.recommends = config.deb.recommends?.filter((d) => d !== "libsqlcipher0");
+    }
+}
+
+export default config;
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF8DCCBNigAwIBAgIRAIZSd8hNVs3w8AhJIsQSoYYwDQYJKoZIhvcNAQELBQAw
+gZExCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
+BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTcwNQYD
+VQQDEy5DT01PRE8gUlNBIEV4dGVuZGVkIFZhbGlkYXRpb24gQ29kZSBTaWduaW5n
+IENBMB4XDTIwMDczMDAwMDAwMFoXDTIzMDczMDIzNTk1OVowgfMxETAPBgNVBAUT
+CDEwODczNjYxMRMwEQYLKwYBBAGCNzwCAQMTAkdCMR0wGwYDVQQPExRQcml2YXRl
+IE9yZ2FuaXphdGlvbjELMAkGA1UEBhMCR0IxDzANBgNVBBEMBlc0IDFRVTEYMBYG
+A1UECAwPTG9uZG9uLCBDaXR5IG9mMQ8wDQYDVQQHDAZMb25kb24xJzAlBgNVBAkM
+HjE0IFR1cm5oYW0gR3JlZW4sIFRlcnJhY2UgTWV3czEbMBkGA1UECgwSTmV3IFZl
+Y3RvciBMaW1pdGVkMRswGQYDVQQDDBJOZXcgVmVjdG9yIExpbWl0ZWQwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKDnGul2M7oCCN+3veGf7yfakSfMjK
+Kqeylyo0Nj8dUleNQvsRo0OHxIWJlbHDYglxebT109MqgyASr0SoeiqvXOSSFACD
+MYFoyerRGMnXEuomTU0y7+FE3p/hcim8+C5gS+rHr3YaJJuzzXRztjjCBGoY4was
+h9V8kYiyMMK0xi2WftOCBa1yYS32CInHIZVmdhzoK4k4YzSYIp57BWvnIUlDyCYk
+slNfp0SFbDrOGa7kbmy8HRfWPLjNmW5PPIrsf8LlnVRBfmTeUIJtV31w/FuMjeir
+pzYjzooXmpIrj96ecxdc9thP6etCUazvpowjfewu7UNWRUhGPtYn8v8rAgMBAAGj
+ggHdMIIB2TAfBgNVHSMEGDAWgBTfj/MgDOnKpgTYW1g3Kj2rRtyDSTAdBgNVHQ4E
+FgQUB9su4pCQXE5ZWFhB1eo48992LEcwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB
+/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEQYJYIZIAYb4QgEBBAQDAgQQMEkG
+A1UdIARCMEAwNQYMKwYBBAGyMQECAQYBMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8v
+c2VjdGlnby5jb20vQ1BTMAcGBWeBDAEDMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6
+Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUV4dGVuZGVkVmFsaWRhdGlvbkNv
+ZGVTaWduaW5nQ0EuY3JsMIGGBggrBgEFBQcBAQR6MHgwUAYIKwYBBQUHMAKGRGh0
+dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUV4dGVuZGVkVmFsaWRhdGlv
+bkNvZGVTaWduaW5nQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v
+ZG9jYS5jb20wJgYDVR0RBB8wHaAbBggrBgEFBQcIA6APMA0MC0dCLTEwODczNjYx
+MA0GCSqGSIb3DQEBCwUAA4IBAQBZ8/YtqW/+VUoV8knKpdhMR2uTn8AEyVmfmoZA
+Ly5kdCRoKvFm/z4VK4cqF7gsUDxRIgDuMKKbWTtr1FEXuaZkUkOjicNcdYxc0pDn
+nFKBWAv5pN5OmnC9cVqIG7PtvD+8bKVzDdQRjpGMy6PY4rN2PYGfQ7KGgddEDD6m
+oM51jI/OTvCeU0Tyl0bixKEmpUJvbeQM9Ul2Y1o5Enx1Q9uda8xATb0HCMKgJ+GC
+iFHL2DNC3j1xK4QoZEIYgbTscj9rK4OMEov3PT/e1FwQyB5V9xdJ5i1MDBDD9fAf
+OiVgf90SffT7TgWUbA4Z+PtQHq/qNma0+dZWyeq7zYn2IIX3
+-----END CERTIFICATE-----
@@ -0,0 +1,6 @@
+This directory contains the config file for the official element.io distribution
+of Element Desktop.
+
+You probably do not want to build with this config unless you're building the
+official element.io distribution, or you'll find your builds will replace
+themselves with the element.io build.
@@ -0,0 +1,9 @@
+{
+    "appId": "im.riot.nightly",
+    "name": "element-desktop-nightly",
+    "productName": "Element Nightly",
+    "description": "Element: the future of secure communication (nightly unstable build)",
+    "protocols": ["io.element.nightly", "element"],
+    "linux.executableName": "element-desktop-nightly",
+    "linux.deb.name": "element-nightly"
+}
@@ -0,0 +1,65 @@
+{
+    "update_base_url": "https://packages.element.io/nightly/update/",
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element Nightly",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "uisi_autorageshake_app": "element-auto-uisi",
+    "show_labs_settings": true,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "sentry": {
+        "dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6",
+        "environment": "nightly"
+    },
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "features": {
+        "threadsActivityCentre": true,
+        "feature_spotlight": true,
+        "feature_group_calls": true,
+        "feature_video_rooms": true,
+        "feature_element_call_video_rooms": true
+    },
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 100
+    },
+    "element_call": {
+        "url": "https://call.element.dev"
+    },
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+}
@@ -0,0 +1,7 @@
+{
+    "appId": "im.riot.app",
+    "name": "element-desktop",
+    "productName": "Element",
+    "description": "Element: the future of secure communication",
+    "protocols": ["io.element.desktop", "element"]
+}
@@ -0,0 +1,59 @@
+{
+    "update_base_url": "https://packages.element.io/desktop/update/",
+    "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+    ],
+    "bug_report_endpoint_url": "https://rageshakes.element.io/api/submit",
+    "uisi_autorageshake_app": "element-auto-uisi",
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im"]
+    },
+    "show_labs_settings": false,
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "terms_and_conditions_links": [
+        {
+            "url": "https://element.io/privacy",
+            "text": "Privacy Policy"
+        },
+        {
+            "url": "https://element.io/cookie-policy",
+            "text": "Cookie Policy"
+        }
+    ],
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 60
+    },
+    "features": {
+        "feature_video_rooms": true,
+        "feature_group_calls": true,
+        "feature_element_call_video_rooms": true
+    },
+    "element_call": {
+        "url": "https://call.element.io"
+    }
+}
@@ -0,0 +1,34 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import type HakEnv from "../../scripts/hak/hakEnv.ts";
+import type { DependencyInfo } from "../../scripts/hak/dep.ts";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const env = hakEnv.makeGypEnv();
+
+    if (!hakEnv.isHost()) {
+        env.CARGO_BUILD_TARGET = hakEnv.getTargetId();
+    }
+
+    console.log("Running yarn install");
+    await hakEnv.spawn("yarn", ["install"], {
+        cwd: moduleInfo.moduleBuildDir,
+        env,
+        shell: true,
+    });
+
+    const buildTarget = hakEnv.wantsStaticSqlCipher() ? "build-bundled" : "build";
+
+    console.log("Running yarn build");
+    await hakEnv.spawn("yarn", ["run", buildTarget], {
+        cwd: moduleInfo.moduleBuildDir,
+        env,
+        shell: true,
+    });
+}
@@ -0,0 +1,60 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020, 2021 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import childProcess from "node:child_process";
+import fsProm from "node:fs/promises";
+
+import type HakEnv from "../../scripts/hak/hakEnv.ts";
+import type { Tool } from "../../scripts/hak/hakEnv.ts";
+import type { DependencyInfo } from "../../scripts/hak/dep.ts";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const tools: Tool[] = [["rustc", "--version"]];
+    if (hakEnv.isWin()) {
+        tools.push(["perl", "--version"]); // for openssl configure
+        tools.push(["nasm", "-v"]); // for openssl building
+        tools.push(["patch", "--version"]); // to patch sqlcipher Makefile.msc
+        tools.push(["nmake", "/?"]);
+    } else {
+        tools.push(["make", "--version"]);
+    }
+    await hakEnv.checkTools(tools);
+
+    try {
+        // node-gyp uses python for reasons beyond comprehension
+        // Try python3 first, to get a more sensible error if python is not found in the fallback
+        await hakEnv.checkTools([["python3", "--version"]]);
+    } catch {
+        await hakEnv.checkTools([["python", "--version"]]);
+    }
+
+    // Ensure Rust target exists (nb. we avoid depending on rustup)
+    await new Promise((resolve, reject) => {
+        const rustc = childProcess.execFile(
+            "rustc",
+            ["--target", hakEnv.getTargetId(), "--emit=obj", "-o", "tmp", "-"],
+            (err, out) => {
+                if (err) {
+                    reject(
+                        "rustc can't build for target " +
+                            hakEnv.getTargetId() +
+                            ": ensure target is installed via `rustup target add " +
+                            hakEnv.getTargetId() +
+                            "` " +
+                            "or your package manager if not using `rustup`",
+                    );
+                }
+                fsProm.unlink("tmp").then(resolve);
+            },
+        );
+        rustc.stdin!.write("fn main() {}");
+        rustc.stdout!.pipe(process.stdout);
+        rustc.stderr!.pipe(process.stderr);
+        rustc.stdin!.end();
+    });
+}
@@ -0,0 +1,7 @@
+{
+    "scripts": {
+        "check": "check.ts",
+        "build": "build.ts"
+    },
+    "copy": "index.node"
+}
@@ -0,0 +1,14 @@
+{
+    "compilerOptions": {
+        "moduleResolution": "node16",
+        "module": "Node16",
+        "esModuleInterop": true,
+        "target": "es2022",
+        "sourceMap": false,
+        "strict": true,
+        "lib": ["es2022"],
+        "types": ["node"],
+        "allowImportingTsExtensions": true
+    },
+    "include": ["../scripts/@types/*.d.ts", "./**/*.ts"]
+}
@@ -0,0 +1,112 @@
+{
+    "name": "element-desktop",
+    "productName": "Element",
+    "main": "lib/electron-main.js",
+    "exports": "./lib/electron-main.js",
+    "version": "1.12.15",
+    "description": "Element: the future of secure communication",
+    "author": {
+        "name": "Element",
+        "email": "support@element.io"
+    },
+    "homepage": "https://element.io",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/vector-im/element-web"
+    },
+    "license": "SEE LICENSE IN README.md",
+    "type": "module",
+    "files": [],
+    "engines": {
+        "node": ">=22.18"
+    },
+    "scripts": {
+        "i18n": "matrix-gen-i18n && pnpm i18n:sort && pnpm i18n:lint",
+        "i18n:sort": "matrix-sort-i18n src/i18n/strings/en_EN.json",
+        "i18n:lint": "prettier --log-level=silent  --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && pnpm i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "mkdirs": "mkdirp packages deploys",
+        "fetch": "pnpm run mkdirs && node scripts/fetch-package.ts",
+        "asar-webapp": "asar p webapp webapp.asar",
+        "start": "nx start",
+        "lint": "pnpm lint:types && pnpm lint:js",
+        "lint:js": "eslint --max-warnings 0 src hak playwright scripts",
+        "lint:js-fix": "eslint --fix --max-warnings 0 src hak playwright scripts && prettier --log-level=warn --write .",
+        "lint:types": "pnpm lint:types:src && pnpm lint:types:test && pnpm lint:types:scripts && pnpm lint:types:hak",
+        "lint:types:src": "tsc --noEmit",
+        "lint:types:test": "tsc --noEmit -p playwright/tsconfig.json",
+        "lint:types:scripts": "tsc --noEmit -p scripts/tsconfig.json",
+        "lint:types:hak": "tsc --noEmit -p hak/tsconfig.json",
+        "build:native": "pnpm run hak",
+        "build:native:universal": "pnpm run hak --target x86_64-apple-darwin fetchandbuild && pnpm run hak --target aarch64-apple-darwin fetchandbuild && pnpm run hak --target x86_64-apple-darwin --target aarch64-apple-darwin copyandlink",
+        "build:32": "nx build --ia32",
+        "build:64": "nx build --x64",
+        "build:universal": "nx build --universal",
+        "build": "nx build --",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild -f dockerbuild/Dockerfile .",
+        "docker:build:native": "scripts/in-docker.sh pnpm run hak",
+        "docker:build": "scripts/in-docker.sh pnpm run build",
+        "docker:install": "scripts/in-docker.sh pnpm install",
+        "clean": "rimraf webapp.asar dist packages deploys lib",
+        "hak": "node scripts/hak/index.ts",
+        "test:playwright": "nx test:playwright --",
+        "test:playwright:open": "nx test:playwright -- --ui",
+        "test:playwright:screenshots": "nx test:playwright:screenshots --",
+        "sane-postinstall": "electron-builder install-app-deps"
+    },
+    "dependencies": {
+        "@sentry/electron": "^7.0.0",
+        "auto-launch": "^5.0.5",
+        "counterpart": "^0.18.6",
+        "electron-store": "^11.0.0",
+        "electron-window-state": "^5.0.3",
+        "minimist": "^1.2.6",
+        "png-to-ico": "^3.0.0",
+        "uuid": "^14.0.0"
+    },
+    "devDependencies": {
+        "@babel/core": "^7.18.10",
+        "@babel/preset-env": "^7.18.10",
+        "@babel/preset-typescript": "^7.18.6",
+        "@electron/asar": "4.2.0",
+        "@electron/fuses": "^2.1.1",
+        "@playwright/test": "catalog:",
+        "@stylistic/eslint-plugin": "^5.0.0",
+        "@types/auto-launch": "^5.0.1",
+        "@types/counterpart": "^0.18.1",
+        "@types/minimist": "^1.2.1",
+        "@types/node": "18.19.130",
+        "@types/pacote": "^11.1.1",
+        "@typescript-eslint/eslint-plugin": "^8.0.0",
+        "@typescript-eslint/parser": "^8.0.0",
+        "app-builder-lib": "26.9.0",
+        "chokidar": "^5.0.0",
+        "detect-libc": "^2.0.0",
+        "electron": "41.2.2",
+        "electron-builder": "26.9.0",
+        "electron-builder-squirrel-windows": "26.9.0",
+        "electron-devtools-installer": "^4.0.0",
+        "eslint": "^8.26.0",
+        "eslint-config-google": "^0.14.0",
+        "eslint-config-prettier": "^10.0.0",
+        "eslint-plugin-import": "^2.25.4",
+        "eslint-plugin-matrix-org": "^3.0.0",
+        "eslint-plugin-n": "^17.12.0",
+        "eslint-plugin-unicorn": "^56.0.0",
+        "glob": "^13.0.0",
+        "matrix-web-i18n": "catalog:",
+        "mkdirp": "^3.0.0",
+        "pacote": "^21.0.0",
+        "prettier": "^3.0.0",
+        "rimraf": "^6.0.0",
+        "tar": "^7.5.8",
+        "typescript": "6.0.3"
+    },
+    "hakDependencies": {
+        "matrix-seshat": "4.2.0"
+    },
+    "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
+    "nx": {
+        "includedScripts": []
+    }
+}
@@ -0,0 +1,27 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+    projects: [{ name: "Desktop" }],
+    tag: process.env.PW_TAG ? `@${process.env.PW_TAG}` : undefined,
+    use: {
+        viewport: { width: 1280, height: 720 },
+        video: "retain-on-failure",
+        trace: "on-first-retry",
+    },
+    testDir: "playwright/e2e",
+    outputDir: "playwright/test-results",
+    workers: 1,
+    retries: process.env.CI ? 2 : 0,
+    reporter: process.env.CI ? [["blob"], ["github"]] : [["html", { outputFolder: "playwright/html-report" }]],
+    snapshotDir: "playwright/snapshots",
+    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    timeout: 30 * 1000,
+});
@@ -0,0 +1,5 @@
+/test-results/
+/html-report/
+# Only commit snapshots from Linux
+/snapshots/**/*.png
+!/snapshots/**/*-linux.png
@@ -0,0 +1,19 @@
+FROM mcr.microsoft.com/playwright:v1.59.1-jammy@sha256:8a0360d39d1973be506dd59002904a774f6d697d4946c94063b3fd006461c8ff
+
+WORKDIR /work
+
+RUN apt-get update && \
+    apt-get -y install xvfb dbus-x11 && \
+    apt-get purge -y --auto-remove && \
+    rm -rf /var/lib/apt/lists/* && \
+    corepack enable
+
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+ENV GITHUB_ACTIONS=1
+ENV DEBUG=pw:browser
+
+# switch to node user
+USER 1000:1000
+
+COPY apps/desktop/playwright/docker-entrypoint.sh /opt/docker-entrypoint.sh
+ENTRYPOINT ["bash", "/opt/docker-entrypoint.sh"]
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+echo "Starting Xvfb"
+Xvfb :99 -ac &
+sleep 2
+
+export DISPLAY=:99
+
+PLAYWRIGHT_HTML_OPEN=never ELEMENT_DESKTOP_EXECUTABLE="./dist/linux-unpacked/element-desktop" \
+  exec pnpm -C apps/desktop exec playwright test --update-snapshots --reporter line,html "$1"
@@ -0,0 +1,44 @@
+/*
+Copyright 2024 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { test, expect } from "../../element-desktop-test.js";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+test.describe("App config options", () => {
+    test.describe("Should load custom config via env", () => {
+        test.slow();
+        test.use({
+            extraEnv: {
+                ELEMENT_DESKTOP_CONFIG_JSON: resolve(__dirname, "../..", "fixtures/custom-config.json"),
+            },
+        });
+        test("should launch and use configured homeserver", async ({ page }) => {
+            await page.locator("#matrixchat").waitFor();
+            await page.locator(".mx_Welcome").waitFor();
+            await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+            await page.getByText("Sign in").click();
+            await page.getByText("matrix.example.org", { exact: true }).waitFor();
+        });
+    });
+    test.describe("Should load custom config via argument", () => {
+        test.slow();
+        test.use({
+            extraArgs: ["--config", resolve(__dirname, "../..", "fixtures/custom-config.json")],
+        });
+        test("should launch and use configured homeserver", async ({ page }) => {
+            await page.locator("#matrixchat").waitFor();
+            await page.locator(".mx_Welcome").waitFor();
+            await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+            await page.getByText("Sign in").click();
+            await page.getByText("matrix.example.org", { exact: true }).waitFor();
+        });
+    });
+});
@@ -0,0 +1,75 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2022, 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { test, expect } from "../../element-desktop-test.js";
+
+declare global {
+    interface ElectronPlatform {
+        getEventIndexingManager():
+            | {
+                  supportsEventIndexing(): Promise<boolean>;
+              }
+            | undefined;
+        getPickleKey(userId: string, deviceId: string): Promise<string | null>;
+        createPickleKey(userId: string, deviceId: string): Promise<string | null>;
+    }
+
+    interface Window {
+        mxPlatformPeg: {
+            get(): ElectronPlatform;
+        };
+    }
+}
+
+test.describe("App launch", () => {
+    test.slow();
+
+    test.beforeEach(async ({ page }) => {
+        await page.locator("#matrixchat").waitFor();
+        await page.locator(".mx_Welcome").waitFor();
+    });
+
+    test("should launch and render the welcome view successfully", async ({ page }) => {
+        await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+        await expect(page).toHaveScreenshot();
+    });
+
+    test("should launch and render the welcome view successfully and support seshat", async ({ page }) => {
+        await expect(
+            page.evaluate<boolean>(async () => {
+                return window.mxPlatformPeg.get().getEventIndexingManager()?.supportsEventIndexing();
+            }),
+        ).resolves.toBeTruthy();
+    });
+
+    test.describe("safeStorage", () => {
+        const userId = "@user:server";
+        const deviceId = "ABCDEF";
+
+        test("should be supported", async ({ page }) => {
+            await expect(
+                page.evaluate(
+                    ([userId, deviceId]) => window.mxPlatformPeg.get().createPickleKey(userId, deviceId),
+                    [userId, deviceId],
+                ),
+            ).resolves.not.toBeNull();
+        });
+    });
+
+    test.describe("--no-update", () => {
+        test.use({
+            extraArgs: ["--no-update"],
+        });
+
+        // XXX: this test works fine locally but in CI the app start races with the test plumbing up the stdout/stderr pipes
+        // which means the logs are missed, disabling for now.
+        test.skip("should respect option", async ({ page, stdout }) => {
+            expect(stdout.data.toString()).toContain("Auto update disabled via command line flag");
+        });
+    });
+});
@@ -0,0 +1,36 @@
+/*
+Copyright 2025 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { test, expect } from "../../element-desktop-test.js";
+
+declare global {
+    interface ElectronPlatform {
+        getOidcCallbackUrl(): URL;
+    }
+
+    interface Window {
+        mxPlatformPeg: {
+            get(): ElectronPlatform;
+        };
+    }
+}
+
+test.describe("OIDC Native", () => {
+    test.slow();
+
+    test.beforeEach(async ({ page }) => {
+        await page.locator(".mx_Welcome").waitFor();
+    });
+
+    test("should use OIDC callback URL without authority component", async ({ page }) => {
+        await expect(
+            page.evaluate<string>(() => {
+                return window.mxPlatformPeg.get().getOidcCallbackUrl().toString();
+            }),
+        ).resolves.toMatch(/io\.element\.(desktop|nightly):\/vector\/webapp\//);
+    });
+});
@@ -0,0 +1,126 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { _electron as electron, test as base, expect as baseExpect, type ElectronApplication } from "@playwright/test";
+import fs from "node:fs/promises";
+import path, { dirname } from "node:path";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import { PassThrough } from "node:stream";
+
+/**
+ * A PassThrough stream that captures all data written to it.
+ */
+class CapturedPassThrough extends PassThrough {
+    private _chunks: any[] = [];
+
+    public constructor() {
+        super();
+        super.on("data", this.onData);
+    }
+
+    private onData = (chunk: any): void => {
+        this._chunks.push(chunk);
+    };
+
+    public get data(): Buffer {
+        return Buffer.concat(this._chunks);
+    }
+}
+
+interface Fixtures {
+    app: ElectronApplication;
+    tmpDir: string;
+    extraEnv: Record<string, string>;
+    extraArgs: string[];
+
+    // Utilities to capture stdout and stderr for tests to make assertions against
+    stdout: CapturedPassThrough;
+    stderr: CapturedPassThrough;
+}
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+export const test = base.extend<Fixtures>({
+    extraEnv: {},
+    extraArgs: [],
+
+    // eslint-disable-next-line no-empty-pattern
+    stdout: async ({}, use) => {
+        await use(new CapturedPassThrough());
+    },
+    // eslint-disable-next-line no-empty-pattern
+    stderr: async ({}, use) => {
+        await use(new CapturedPassThrough());
+    },
+
+    // eslint-disable-next-line no-empty-pattern
+    tmpDir: async ({}, use) => {
+        const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "element-desktop-tests-"));
+        await use(tmpDir);
+        await fs.rm(tmpDir, { recursive: true });
+    },
+    app: async ({ tmpDir, extraEnv, extraArgs, stdout, stderr }, use) => {
+        const args = ["--profile-dir", tmpDir, ...extraArgs];
+
+        if (process.env.GITHUB_ACTIONS) {
+            args.push("--disable-gpu");
+
+            if (process.platform === "linux") {
+                if (process.getuid() === 0) {
+                    args.push("--no-sandbox");
+                }
+
+                // GitHub Actions hosted runner lacks dbus and a compatible keyring, so we need to force plaintext storage
+                args.push("--storage-mode", "force-plaintext");
+            } else if (process.platform === "darwin") {
+                // GitHub Actions hosted runner has no working default keychain, so allow plaintext storage
+                args.push("--storage-mode", "allow-plaintext");
+            }
+        }
+
+        const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
+        if (!executablePath) {
+            // Unpackaged mode testing
+            args.unshift(path.join(__dirname, "..", "lib", "electron-main.js"));
+        }
+
+        console.log(`Launching '${executablePath || "electron"}' with args ${args.join(" ")}`);
+
+        const app = await electron.launch({
+            env: {
+                ...process.env,
+                ...extraEnv,
+            },
+            executablePath,
+            args,
+        });
+
+        app.process().stdout.pipe(stdout).pipe(process.stdout);
+        app.process().stderr.pipe(stderr).pipe(process.stderr);
+
+        await app.firstWindow();
+
+        // Block matrix.org access to ensure consistent tests
+        const context = app.context();
+        await context.route("https://matrix.org/**", async (route) => {
+            await route.abort();
+        });
+
+        await use(app);
+    },
+    page: async ({ app }, use) => {
+        const window = await app.firstWindow();
+        await use(window);
+        await app.close().catch((e) => {
+            console.error(e);
+        });
+    },
+});
+
+export const expect = baseExpect;
@@ -0,0 +1,10 @@
+{
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix.example.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://identity.example.org"
+        }
+    }
+}
@@ -0,0 +1,13 @@
+{
+    "compilerOptions": {
+        "resolveJsonModule": true,
+        "moduleResolution": "bundler",
+        "esModuleInterop": true,
+        "target": "es2022",
+        "module": "ESNext",
+        "lib": ["es2024", "dom", "dom.iterable"],
+        "strictNullChecks": false,
+        "types": ["node"]
+    },
+    "include": ["**/*.ts"]
+}
@@ -0,0 +1,83 @@
+{
+    "$schema": "../../node_modules/nx/schemas/project-schema.json",
+    "projectType": "application",
+    "implicitDependencies": ["element-web"],
+    "root": "apps/desktop",
+    "targets": {
+        "docker:build": {
+            "executor": "@nx-tools/nx-container:build",
+            "options": {
+                "load": true,
+                "engine": "docker",
+                "platforms": ["linux/amd64", "linux/arm64"],
+                "provenance": "true",
+                "sbom": true,
+                "context": "{projectRoot}",
+                "file": "{projectRoot}/dockerbuild/Dockerfile",
+                "metadata": {
+                    "images": ["ghcr.io/element-hq/element-web/desktop-build-env"],
+                    "tags": ["type=ref,event=branch"]
+                }
+            }
+        },
+        "build:ts": {
+            "cache": true,
+            "command": "tsc",
+            "inputs": ["src", "{projectRoot}/tsconfig.json"],
+            "outputs": ["{projectRoot}/lib/*.js", "{projectRoot}/lib/*.d.ts"],
+            "options": { "cwd": "apps/desktop" }
+        },
+        "build:res": {
+            "cache": true,
+            "command": "node scripts/copy-res.ts",
+            "inputs": ["{projectRoot}/i18n"],
+            "outputs": ["{projectRoot}/lib/i18n"],
+            "options": { "cwd": "apps/desktop" }
+        },
+        "build": {
+            "cache": true,
+            "command": "pnpm exec electron-builder",
+            "inputs": [
+                "src",
+                "{projectRoot}/.hak/hakModules",
+                "{projectRoot}/electron-builder.json",
+                "{projectRoot}/webapp.asar"
+            ],
+            "outputs": ["{projectRoot}/dist"],
+            "options": { "cwd": "apps/desktop" },
+            "dependsOn": ["build:*"]
+        },
+        "start": {
+            "command": "electron .",
+            "options": { "cwd": "apps/desktop" },
+            "dependsOn": ["build:*"]
+        },
+        "test:playwright": {
+            "command": "playwright test",
+            "options": { "cwd": "apps/desktop" }
+        },
+        "test:playwright:screenshots:build-app": {
+            "executor": "nx:run-commands",
+            "options": {
+                "commands": [
+                    "pnpm run build -l --x64 --dir --publish=never",
+                    "pnpm exec electron-fuses write --app ./dist/linux-unpacked/element-desktop EnableNodeCliInspectArguments=on"
+                ],
+                "parallel": false,
+                "cwd": "apps/desktop"
+            },
+            "dependsOn": ["build:*"]
+        },
+        "test:playwright:screenshots:build-docker": {
+            "cache": true,
+            "command": "docker build -f playwright/Dockerfile -t element-desktop-playwright --platform linux/amd64 ../..",
+            "inputs": ["{projectRoot}/playwright/Dockerfile", "{projectRoot}/playwright/docker-entrypoint.sh"],
+            "options": { "cwd": "apps/desktop" }
+        },
+        "test:playwright:screenshots": {
+            "command": "docker run --rm --network host -v $(pwd)/../../:/work/ --platform linux/amd64 -it element-desktop-playwright",
+            "options": { "cwd": "apps/desktop" },
+            "dependsOn": ["test:playwright:screenshots:*"]
+        }
+    }
+}
@@ -0,0 +1,7 @@
+REM Batch file to aid in cross-compiling sqlcipher for Windows ARM64
+REM Full path should be passed to Makefile.msc as NCC env var
+
+setlocal
+call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" %VSCMD_ARG_HOST_ARCH%
+cl.exe %*
+endlocal
@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+
+// copies resources into the lib directory.
+
+import parseArgs from "minimist";
+import * as chokidar from "chokidar";
+import * as path from "node:path";
+import * as fs from "node:fs";
+
+const argv = parseArgs(process.argv.slice(2), {});
+
+const watch = argv.w;
+const verbose = argv.v;
+
+function errCheck(err: unknown): void {
+    if (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}
+
+const I18N_BASE_PATH = "src/i18n/strings/";
+const INCLUDE_LANGS = fs.readdirSync(I18N_BASE_PATH).filter((fn) => fn.endsWith(".json"));
+
+// Ensure lib, lib/i18n and lib/i18n/strings all exist
+fs.mkdirSync("lib/i18n/strings", { recursive: true });
+
+type Translations = Record<string, Record<string, string> | string>;
+
+function genLangFile(file: string, dest: string): void {
+    const translations: Translations = {};
+    [file].forEach(function (f) {
+        if (fs.existsSync(f)) {
+            try {
+                Object.assign(translations, JSON.parse(fs.readFileSync(f).toString()));
+            } catch (e) {
+                console.error("Failed: " + f, e);
+                throw e;
+            }
+        }
+    });
+
+    const json = JSON.stringify(translations, null, 4);
+    const filename = path.basename(file);
+
+    fs.writeFileSync(dest + filename, json);
+    if (verbose) {
+        console.log("Generated language file: " + filename);
+    }
+}
+
+/*
+ watch the input files for a given language,
+ regenerate the file, and regenerating languages.json with the new filename
+ */
+function watchLanguage(file: string, dest: string): void {
+    // XXX: Use a debounce because for some reason if we read the language
+    // file immediately after the FS event is received, the file contents
+    // appears empty. Possibly https://github.com/nodejs/node/issues/6112
+    let makeLangDebouncer: NodeJS.Timeout | undefined;
+    const makeLang = (): void => {
+        if (makeLangDebouncer) {
+            clearTimeout(makeLangDebouncer);
+        }
+        makeLangDebouncer = setTimeout(() => {
+            genLangFile(file, dest);
+        }, 500);
+    };
+
+    chokidar.watch(file).on("add", makeLang).on("change", makeLang).on("error", errCheck);
+}
+
+// language resources
+const I18N_DEST = "lib/i18n/strings/";
+INCLUDE_LANGS.forEach((file): void => {
+    genLangFile(I18N_BASE_PATH + file, I18N_DEST);
+}, {});
+
+if (watch) {
+    INCLUDE_LANGS.forEach((file) => watchLanguage(I18N_BASE_PATH + file, I18N_DEST));
+}
@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+
+import * as path from "node:path";
+import { createWriteStream, promises as fs } from "node:fs";
+import * as childProcess from "node:child_process";
+import * as tar from "tar";
+import * as asar from "@electron/asar";
+import { promises as stream } from "node:stream";
+
+import riotDesktopPackageJson from "../package.json" with { type: "json" };
+import { setPackageVersion } from "./set-version.ts";
+
+const PUB_KEY_URL = "https://packages.riot.im/element-release-key.asc";
+const PACKAGE_URL_PREFIX = "https://github.com/element-hq/element-web/releases/download/";
+const DEVELOP_TGZ_URL = "https://develop.element.io/develop.tar.gz";
+const ASAR_PATH = "webapp.asar";
+
+async function downloadToFile(url: string, filename: string): Promise<void> {
+    console.log("Downloading " + url + "...");
+
+    try {
+        const resp = await fetch(url);
+        if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
+        if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
+        await stream.pipeline(resp.body, createWriteStream(filename));
+    } catch (e) {
+        console.error(e);
+        try {
+            await fs.unlink(filename);
+        } catch {}
+        throw e;
+    }
+}
+
+async function verifyFile(filename: string): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+        childProcess.execFile("gpg", ["--verify", filename + ".asc", filename], (error) => {
+            if (error) {
+                reject(error);
+            } else {
+                resolve();
+            }
+        });
+    });
+}
+
+async function main(): Promise<number | undefined> {
+    let verify = true;
+    let importkey = false;
+    let pkgDir = "packages";
+    let deployDir = "deploys";
+    let cfgDir: string | undefined;
+    let targetVersion: string | undefined;
+    let filename: string | undefined;
+    let url: string | undefined;
+    let setVersion = false;
+
+    while (process.argv.length > 2) {
+        switch (process.argv[2]) {
+            case "--noverify":
+                verify = false;
+                break;
+            case "--importkey":
+                importkey = true;
+                break;
+            case "--packages":
+                process.argv.shift();
+                pkgDir = process.argv[2];
+                break;
+            case "--deploys":
+                process.argv.shift();
+                deployDir = process.argv[2];
+                break;
+            case "--cfgdir":
+            case "-d":
+                process.argv.shift();
+                cfgDir = process.argv[2];
+                break;
+            default:
+                targetVersion = process.argv[2];
+        }
+        process.argv.shift();
+    }
+
+    if (targetVersion === undefined) {
+        targetVersion = "v" + riotDesktopPackageJson.version;
+    } else if (targetVersion !== "develop") {
+        setVersion = true; // version was specified
+    }
+
+    if (targetVersion === "develop") {
+        filename = "develop.tar.gz";
+        url = DEVELOP_TGZ_URL;
+        verify = false; // develop builds aren't signed
+    } else if (targetVersion.includes("://")) {
+        filename = targetVersion.substring(targetVersion.lastIndexOf("/") + 1);
+        url = targetVersion;
+        verify = false; // manually verified
+    } else {
+        filename = `element-${targetVersion}.tar.gz`;
+        url = PACKAGE_URL_PREFIX + targetVersion + "/" + filename;
+    }
+
+    const haveGpg = await new Promise<boolean>((resolve) => {
+        childProcess.execFile("gpg", ["--version"], (error) => {
+            resolve(!error);
+        });
+    });
+
+    if (importkey) {
+        if (!haveGpg) {
+            console.log("Can't import key without working GPG binary: install GPG and try again");
+            return 1;
+        }
+
+        await new Promise<boolean>((resolve, reject) => {
+            const gpgProc = childProcess.execFile("gpg", ["--import"], (error) => {
+                if (error) {
+                    console.log("Failed to import key", error);
+                } else {
+                    console.log("Key imported!");
+                }
+                resolve(!error);
+            });
+            fetch(PUB_KEY_URL)
+                .then((resp) => {
+                    if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
+                    if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
+                    stream.pipeline(resp.body, gpgProc.stdin!).catch(reject);
+                })
+                .catch(reject);
+        });
+        return 0;
+    }
+
+    if (cfgDir === undefined) {
+        console.log("No config directory set");
+        console.log("Specify a config directory with --cfgdir or -d");
+        console.log("To build with no config (and no auto-update), pass the empty string (-d '')");
+        return 1;
+    }
+
+    if (verify && !haveGpg) {
+        console.log("No working GPG binary: install GPG or pass --noverify to skip verification");
+        return 1;
+    }
+
+    let haveDeploy = false;
+    let expectedDeployDir = path.join(deployDir, path.basename(filename).replace(/\.tar\.gz/, ""));
+    try {
+        await fs.opendir(expectedDeployDir);
+        console.log(expectedDeployDir + "already exists");
+        haveDeploy = true;
+    } catch {}
+
+    if (!haveDeploy) {
+        const outPath = path.join(pkgDir, filename);
+        try {
+            await fs.stat(outPath);
+            console.log("Already have " + filename + ": not redownloading");
+        } catch {
+            try {
+                await downloadToFile(url, outPath);
+            } catch (e) {
+                console.log("Failed to download " + url, e);
+                return 1;
+            }
+        }
+
+        if (verify) {
+            try {
+                await fs.stat(outPath + ".asc");
+                console.log("Already have " + filename + ".asc: not redownloading");
+            } catch {
+                try {
+                    await downloadToFile(url + ".asc", outPath + ".asc");
+                } catch (e) {
+                    console.log("Failed to download " + url, e);
+                    return 1;
+                }
+            }
+
+            try {
+                await verifyFile(outPath);
+                console.log(outPath + " downloaded and verified");
+            } catch (e) {
+                console.log("Signature verification failed!", e);
+                return 1;
+            }
+        } else {
+            console.log(outPath + " downloaded but NOT verified");
+        }
+
+        await tar.x({
+            file: outPath,
+            cwd: deployDir,
+            onentry: (entry) => {
+                // Find the appropriate extraction path, only needed for `develop` where the dir name is unknown
+                if (entry.type === "Directory" && !path.join(deployDir, entry.path).startsWith(expectedDeployDir)) {
+                    expectedDeployDir = path.join(deployDir, entry.path);
+                }
+            },
+        });
+    }
+
+    try {
+        await fs.stat(ASAR_PATH);
+        console.log(ASAR_PATH + " already present: removing");
+        await fs.unlink(ASAR_PATH);
+    } catch {}
+
+    if (cfgDir.length) {
+        const configJsonSource = path.join(cfgDir, "config.json");
+        const configJsonDest = path.join(expectedDeployDir, "config.json");
+        console.log(configJsonSource + " -> " + configJsonDest);
+        await fs.copyFile(configJsonSource, configJsonDest);
+    } else {
+        console.log("Skipping config file");
+    }
+
+    console.log("Pack " + expectedDeployDir + " -> " + ASAR_PATH);
+    await asar.createPackage(expectedDeployDir, ASAR_PATH);
+
+    if (setVersion) {
+        const semVer = (await fs.readFile(path.join(expectedDeployDir, "version"), "utf-8")).trim();
+        console.log("Updating version to " + semVer);
+        await setPackageVersion(semVer);
+    }
+
+    console.log("Done!");
+}
+
+main()
+    .then((ret) => {
+        process.exit(ret);
+    })
+    .catch((e) => {
+        console.error(e);
+        process.exit(1);
+    });
@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+
+/**
+ * Script to generate incremental Nightly build versions, based on the latest Nightly build version of that kind.
+ * The version format is YYYYMMDDNN where NN is in case we need to do multiple versions in a day.
+ *
+ * NB. on windows, squirrel will try to parse the version number parts, including this string, into 32-bit integers,
+ * which is fine as long as we only add two digits to the end...
+ */
+
+import parseArgs from "minimist";
+
+const argv = parseArgs<{
+    latest?: string;
+}>(process.argv.slice(2), {
+    string: ["latest"],
+});
+
+function parseVersion(version: string): [Date, number] {
+    const year = parseInt(version.slice(0, 4), 10);
+    const month = parseInt(version.slice(4, 6), 10);
+    const day = parseInt(version.slice(6, 8), 10);
+    const num = parseInt(version.slice(8, 10), 10);
+    return [new Date(year, month - 1, day), num];
+}
+
+const [latestDate, latestNum] = argv.latest ? parseVersion(argv.latest) : [];
+
+const now = new Date();
+const month = (now.getMonth() + 1).toString().padStart(2, "0");
+const date = now.getDate().toString().padStart(2, "0");
+let buildNum = 1;
+if (latestDate && new Date(latestDate).getDate().toString().padStart(2, "0") === date) {
+    buildNum = latestNum! + 1;
+}
+
+if (buildNum > 99) {
+    throw new Error("Maximum number of Nightlies exceeded on this day.");
+}
+
+console.log(now.getFullYear() + month + date + buildNum.toString().padStart(2, "0"));
@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+
+/*
+ * Checks for the presence of a webapp, inspects its version and prints it
+ */
+
+import url from "node:url";
+
+import { versionFromAsar } from "./set-version.ts";
+
+async function main(): Promise<number> {
+    const version = await versionFromAsar();
+    console.log(version);
+
+    return 0;
+}
+
+if (import.meta.url.startsWith("file:")) {
+    const modulePath = url.fileURLToPath(import.meta.url);
+    if (process.argv[1] === modulePath) {
+        main()
+            .then((ret) => {
+                process.exit(ret);
+            })
+            .catch((e) => {
+                console.error(e);
+                process.exit(1);
+            });
+    }
+}
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Source https://gist.github.com/vladimyr/9a03481154cd3048a486bdf71e5e1535/57e57a6ace6fb2c8bba948bce726df7a96c3f99f
+# This scripts lets you check which minimum GLIBC version an executable requires.
+# Simply run './glibc-check.sh path/to/your/binary'
+MAX_GLIBC="${MAX_GLIBC:-2.28}"
+
+BINARY="$1"
+
+# Version comparison function in bash
+vercomp() {
+  if [[ $1 == "$2" ]]; then
+    return 0
+  fi
+  local i ver1 ver2
+  IFS="." read -ra ver1 <<<"$1"
+  IFS="." read -ra ver2 <<<"$2"
+  # fill empty fields in ver1 with zeros
+  for ((i = ${#ver1[@]}; i < ${#ver2[@]}; i++)); do
+    ver1[i]=0
+  done
+  for ((i = 0; i < ${#ver1[@]}; i++)); do
+    if [[ -z ${ver2[i]} ]]; then
+      # fill empty fields in ver2 with zeros
+      ver2[i]=0
+    fi
+    if ((10#${ver1[i]} > 10#${ver2[i]})); then
+      return 1
+    fi
+    if ((10#${ver1[i]} < 10#${ver2[i]})); then
+      return 2
+    fi
+  done
+  return 0
+}
+
+IFS="
+"
+VERS=$(objdump -T "$BINARY" | grep GLIBC_ | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -u)
+
+for VER in $VERS; do
+  vercomp "$VER" "$MAX_GLIBC"
+  COMP=$?
+  if [[ $COMP -eq 1 ]]; then
+    echo "Error! ${BINARY} requests GLIBC ${VER}, which is higher than target ${MAX_GLIBC}"
+    echo "Affected symbols:"
+    objdump -T "$BINARY" | grep -F "GLIBC_${VER}"
+    echo "Looking for symbols in libraries..."
+    for LIBRARY in $(ldd "$BINARY" | cut -d ' ' -f 3); do
+      echo "$LIBRARY"
+      objdump -T "$LIBRARY" | grep -F "GLIBC_${VER}"
+    done
+    exit 27
+  else
+    echo "Found version ${VER}"
+  fi
+done
@@ -0,0 +1,78 @@
+# hak
+
+This tool builds native dependencies for element-desktop. Here follows some very minimal
+documentation for it.
+
+Goals:
+
+- Must build compiled native node modules in a shippable state
+  (ie. only dynamically linked against libraries that will be on the
+  target system, all unnecessary files removed).
+- Must be able to build any native module, no matter what build system
+  it uses (electron-rebuild is supposed to do this job but only works
+  for modules that use gyp).
+
+It's also loosely designed to be a general tool and agnostic to what it's
+actually building. It's used here to build modules for the electron app
+but should work equally well for building modules for normal node.
+
+# Running
+
+Hak is invoked with a command and a dependency, eg. `pnpm run hak fetch matrix-seshat`.
+If no dependencies are given, hak runs the command on all dependencies.
+
+# Files
+
+There are a lot of files involved:
+
+- scripts/hak/... - The tool itself
+- hak/[dependency] - Files provided by the app that tell hak how to build each of its native dependencies.
+  Contains a hak.json file and also some script files, each of which must be referenced in hak.json.
+- .hak/ - Files generated by hak in the course of doing its job. Includes the dependency module itself and
+  any of the native dependency's native dependencies.
+- .hak/[dependency]/build - An extracted copy of the dependency's node module used to build it.
+- .hak/[dependency]/out - Another extracted copy of the dependency, this one contains only what will be shipped.
+
+# Workings
+
+Hak works around native node modules that try to fetch or build their native component in
+the npm 'install' phase - modules that do this will typically end up with native components
+targeted to the build platform and the node that npm/pnpm is using, which is no good for an
+electron app.
+
+It does this by installing it with `--ignore-scripts` and then using `pnpm link` to keep the
+dependency module separate so pnpm doesn't try to run its install / postinstall script
+at other points (eg. whenever you `pnpm add` a random other dependency).
+
+This also means that the dependencies cannot be listed in `dependencies` or
+`devDependencies` in the project, since this would cause pnpm to install them and
+try to fetch their native parts. Instead, they are listed in `hakDependencies` which
+hak reads to install them for you.
+
+Hak will _not_ install dependencies for the copy of the module it links into your
+project, so if your native module has javascript dependencies that are actually needed at
+runtime (and not just to fetch / build the native parts), it won't work.
+
+# Lifecycle
+
+Hak is divided into lifecycle stages, in order:
+
+- fetch - Download and extract the source of the dependency
+- link - Link the copy of the dependency into your node_modules directory
+- build - The Good Stuff. Configure and build any native dependencies, then the module itself.
+- copy - Copy the built artifact from the module build directory to the module output directory.
+
+# hak.json
+
+The scripts section contains scripts used for lifecycle stages that need them (fetch, build).
+It also contains 'prune' and 'copy' which are globs of files to delete from the output module directory
+and copy over from the module build directory to the output module directory, respectively.
+
+# Shortcomings
+
+Hak doesn't know about dependencies between lifecycle stages, ie. it doesn't know that you need to
+'fetch' before you can 'build', etc. You get to run each individually, and remember
+the right order.
+
+There is also a _lot_ of duplication in the command execution: we should abstract away
+some of the boilerplate required to run commands & so forth.
@@ -0,0 +1,14 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+import type { DependencyInfo } from "./dep.ts";
+import type HakEnv from "./hakEnv.ts";
+
+export default async function build(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    await moduleInfo.scripts.build(hakEnv, moduleInfo);
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");`