Merge remote-tracking branch 'origin/main' into security/frontend-cves

# Conflicts: # frontend/package-lock.json # frontend/package.json
Merge branch 'main' into security/frontend-cves
2026-09-03 13:20:08 +03:00 · 2026-08-12 12:07:18 +01:00 · 2026-08-05 09:57:59 +01:00 · 2026-08-02 02:31:52 +01:00 · 2026-07-31 14:18:29 +01:00 · 2026-07-31 14:07:07 +01:00
1675 changed files with 36958 additions and 99150 deletions
@@ -1,19 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "hooks": {
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node",
-            "args": [
-              "${CLAUDE_PROJECT_DIR}/scripts/lint/comment-lint-hook.mjs"
-            ],
-            "timeout": 60
-          }
-        ]
-      }
-    ]
-  }
-}
@@ -96,14 +96,6 @@ configs/
 __pycache__/
 **/__pycache__/

-# Python virtualenvs. Large, platform-specific, and their symlinks break the build.
-.venv/
-**/.venv/
-venv/
-**/venv/
-*.egg-info/
-**/*.egg-info/
-
 # Local env
 .env
 .env.*
@@ -22,15 +22,26 @@ indent_size = 4

 [*.html]
 indent_size = 2
+insert_final_newline = false
+trim_trailing_whitespace = false

-[{*.js,*.jsx,*.mjs,*.ts,*.tsx,*.mts}]
+[{*.js,*.jsx,*.mjs,*.ts,*.tsx}]
 indent_size = 2

 [*.css]
+# CSS files typically use an indent size of 2 spaces for better readability and alignment with community standards.
 indent_size = 2

 [*.{yml,yaml}]
+# YAML files use an indent size of 2 spaces to maintain consistency with common YAML formatting practices.
+indent_size = 2
+insert_final_newline = false
+trim_trailing_whitespace = false
+
+[*.json]
+# JSON files use an indent size of 2 spaces, which is the standard for JSON formatting.
 indent_size = 2

-[*.{json,jsonc}]
+[*.jsonc]
+# JSONC (JSON with comments) files also follow the standard JSON formatting with an indent size of 2 spaces.
 indent_size = 2
@@ -98,13 +98,6 @@ body:
      description: |
        If you have any additional information that might help us understand and resolve the issue, provide it here.

-  - type: textarea
-    id: sample-files
-    attributes:
-      label: Sample Files
-      description: |
-        If possible, attach the PDF or other input files needed to reproduce the issue. Remove any sensitive information before sharing.
-
  - type: markdown
    attributes:
      value: |
@@ -67,13 +67,6 @@ body:
      description: |
        If you have any additional information, comments, or resources you think would support or be relevant to your feature request, include them here.

-  - type: textarea
-    id: sample-files
-    attributes:
-      label: Example Files
-      description: |
-        If the feature request depends on specific PDFs or other example files, attach them here when available. Remove any sensitive information before sharing.
-
  - type: checkboxes
    id: search-confirmation
    attributes:
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.3
+pkgver=2.14.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.3
+pkgver=2.14.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
@@ -1,15 +1,13 @@
-# CI routing infrastructure. Changes to the top-level router (build.yml) or
-# this filter configuration rerun every area's jobs. Every job-gating filter
-# therefore includes *ci, so routing changes exercise the jobs they affect
-# instead of matching only the project filter.
+# CI routing infra. Editing the top-level router (build.yml) or this filter
+# config re-runs every area's jobs, so every job-gating filter below includes
+# *ci. That makes a change to how jobs are dispatched actually exercise those
+# jobs (self-testing), instead of a router edit only matching the project filter.
 ci: &ci
  - .github/workflows/build.yml
-  - .github/workflows/gradle-cache-prime.yml
  - .github/config/.files.yaml

 build: &build
  - *ci
-  - buildSrc/**
  - build.gradle
  - gradle/spotless.gradle
  - app/(common|core|proprietary|saas)/build.gradle
@@ -17,22 +15,6 @@ build: &build
  - .taskfiles/backend.yml
  - .github/workflows/check-licence.yml

-# Backend build inputs. This is intentionally broader than `build`: Java and
-# backend resource changes must exercise the backend matrix even when Gradle
-# build scripts themselves are unchanged.
-backend: &backend
-  - *ci
-  - *build
-  - gradle/**
-  - gradle.properties
-  - gradlew
-  - gradlew.bat
-  - settings.gradle
-  - app/(common|core|proprietary|saas)/src/(main|test)/java/**
-  - "app/(common|core|proprietary|saas)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
-  - scripts/db-migration/**
-  - .github/workflows/backend-build.yml
-
 openapi: &openapi
  - *ci
  - *build
@@ -42,9 +24,9 @@ openapi: &openapi
 docker-base: &docker-base
  - docker/base/Dockerfile

-# Dockerfiles only (base, embedded, and unoserver). The slow multi-architecture
-# (arm64) leg of the PR Docker test build runs only when a Dockerfile changes,
-# rather than for every code PR.
+# Dockerfiles only (base + embedded + unoserver). Gates the slow multi-arch
+# (arm64) leg of the PR docker test build: arm64 is only rebuilt when a
+# Dockerfile itself changes, not on every code PR.
 dockerfiles: &dockerfiles
  - docker/**/Dockerfile*

@@ -86,6 +68,7 @@ project: &project
 frontend: &frontend
  - *ci
  - frontend/**
+  - .github/workflows/testdriver.yml
  - testing/**
  - docker/**
  - scripts/translations/*.py
@@ -105,8 +88,8 @@ frontend: &frontend
  - .github/workflows/e2e-stubbed.yml
  - .github/workflows/e2e-live.yml

-# Files that affect the Tauri desktop bundle. Changes to any of these files
-# trigger the multi-OS Tauri build job.
+# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
+# job on changes to any of these.
 tauri: &tauri
  - *ci
  - frontend/editor/src-tauri/**
@@ -119,9 +102,9 @@ tauri: &tauri
  - Taskfile.yml
  - .taskfiles/desktop.yml

-# Files that affect the AI engine, including its Python tool models, fixers,
-# and tests. The engine validation job also runs when the Java tool surfaces
-# used to generate those models change.
+# Files that affect the AI engine (Python tool models, fixers, tests). Gate
+# the engine validation job on changes to engine sources or to the Java
+# tool surfaces it generates models from.
 engine: &engine
  - *ci
  - engine/**
@@ -131,10 +114,10 @@ engine: &engine
  - .taskfiles/engine.yml

 # Files that can make the committed generated API models (frontend tool API
-# types and engine tool models) stale: their Java sources, generators,
-# generated outputs (to catch hand edits), and generation tasks. Broad
-# frontend, Docker, and testing globs are intentionally excluded, so a CSS-only
-# PR does not start the backend to rebuild the specification.
+# types + engine tool models) go stale: the Java tool surfaces they derive from,
+# the generators, the generated files themselves (to catch a hand-edit), and the
+# tasks that drive generation. Deliberately excludes the broad frontend/docker/
+# testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
 generated-models: &generated-models
  - *ci
  - *openapi
@@ -158,8 +141,8 @@ licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - *build

-# Files that can affect premium or enterprise behaviour. Changes to any of
-# these files trigger the enterprise Playwright job for pull requests.
+# Files that can affect premium / enterprise behaviour. Gate the enterprise
+# Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
  - *ci
  - app/proprietary/**
@@ -8,6 +8,9 @@ updates:
  - package-ecosystem: "gradle" # See documentation for possible values
    directories:
      - "/" # Location of package manifests
+      - "/app/common"
+      - "/app/core"
+      - "/app/proprietary"
    schedule:
      interval: "weekly"
    cooldown:
@@ -34,19 +37,6 @@ updates:
    cooldown:
      default-days: 7
    rebase-strategy: "auto"
-    groups:
-      ubuntu:
-        patterns:
-          - "ubuntu"
-      eclipse-temurin:
-        patterns:
-          - "eclipse-temurin"
-      uv:
-        patterns:
-          - "ghcr.io/astral-sh/uv"
-      gradle:
-        patterns:
-          - "gradle"

  - package-ecosystem: github-actions
    directory: /
@@ -60,7 +50,6 @@ updates:
    directories:
      - /devTools
      - /frontend
-      - /testing/compose/mcp-client-check
    schedule:
      interval: "weekly"
    cooldown:
@@ -89,13 +78,6 @@ updates:
          - "react-dom"
          - "@types/react"
          - "@types/react-dom"
-      tanstack:
-        patterns:
-          - "@tanstack/*"
-      typescript:
-        patterns:
-          - "typescript"
-          - "@typescript/*"
      vite:
        patterns:
          - "vite"
@@ -124,10 +106,6 @@ updates:
        patterns:
          - "@posthog/*"
          - "posthog-js"
-      storybook:
-        patterns:
-          - "storybook"
-          - "@storybook/*"
      supabase:
        patterns:
          - "@supabase/*"
@@ -174,8 +152,8 @@ updates:
          - "tokio"
          - "tokio-*"

-  - package-ecosystem: "uv"
-    directory: "/engine"
+  - package-ecosystem: pip
+    directory: /testing/cucumber
    schedule:
      interval: "weekly"
    cooldown:
@@ -67,7 +67,6 @@ labels:
      - 'frontend/**'
      - 'frontend/.*'
      - 'frontend/**/.*'
-      - '.taskfiles/frontend.yml'

  - label: 'Tauri'
    files:
@@ -20,7 +20,6 @@ Closes #(issue_number)
 - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable)
 - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable)
 - [ ] I have performed a self-review of my own code
- [ ] Every comment I added says something the code does not ([guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/CODE_COMMENTS.md))
 - [ ] My changes generate no new warnings

 ### Documentation
@@ -26,10 +26,6 @@ jobs:
  check-pr:
    if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
-    # Only reads the PR via pulls.get with the default GITHUB_TOKEN.
-    permissions:
-      contents: read
-      pull-requests: read
    outputs:
      should_deploy: ${{ steps.decide.outputs.should_deploy }}
      is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -39,7 +35,7 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -101,7 +97,6 @@ jobs:
          echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT

  deploy-v2-pr:
-    environment: pr-preview
    needs: check-pr
    runs-on: ubuntu-latest
    if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
@@ -112,7 +107,6 @@ jobs:
    permissions:
      contents: read
      issues: write
-      packages: write
      pull-requests: write
    env:
      # Single source of truth for whether this preview embeds the admin portal:
@@ -121,7 +115,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -131,11 +125,20 @@ jobs:
          repository: ${{ github.repository }}
          ref: main

+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Add deployment started comment
        id: deployment-started
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
@@ -177,12 +180,11 @@ jobs:
        with:
          repository: ${{ needs.check-pr.outputs.pr_repository }}
          ref: ${{ needs.check-pr.outputs.pr_ref }}
-          # untrusted tree is built below - never leave credentials in .git/config
-          persist-credentials: false
+          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0 # Fetch full history for commit hash detection

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Get version number
        id: versionNumber
@@ -190,16 +192,11 @@ jobs:
          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

-      - name: Login to GitHub Container Registry
+      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Get commit hash for app
        id: commit-hash
@@ -223,7 +220,7 @@ jobs:
      - name: Check if image exists
        id: check-image
        run: |
-          if docker manifest inspect ${IMAGE_BASE}:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Image already exists, skipping build"
          else
@@ -231,8 +228,6 @@ jobs:
            echo "Image needs to be built"
          fi

-        env:
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
      - name: Build and push V2 image
        if: steps.check-image.outputs.exists == 'false'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -242,7 +237,7 @@ jobs:
          push: true
          cache-from: type=gha,scope=stirling-pdf-latest
          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:v2-${{ steps.commit-hash.outputs.app_short }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
          build-args: |
            VERSION_TAG=v2-alpha
            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
@@ -251,11 +246,9 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
      - name: Deploy V2 to VPS
        id: deploy
        run: |
@@ -268,7 +261,7 @@ jobs:
          services:
            stirling-pdf-v2:
              container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${IMAGE_BASE}:v2-${{ steps.commit-hash.outputs.app_short }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
              ports:
                - "${V2_PORT}:8080"
              volumes:
@@ -280,8 +273,8 @@ jobs:
                DISABLE_ADDITIONAL_FEATURES: "false"
                STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
                SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${TEST_LOGIN_USERNAME}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${TEST_LOGIN_PASSWORD}"
+                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
+                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                SYSTEM_DEFAULTLOCALE: en-US
                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
@@ -295,9 +288,9 @@ jobs:
          EOF

          # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${NEW_VPS_USERNAME}@${NEW_VPS_HOST}:/tmp/docker-compose-v2.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create V2 PR-specific directories
            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}

@@ -322,19 +315,12 @@ jobs:
          # Set port for output
          echo "v2_port=${V2_PORT}" >> $GITHUB_OUTPUT

-        env:
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
-          TEST_LOGIN_USERNAME: ${{ secrets.TEST_LOGIN_USERNAME }}
-          TEST_LOGIN_PASSWORD: ${{ secrets.TEST_LOGIN_PASSWORD }}
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
-
      # ---- Storybook preview (only when this PR touches stories/.storybook) ----
      # Runs inside the same approved-contributor-gated deploy job, so it deploys
      # under the exact same access rules as the app preview.
      - name: Detect Storybook changes
        id: sb-changes
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          list-files: json
          filters: |
@@ -353,7 +339,7 @@ jobs:

      - name: Install Task for Storybook
        if: steps.sb-changes.outputs.storybook == 'true'
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Build and deploy Storybook
        id: storybook
@@ -393,9 +379,8 @@ jobs:
        env:
          SB_URL: ${{ steps.storybook.outputs.url }}
          SB_FILES: ${{ steps.sb-changes.outputs.storybook_files }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ needs.check-pr.outputs.pr_number }};
@@ -416,7 +401,7 @@ jobs:
              }
            }

-            const deploymentUrl = `http://${process.env.NEW_VPS_HOST}:${v2Port}`;
+            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;

            // Only mention the portal when this image actually embeds it.
            // Use the direct IP URL - the SSL hostname isn't supported yet.
@@ -462,10 +447,6 @@ jobs:
            });

  cleanup-v2-deployment:
-    # Tearing a preview down is not a deployment - no deployment object.
-    environment:
-      name: pr-preview
-      deployment: false
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    permissions:
@@ -475,17 +456,26 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Clean up V2 deployment comments
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { owner, repo } = context.repo;
            const prNumber = ${{ github.event.pull_request.number }};
@@ -514,14 +504,12 @@ jobs:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
      - name: Cleanup V2 deployment
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
            if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
              echo "Found V2 PR directory, proceeding with cleanup..."

@@ -554,11 +542,8 @@ jobs:
            # Only remove PR-specific containers and directories
          ENDSSH

-        env:
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
      - name: Cleanup temporary files
        if: always()
        run: |
-          rm -f ../private.key docker-compose.yml storybook.tgz
+          rm -f ../private.key
        continue-on-error: true
@@ -37,8 +37,7 @@ jobs:
  check-comment:
    runs-on: ubuntu-latest
    permissions:
-      contents: read # actions/checkout
-      issues: write # add reaction to the triggering issue comment
+      issues: write
    if: |
      vars.CI_PROFILE != 'lite' && (
        github.event_name == 'workflow_dispatch' ||
@@ -70,13 +69,22 @@ jobs:
      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout PR
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Get PR data
        id: get-pr
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -147,7 +155,7 @@ jobs:
        id: add-eyes-reaction
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            console.log(`Adding eyes reaction to comment ID: ${context.payload.comment.id}`);
            try {
@@ -166,38 +174,35 @@ jobs:
            }

  deploy-pr:
-    environment: pr-preview
    needs: check-comment
    runs-on: ubuntu-latest
    permissions:
-      contents: read # actions/checkout, incl. the PR merge ref
-      issues: write # reactions, 'pr-deployed' label, deployment URL comment
+      issues: write
      pull-requests: write
-      packages: write # push PR image to ghcr.io

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout PR
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Checkout PR
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
-          # untrusted tree gets built below - never leave credentials in .git/config
-          persist-credentials: false
-
-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-deploy-pr-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          token: ${{ steps.setup-bot.outputs.token }}

      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -205,8 +210,19 @@ jobs:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -222,18 +238,13 @@ jobs:
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

-      - name: Login to GitHub Container Registry
+      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Build and push PR-specific image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -243,7 +254,7 @@ jobs:
          push: true
          cache-from: type=gha,scope=stirling-pdf-latest
          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:pr-${{ needs.check-comment.outputs.pr_number }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
          build-args: |
            VERSION_TAG=alpha
            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
@@ -258,17 +269,15 @@ jobs:
          push: true
          cache-from: type=gha,scope=stirling-pdf-engine
          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
          platforms: linux/amd64

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key

-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
      - name: Deploy to VPS
        id: deploy
        run: |
@@ -286,11 +295,11 @@ jobs:
          # Set pro/enterprise settings (enterprise implies pro)
          if [ "${{ needs.check-comment.outputs.enable_enterprise }}" == "true" ]; then
            PREMIUM_ENABLED="true"
-            PREMIUM_KEY="${ENTERPRISE_KEY}"
+            PREMIUM_KEY="${{ secrets.ENTERPRISE_KEY }}"
            PREMIUM_PROFEATURES_AUDIT_ENABLED="true"
          elif [ "${{ needs.check-comment.outputs.enable_pro }}" == "true" ]; then
            PREMIUM_ENABLED="true"
-            PREMIUM_KEY="${PRO_KEY}"
+            PREMIUM_KEY="${{ secrets.PREMIUM_KEY }}"
            PREMIUM_PROFEATURES_AUDIT_ENABLED="true"
          else
            PREMIUM_ENABLED="false"
@@ -300,6 +309,7 @@ jobs:

          ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
          PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
+          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"

          # Build engine env vars for backend (only set when prototypes enabled)
          if [ "$ENABLE_PROTOTYPES" == "true" ]; then
@@ -309,9 +319,9 @@ jobs:
            ENGINE_SERVICE="
            stirling-pdf-engine:
              container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${IMAGE_BASE}:engine-pr-${PR_NUMBER}
+              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
              environment:
-                ANTHROPIC_API_KEY: \"${ANTHROPIC_API_KEY}\"
+                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
              networks:
                - pr-network
              restart: on-failure:5"
@@ -334,7 +344,7 @@ jobs:
          services:
            stirling-pdf:
              container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${IMAGE_BASE}:pr-${PR_NUMBER}
+              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
              ports:
                - "${PR_NUMBER}:8080"
              volumes:
@@ -358,9 +368,9 @@ jobs:
          EOF

          # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${NEW_VPS_USERNAME}@${NEW_VPS_HOST}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml

-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create PR-specific directories
            mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}

@@ -376,19 +386,11 @@ jobs:
          # Set output for use in PR comment
          echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV

-        env:
-          ENTERPRISE_KEY: ${{ secrets.ENTERPRISE_KEY }}
-          # named PRO_KEY, not PREMIUM_KEY, so the shell var it feeds is not self-referential
-          PRO_KEY: ${{ secrets.PREMIUM_KEY }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
      - name: Add success reaction to comment
        if: success() && github.event_name == 'issue_comment'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            console.log(`Adding rocket reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
            try {
@@ -423,7 +425,7 @@ jobs:
        if: failure() && github.event_name == 'issue_comment'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            console.log(`Adding -1 reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
            try {
@@ -442,17 +444,15 @@ jobs:
      - name: Post deployment URL to PR
        if: success()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { GITHUB_REPOSITORY } = process.env;
            const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
            const prNumber = ${{ needs.check-comment.outputs.pr_number }};
            const securityStatus = process.env.security_status || "Security Disabled";

-            const deploymentUrl = `http://${process.env.NEW_VPS_HOST}:${prNumber}`;
+            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
            const commentBody = `## 🚀 PR Test Deployment\n\n` +
                              `Your PR has been deployed for testing!\n\n` +
                              `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -477,22 +477,26 @@ jobs:
  handle-label-commands:
    if: ${{ github.event.issue.pull_request != null }}
    runs-on: ubuntu-latest
-    permissions:
-      contents: read # actions/checkout, reads repo_devs.json and labels.yml
-      issues: write # add/remove labels, delete the command comment
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Check out the repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Apply label commands
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const fs = require('fs');
            const path = require('path');
@@ -7,33 +7,41 @@ on:
 permissions:
  contents: read

+env:
+  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
+  CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred
+
 jobs:
  cleanup:
-    # Tearing a preview down is not a deployment - no deployment object.
-    environment:
-      name: pr-preview
-      deployment: false
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    permissions:
-      contents: read # actions/checkout
      pull-requests: write
-      issues: write # list/remove labels, list/delete comments
+      issues: write

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout PR
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Remove 'pr-deployed' label if present
        id: remove-label-comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const prNumber = ${{ github.event.pull_request.number }};
            const owner = context.repo.owner;
@@ -92,22 +100,14 @@ jobs:
        if: steps.remove-label-comment.outputs.present == 'true'
        run: |
          mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
          sudo chmod 600 ../private.key
-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT

      - name: Cleanup PR deployment
        if: steps.remove-label-comment.outputs.present == 'true'
        id: cleanup
-        # ENDSSH heredoc is quoted, so its body is sent literally: secrets inside it
-        # must stay as GitHub expressions, a shell var would be empty on the remote host.
        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
            if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
              echo "Found PR directory, proceeding with cleanup..."

@@ -122,8 +122,8 @@ jobs:
              rm -rf /stirling/PR-${{ github.event.pull_request.number }}

              # Remove the Docker images
-              docker rmi --no-prune ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:engine-pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true

              echo "PERFORMED_CLEANUP"
            else
@@ -131,9 +131,6 @@ jobs:
              echo "NO_CLEANUP_NEEDED"
            fi
          ENDSSH
-        env:
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}

      - name: Cleanup temporary files
        if: always()
@@ -1,246 +0,0 @@
-name: Auto SaaS Dev Deployment
-
-on:
-  push:
-    branches:
-      - saas-prod
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  FRONTEND_PORT: "901"
-  BACKEND_PORT: "902"
-  DEPLOY_DIR: /stirling/SAAS-DEV
-
-jobs:
-  deploy-saas-dev:
-    runs-on: ubuntu-latest
-    environment: saas-dev
-    concurrency:
-      group: saas-dev-deploy
-      cancel-in-progress: true
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Check SaaS configuration
-        id: config
-        env:
-          PROJECT_REF: ${{ secrets.SAAS_DB_PROJECT_REF }}
-        run: |
-          echo "supabase_url=https://${PROJECT_REF}.supabase.co" >> "$GITHUB_OUTPUT"
-          echo "meter_endpoint=https://${PROJECT_REF}.supabase.co/functions/v1/meter-payg-units" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Get commit hash
-        id: commit-hash
-        run: echo "app_short=$(git rev-parse --short=8 HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Build and push backend image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-saas-backend
-          cache-to: type=gha,mode=max,scope=stirling-saas-backend
-          tags: |
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:saas-backend-${{ steps.commit-hash.outputs.app_short }}
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:saas-backend-latest
-          build-args: |
-            VERSION_TAG=v2-alpha
-            STIRLING_FLAVOR=saas
-          platforms: linux/amd64
-
-      - name: Build and push frontend image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-saas-frontend
-          cache-to: type=gha,mode=max,scope=stirling-saas-frontend
-          tags: |
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:saas-frontend-${{ steps.commit-hash.outputs.app_short }}
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:saas-frontend-latest
-          build-args: |
-            VERSION_TAG=v2-alpha
-            STIRLING_FLAVOR=saas
-            VITE_BUILD_MODE=development
-            VITE_SUPABASE_URL=${{ steps.config.outputs.supabase_url }}
-            VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY=${{ secrets.SAAS_SUPABASE_PUBLISHABLE_KEY }}
-          platforms: linux/amd64
-
-      - name: Build and push AI engine image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-saas-engine
-          cache-to: type=gha,mode=max,scope=stirling-saas-engine
-          tags: |
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:saas-engine-${{ steps.commit-hash.outputs.app_short }}
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:saas-engine-latest
-          platforms: linux/amd64
-
-      - name: Set up SSH
-        env:
-          SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh/
-          echo "$SSH_KEY" > ../private.key
-          sudo chmod 600 ../private.key
-
-      - name: Deploy to VPS
-        env:
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
-          IMAGE_TAG: ${{ steps.commit-hash.outputs.app_short }}
-          GHCR_USER: ${{ github.actor }}
-          GHCR_TOKEN: ${{ github.token }}
-          VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
-          SAAS_DB_URL: ${{ secrets.SAAS_DB_URL }}
-          SAAS_DB_USERNAME: ${{ secrets.SAAS_DB_USERNAME || 'postgres' }}
-          SAAS_DB_PASSWORD: ${{ secrets.SAAS_DB_PASSWORD }}
-          SAAS_DB_PROJECT_REF: ${{ secrets.SAAS_DB_PROJECT_REF }}
-          SUPABASE_EDGE_FUNCTION_SECRET: ${{ secrets.SUPABASE_EDGE_FUNCTION_SECRET }}
-          PAYG_METER_ENDPOINT: ${{ steps.config.outputs.meter_endpoint }}
-          STIRLING_KEYGEN_ENABLED: ${{ secrets.KEYGEN_ACCOUNT_ID != '' && secrets.KEYGEN_API_TOKEN != '' && secrets.KEYGEN_POLICY_ID != '' }}
-          KEYGEN_ACCOUNT_ID: ${{ secrets.KEYGEN_ACCOUNT_ID }}
-          KEYGEN_API_TOKEN: ${{ secrets.KEYGEN_API_TOKEN }}
-          KEYGEN_POLICY_ID: ${{ secrets.KEYGEN_POLICY_ID }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          VOYAGE_API_KEY: ${{ secrets.VOYAGE_API_KEY }}
-        run: |
-          set -euo pipefail
-
-          BASE_URL="http://${VPS_HOST}:${FRONTEND_PORT}"
-
-          yaml() {
-            printf "'%s'" "$(printf '%s' "$1" | sed -e "s/'/''/g" -e 's/\$/$$/g')"
-          }
-
-            ENGINE_SECRET="$(openssl rand -hex 32)"
-            AI_BACKEND_VARS="
-                SYSTEM_AIENGINE_ENABLED: \"true\"
-                SYSTEM_AIENGINE_URL: \"http://saas-engine:5001\"
-                APP_AI_SERVICEBASEURL: \"http://saas-engine:5001\"
-                STIRLING_ENGINE_SHARED_SECRET: $(yaml "$ENGINE_SECRET")"
-            AI_SERVICE="
-
-            saas-engine:
-              container_name: stirling-saas-dev-engine
-              image: ${IMAGE_BASE}:saas-engine-${IMAGE_TAG}
-              environment:
-                ANTHROPIC_API_KEY: $(yaml "$ANTHROPIC_API_KEY")
-                VOYAGE_API_KEY: $(yaml "$VOYAGE_API_KEY")
-                STIRLING_ENGINE_SHARED_SECRET: $(yaml "$ENGINE_SECRET")
-              restart: on-failure:5"
-
-          cat > docker-compose.yml << EOF
-          version: '3.3'
-          services:
-            saas-backend:
-              container_name: stirling-saas-dev-backend
-              image: ${IMAGE_BASE}:saas-backend-${IMAGE_TAG}
-              ports:
-                - "${BACKEND_PORT}:8080"
-              volumes:
-                - ${DEPLOY_DIR}/config:/configs:rw
-                - ${DEPLOY_DIR}/logs:/logs:rw
-                - ${DEPLOY_DIR}/storage:/storage:rw
-              environment:
-                SPRING_PROFILES_ACTIVE: "saas"
-                DISABLE_ADDITIONAL_FEATURES: "false"
-                SAAS_DB_URL: $(yaml "$SAAS_DB_URL")
-                SAAS_DB_USERNAME: $(yaml "$SAAS_DB_USERNAME")
-                SAAS_DB_PASSWORD: $(yaml "$SAAS_DB_PASSWORD")
-                SAAS_DB_PROJECT_REF: $(yaml "$SAAS_DB_PROJECT_REF")
-                SUPABASE_EDGE_FUNCTION_SECRET: $(yaml "$SUPABASE_EDGE_FUNCTION_SECRET")
-                PAYG_METER_ENDPOINT: $(yaml "$PAYG_METER_ENDPOINT")
-                STIRLING_KEYGEN_ENABLED: $(yaml "$STIRLING_KEYGEN_ENABLED")
-                KEYGEN_ACCOUNT_ID: $(yaml "$KEYGEN_ACCOUNT_ID")
-                KEYGEN_API_TOKEN: $(yaml "$KEYGEN_API_TOKEN")
-                KEYGEN_POLICY_ID: $(yaml "$KEYGEN_POLICY_ID")
-                SYSTEM_DEFAULTLOCALE: en-US
-                SYSTEM_MAXFILESIZE: "100"
-                METRICS_ENABLED: "true"
-                SYSTEM_GOOGLEVISIBILITY: "false"
-                SWAGGER_SERVER_URL: "${BASE_URL}"
-                baseUrl: "${BASE_URL}"${AI_BACKEND_VARS}
-              restart: on-failure:5
-
-            saas-frontend:
-              container_name: stirling-saas-dev-frontend
-              image: ${IMAGE_BASE}:saas-frontend-${IMAGE_TAG}
-              ports:
-                - "${FRONTEND_PORT}:80"
-              environment:
-                VITE_API_BASE_URL: "http://saas-backend:8080"
-              depends_on:
-                - saas-backend
-              restart: on-failure:5${AI_SERVICE}
-          EOF
-
-          SSH_OPTS=(-i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null)
-
-          scp "${SSH_OPTS[@]}" docker-compose.yml "${VPS_USERNAME}@${VPS_HOST}:/tmp/saas-dev-docker-compose.yml"
-
-          ssh "${SSH_OPTS[@]}" -T "${VPS_USERNAME}@${VPS_HOST}" << ENDSSH
-            set -e
-            mkdir -p ${DEPLOY_DIR}/{config,logs,storage}
-            mv /tmp/saas-dev-docker-compose.yml ${DEPLOY_DIR}/docker-compose.yml
-            chmod 600 ${DEPLOY_DIR}/docker-compose.yml
-            cd ${DEPLOY_DIR}
-            printf '%s' "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USER}" --password-stdin
-            docker-compose down --remove-orphans 2>/dev/null || true
-            docker-compose pull
-            docker-compose up -d
-            docker logout ghcr.io >/dev/null 2>&1 || true
-            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
-          ENDSSH
-
-      - name: Wait for the backend to answer
-        env:
-          VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
-        run: |
-          URL="http://${VPS_HOST}:${BACKEND_PORT}/api/v1/info/status"
-          for i in $(seq 1 60); do
-            code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "$URL" || true)
-            if [ "$code" = "200" ]; then echo "Healthy after $((i * 10))s"; exit 0; fi
-            sleep 10
-          done
-          echo "::error::SaaS dev backend did not become healthy within 10 minutes"
-          exit 1
-
-      - name: Cleanup temporary files
-        if: always()
-        run: rm -f ../private.key docker-compose.yml
-        continue-on-error: true
@@ -38,7 +38,7 @@ jobs:
      is_fork: ${{ steps.decide.outputs.is_fork }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -20,7 +20,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -28,15 +28,16 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            engine/pyproject.toml
            engine/uv.lock
+          cache-suffix: ai-engine

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Quality-check engine
        id: engine-check
@@ -0,0 +1,228 @@
+name: AI - PR Title Review
+
+on:
+  pull_request:
+    types: [opened, edited]
+    branches: [main]
+
+permissions: # required for secure-repo hardening
+  contents: read
+
+jobs:
+  ai-title-review:
+    permissions:
+      contents: read
+      pull-requests: write
+      models: read
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git to suppress detached HEAD warning
+        run: git config --global advice.detachedHead false
+
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Check if actor is repo developer
+        id: actor
+        run: |
+          if [[ "${{ github.actor }}" == *"[bot]" ]]; then
+            echo "PR opened by a bot – skipping AI title review."
+            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          if [ ! -f .github/config/repo_devs.json ]; then
+            echo "Error: .github/config/repo_devs.json not found" >&2
+            exit 1
+          fi
+          # Validate JSON and extract repo_devs
+          REPO_DEVS=$(jq -r '.repo_devs[]' .github/config/repo_devs.json 2>/dev/null || { echo "Error: Invalid JSON in repo_devs.json" >&2; exit 1; })
+          # Convert developer list into Bash array
+          mapfile -t DEVS_ARRAY <<< "$REPO_DEVS"
+          if [[ " ${DEVS_ARRAY[*]} " == *" ${{ github.actor }} "* ]]; then
+            echo "is_repo_dev=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Get PR diff
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        id: get_diff
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          git diff origin/${{ github.base_ref }}...HEAD | head -n 10000 | grep -vP '[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x{202E}\x{200B}]' > pr.diff
+          echo "diff<<EOF" >> $GITHUB_OUTPUT
+          cat pr.diff >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Check and sanitize PR title
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        id: sanitize_pr_title
+        env:
+          PR_TITLE_RAW: ${{ github.event.pull_request.title }}
+        run: |
+          # Sanitize PR title: max 72 characters, only printable characters
+          PR_TITLE=$(echo "$PR_TITLE_RAW" | tr -d '\n\r' | head -c 72 | sed 's/[^[:print:]]//g')
+          if [[ ${#PR_TITLE} -lt 5 ]]; then
+            echo "PR title is too short. Must be at least 5 characters." >&2
+          fi
+          echo "pr_title=$PR_TITLE" >> $GITHUB_OUTPUT
+
+      - name: AI PR Title Analysis
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        id: ai-title-analysis
+        uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2.1.1
+        with:
+          model: openai/gpt-4o
+          system-prompt-file: ".github/config/system-prompt.txt"
+          prompt: |
+            Based on the following input data:
+
+            {
+              "diff": "${{ steps.get_diff.outputs.diff }}",
+              "pr_title": "${{ steps.sanitize_pr_title.outputs.pr_title }}"
+            }
+
+            Respond ONLY with valid JSON in the format:
+            {
+              "improved_rating": <0-10>,
+              "improved_ai_title_rating": <0-10>,
+              "improved_title": "<ai generated title>"
+            }
+
+      - name: Validate and set SCRIPT_OUTPUT
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        run: |
+          cat <<EOF > ai_response.json
+          ${{ steps.ai-title-analysis.outputs.response }}
+          EOF
+
+          # Validate JSON structure
+          jq -e '
+            (keys | sort) == ["improved_ai_title_rating", "improved_rating", "improved_title"] and
+            (.improved_rating | type == "number" and . >= 0 and . <= 10) and
+            (.improved_ai_title_rating | type == "number" and . >= 0 and . <= 10) and
+            (.improved_title | type == "string")
+          ' ai_response.json
+          if [ $? -ne 0 ]; then
+            echo "Invalid AI response format" >&2
+            cat ai_response.json >&2
+            exit 1
+          fi
+          # Parse JSON fields
+          IMPROVED_RATING=$(jq -r '.improved_rating' ai_response.json)
+          IMPROVED_TITLE=$(jq -r '.improved_title' ai_response.json)
+          # Limit comment length to 1000 characters
+          COMMENT=$(cat <<EOF
+          ## 🤖 AI PR Title Suggestion
+
+          **PR-Title Rating**: $IMPROVED_RATING/10
+
+          ### ⬇️ Suggested Title (copy & paste):
+
+          \`\`\`
+          $IMPROVED_TITLE
+          \`\`\`
+
+          ---
+          *Generated by GitHub Models AI*
+          EOF
+          )
+          echo "$COMMENT" > /tmp/ai-title-comment.md
+          # Log input and output to the GitHub Step Summary
+          echo "### 🤖 AI PR Title Analysis" >> $GITHUB_STEP_SUMMARY
+          echo "### Input PR Title" >> $GITHUB_STEP_SUMMARY
+          echo '```bash' >> $GITHUB_STEP_SUMMARY
+          echo "${{ steps.sanitize_pr_title.outputs.pr_title }}" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo '### AI Response (raw JSON)' >> $GITHUB_STEP_SUMMARY
+          echo '```json' >> $GITHUB_STEP_SUMMARY
+          cat ai_response.json >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+
+      - name: Post comment on PR if needed
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        continue-on-error: true
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const fs = require('fs');
+            const body = fs.readFileSync('/tmp/ai-title-comment.md', 'utf8');
+            const { GITHUB_REPOSITORY } = process.env;
+            const [owner, repo] = GITHUB_REPOSITORY.split('/');
+            const issue_number = context.issue.number;
+
+            const ratingMatch = body.match(/\*\*PR-Title Rating\*\*: (\d+)\/10/);
+            const rating = ratingMatch ? parseInt(ratingMatch[1], 10) : null;
+
+            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
+            const comments = await github.rest.issues.listComments({ owner, repo, issue_number });
+
+            const existing = comments.data.find(c =>
+              c.user?.login === expectedActor &&
+              c.body.includes("## 🤖 AI PR Title Suggestion")
+            );
+
+            if (rating === null) {
+              console.log("No rating found in AI response – skipping.");
+              return;
+            }
+
+            if (rating <= 5) {
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner, repo,
+                  comment_id: existing.id,
+                  body
+                });
+                console.log("Updated existing suggestion comment.");
+              } else {
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number,
+                  body
+                });
+                console.log("Created new suggestion comment.");
+              }
+            } else {
+              const praise = `## 🤖 AI PR Title Suggestion\n\nGreat job! The current PR title is clear and well-structured.\n\n✅ No suggestions needed.\n\n---\n*Generated by GitHub Models AI*`;
+
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner, repo,
+                  comment_id: existing.id,
+                  body: praise
+                });
+                console.log("Replaced suggestion with praise.");
+              } else {
+                console.log("Rating > 5 and no existing comment – skipping comment.");
+              }
+            }
+
+      - name: is not repo dev
+        if: steps.actor.outputs.is_repo_dev != 'true'
+        run: |
+          exit 0 # Skip the AI title review for non-repo developers
+
+      - name: Clean up
+        if: always()
+        run: |
+          rm -f pr.diff ai_response.json /tmp/ai-title-comment.md
+          echo "Cleaned up temporary files."
+        continue-on-error: true # Ensure cleanup runs even if previous steps fail
@@ -26,7 +26,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -66,12 +66,11 @@ jobs:
          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"

  publish-aur:
-    environment: package-publish
    needs: get-release-info
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -107,7 +106,7 @@ jobs:

      - name: Publish stirling-pdf-desktop to AUR
        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@084b0d9b15415bf9cdb65d44dad1efe37a354050 # v4.2.0
+        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
        with:
          pkgname: stirling-pdf-desktop
          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
@@ -13,21 +13,26 @@ jobs:
  labeler:
    runs-on: ubuntu-latest
    permissions:
-      contents: read # checkout + labeler fetching its config from the repo
-      pull-requests: write # read changed files, apply labels to the PR
-      issues: write # labels are applied through the issues API
+      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - uses: srvaroa/labeler@bf262763a8a8e191f5847873aecc0f29df84f957 # v1.14.0
        with:
          config_path: .github/labeler-config-srvaroa.yml
          use_local_config: false
          fail_on_error: true
        env:
-          GITHUB_TOKEN: "${{ github.token }}"
+          GITHUB_TOKEN: "${{ steps.setup-bot.outputs.token }}"
@@ -20,9 +20,6 @@ permissions:

 jobs:
  build:
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
@@ -31,28 +28,31 @@ jobs:
        flavor: [core, proprietary, saas]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK ${{ matrix.jdk-version }}
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: ${{ matrix.jdk-version }}
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Check Java formatting (Spotless)
        # Runs once per matrix combination - pick the cheapest leg
        # (core - no proprietary, no saas) so we don't wait for the
@@ -153,9 +153,6 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_FLAVOR: ${{ matrix.flavor }}
-          # Configure the Gradle daemon explicitly; GRADLE_OPTS alone only
-          # configures the Gradle client JVM.
-          GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx4g -XX:+UseG1GC"

      - name: Check Test Reports Exist
        if: always()
@@ -197,7 +194,7 @@ jobs:

      - name: Install uv
        if: always() && matrix.flavor == 'saas'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -15,11 +15,6 @@ name: Enterprise E2E (Playwright)

 on:
  workflow_call:
-    inputs:
-      use_shared_cache:
-        required: false
-        type: boolean
-        default: false
  push:
    branches: ["main"]
  schedule:
@@ -42,9 +37,6 @@ jobs:
    uses: ./.github/workflows/_runner-pick.yml

  playwright-e2e-enterprise:
-    environment:
-      name: ci-unsigned
-      deployment: false
    needs: pick
    # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE,
    # so the suite can't boot premium and would fail. See the header comment.
@@ -58,36 +50,26 @@ jobs:
      SYSTEM_ENABLEANALYTICS: "false"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Restore cache Gradle User Home
-        if: inputs.use_shared_cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
-      - name: Restore cache Gradle
-        if: inputs.use_shared_cache == false
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-playwright-e2e-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"
-
+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
@@ -95,7 +77,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (needed for playwright's vite preview webServer)
@@ -324,18 +306,9 @@ jobs:
          path: frontend/playwright-report/
          retention-days: 7

-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          rm -f /tmp/helpers.sh /tmp/backend.log /tmp/backend.pid
-        continue-on-error: true
-
  # Multi-node regression: builds + seeds the clustered stack (testing/compose/docker-compose-multinode.yml)
  # and runs behave features/multinode. Licence-gated, so it runs after the Playwright job (not in parallel).
  multinode-e2e:
-    environment:
-      name: ci-unsigned
-      deployment: false
    needs: [pick, playwright-e2e-enterprise]
    # Nightly cron + manual dispatch only (heavy build), fork-gated for the licence secret.
    if: >-
@@ -351,13 +324,13 @@ jobs:
      MN_COMPOSE: docker-compose-multinode.yml
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -37,7 +37,6 @@ jobs:
    timeout-minutes: 3
    outputs:
      build: ${{ steps.changes.outputs.build }}
-      backend: ${{ steps.changes.outputs.backend }}
      project: ${{ steps.changes.outputs.project }}
      openapi: ${{ steps.changes.outputs.openapi }}
      frontend: ${{ steps.changes.outputs.frontend }}
@@ -49,25 +48,54 @@ jobs:
      proprietary: ${{ steps.changes.outputs.proprietary }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: changes
        with:
          filters: .github/config/.files.yaml

  gradle-cache-prime:
+    name: Prime shared Gradle cache
    needs: [files-changed]
-    uses: ./.github/workflows/gradle-cache-prime.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+      - name: Resolve backend dependencies
+        run: ./gradlew :stirling-pdf:classes -PnoSpotless --no-daemon
+        env:
+          STIRLING_FLAVOR: saas
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

  build:
-    if: needs.files-changed.outputs.backend == 'true'
    needs: [files-changed, gradle-cache-prime]
    permissions:
      actions: read
@@ -106,10 +134,9 @@ jobs:
    uses: ./.github/workflows/frontend-validation.yml
    secrets: inherit

-  # Required (in all-checks-passed). Scans the stories a branch touches in both
-  # light and dark; an axe violation in either theme blocks the merge. The
-  # whole-suite sweep (nightly.yml) still covers stories a change affects without
-  # touching them directly.
+  # Advisory: deliberately NOT in all-checks-passed. It reports on the stories a
+  # branch touches so a regression is visible in review, but a browser scan is
+  # too new here to block merges on. Promote it once its pass/fail proves stable.
  frontend-a11y:
    if: needs.files-changed.outputs.frontend == 'true'
    needs: [files-changed]
@@ -141,12 +168,10 @@ jobs:
      contents: read
    uses: ./.github/workflows/build-enterprise.yml
    secrets: inherit
-    with:
-      use_shared_cache: true

  check-licence:
    if: needs.files-changed.outputs.build == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed, build, gradle-cache-prime]
    permissions:
      contents: read
    uses: ./.github/workflows/check-licence.yml
@@ -165,22 +190,8 @@ jobs:
      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}

  test-build-docker-images:
-    if: |
-      always() &&
-      github.event_name == 'pull_request' &&
-      needs.files-changed.outputs.project == 'true' &&
-      contains(fromJSON('["success", "skipped"]'), needs.gradle-cache-prime.result) &&
-      contains(fromJSON('["success", "skipped"]'), needs.build.result) &&
-      contains(fromJSON('["success", "skipped"]'), needs.check-generateOpenApiDocs.result) &&
-      contains(fromJSON('["success", "skipped"]'), needs.check-licence.result)
-    needs:
-      [
-        files-changed,
-        build,
-        check-generateOpenApiDocs,
-        check-licence,
-        gradle-cache-prime,
-      ]
+    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
+    needs: [files-changed, build, check-generateOpenApiDocs, check-licence, gradle-cache-prime]
    permissions:
      contents: read
      packages: read
@@ -192,7 +203,7 @@ jobs:

  tauri-build:
    if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
    permissions:
      contents: read
      pull-requests: write
@@ -206,7 +217,6 @@ jobs:
    with:
      platform: windows-macos
      sign: true
-      use_shared_cache: true

  ai-engine:
    if: needs.files-changed.outputs.engine == 'true'
@@ -230,8 +240,6 @@ jobs:
      pull-requests: write
    uses: ./.github/workflows/check-generated-models.yml
    secrets: inherit
-    with:
-      use_shared_cache: true

  pre-commit:
    needs: [files-changed]
@@ -278,12 +286,10 @@ jobs:
    if: always()
    needs:
      - files-changed
-      - gradle-cache-prime
      - build
      - db-migration-test
      - check-generateOpenApiDocs
      - frontend-validation
-      - frontend-a11y
      - playwright-e2e
      - playwright-e2e-live
      - playwright-e2e-enterprise
@@ -298,7 +304,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -306,12 +312,10 @@ jobs:
        env:
          RESULTS: |
            files-changed=${{ needs.files-changed.result }}
-            gradle-cache-prime=${{ needs.gradle-cache-prime.result }}
            build=${{ needs.build.result }}
            db-migration-test=${{ needs.db-migration-test.result }}
            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
            frontend-validation=${{ needs.frontend-validation.result }}
-            frontend-a11y=${{ needs.frontend-a11y.result }}
            playwright-e2e=${{ needs.playwright-e2e.result }}
            playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
            playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}
@@ -9,11 +9,6 @@ name: Check generated models
 # post-merge safety net.
 on:
  workflow_call:
-    inputs:
-      use_shared_cache:
-        required: false
-        type: boolean
-        default: false
  push:
    branches: [main]

@@ -28,7 +23,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -36,30 +31,13 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            engine/pyproject.toml
            engine/uv.lock
-
-      - name: Restore cache Gradle User Home
-        if: inputs.use_shared_cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
-      - name: Restore cache Gradle
-        if: inputs.use_shared_cache == false
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-generated-models-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          cache-suffix: generated-models

      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -67,6 +45,17 @@ jobs:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
@@ -75,7 +64,7 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Verify generated models are up to date
        id: models-check
@@ -10,35 +10,35 @@ permissions:

 jobs:
  check-licence:
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Check licenses for compatibility
        run: task backend:licenses:check
        env:
@@ -11,35 +11,35 @@ permissions:

 jobs:
  check-generate-openapi-docs:
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Generate OpenAPI documentation
        run: task backend:swagger
        env:
@@ -23,23 +23,29 @@ jobs:
    if: github.event_name == 'pull_request_target'
    runs-on: ubuntu-latest
    permissions:
-      contents: read # Checkout, and read translation files via the contents API
      issues: write # Allow posting comments on issues/PRs
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout main branch first
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Get PR data
        id: get-pr-data
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const prNumber = context.payload.pull_request.number;
            const repoOwner = context.payload.repository.owner.login;
@@ -60,18 +66,17 @@ jobs:
      - name: Fetch PR changed files
        id: fetch-pr-changes
        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
        run: |
          echo "Fetching PR changed files..."
          echo "Getting list of changed files from PR..."
          # Check if PR number exists
-          if [ -z "${PR_NUMBER}" ]; then
+          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
            echo "Error: PR number is empty"
            exit 1
          fi
          # Get changed files and filter for TOML translation files
-          gh pr view "${PR_NUMBER}" --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
@@ -83,37 +88,33 @@ jobs:
      - name: Determine reference file
        id: determine-file
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          # Untrusted, fork-controlled values are passed via env, never interpolated into the script
-          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
-          REPO_OWNER: ${{ steps.get-pr-data.outputs.repo_owner }}
-          REPO_NAME: ${{ steps.get-pr-data.outputs.repo_name }}
-          PR_REPO_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
-          PR_REPO_NAME: ${{ github.event.pull_request.head.repo.name }}
-          PR_BRANCH: ${{ steps.get-pr-data.outputs.branch }}
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const fs = require("fs");
            const path = require("path");

-            // Validate inputs before any use
-            const validateInput = (input, regex, name) => {
-              if (typeof input !== "string" || !regex.test(input)) {
-                throw new Error(`Invalid ${name}: ${input}`);
-              }
-              return input;
-            };
+            const prNumber = ${{ steps.get-pr-data.outputs.pr_number }};
+            const repoOwner = "${{ steps.get-pr-data.outputs.repo_owner }}";
+            const repoName = "${{ steps.get-pr-data.outputs.repo_name }}";

-            const repoOwner = validateInput(process.env.REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "repository owner");
-            const repoName = validateInput(process.env.REPO_NAME, /^[a-zA-Z0-9._-]+$/, "repository name");
-            const prRepoOwner = validateInput(process.env.PR_REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "PR repository owner");
-            const prRepoName = validateInput(process.env.PR_REPO_NAME, /^[a-zA-Z0-9._-]+$/, "PR repository name");
-            const branch = validateInput(process.env.PR_BRANCH, /^[a-zA-Z0-9._/-]+$/, "branch name");
-            const prNumber = Number(validateInput(process.env.PR_NUMBER, /^[0-9]+$/, "PR number"));
+            const prRepoOwner = "${{ github.event.pull_request.head.repo.owner.login }}";
+            const prRepoName = "${{ github.event.pull_request.head.repo.name }}";
+            const branch = "${{ steps.get-pr-data.outputs.branch }}";

            console.log(`Determining reference file for PR #${prNumber}`);

+            // Validate inputs
+            const validateInput = (input, regex, name) => {
+              if (!regex.test(input)) {
+                throw new Error(`Invalid ${name}: ${input}`);
+              }
+            };
+
+            validateInput(repoOwner, /^[a-zA-Z0-9_-]+$/, "repository owner");
+            validateInput(repoName, /^[a-zA-Z0-9._-]+$/, "repository name");
+            validateInput(branch, /^[a-zA-Z0-9._/-]+$/, "branch name");
+
            // Get the list of changed files in the PR
            const { data: files } = await github.rest.pulls.listFiles({
              owner: repoOwner,
@@ -125,7 +126,7 @@ jobs:
            const changedFiles = files
              .filter(file =>
                file.status !== "removed" &&
-                /^frontend\/editor\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
              )
              .map(file => file.filename);

@@ -195,7 +196,7 @@ jobs:
            core.exportVariable("REFERENCE_FILE", referenceFilePath);

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -208,12 +209,10 @@ jobs:

      - name: Run Python script to check files
        id: run-check
-        env:
-          PR_ACTOR: ${{ github.event.pull_request.user.login }}
        run: |
          echo "Running Python script to check TOML files..."
          uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py \
-            --actor "${PR_ACTOR}" \
+            --actor ${{ github.event.pull_request.user.login }} \
            --reference-file "${REFERENCE_FILE}" \
            --branch "pr-branch" \
            --files "${FILES_LIST[@]}" > result.txt
@@ -246,7 +245,7 @@ jobs:
        if: env.SCRIPT_OUTPUT != ''
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env;
            const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
@@ -262,7 +261,7 @@ jobs:
            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));

            // Only update or create comments by the action user
-            const expectedActor = "github-actions[bot]";
+            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";

            if (comment && comment.user.login === expectedActor) {
              // Update existing comment
@@ -34,28 +34,31 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -13,34 +13,34 @@ permissions:

 jobs:
  migration-test:
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: 25
          distribution: temurin

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      # Keep the normal formatting path here so this smoke test exercises the
      # same Gradle configuration as the backend build.
      - name: Build Stirling-PDF JAR
@@ -81,8 +81,3 @@ jobs:
          path: /tmp/stirling-migration-failed-*/app.log
          retention-days: 7
          if-no-files-found: warn
-
-      - name: Cleanup temporary files
-        if: always()
-        run: rm -rf /tmp/stirling-migration-failed-*
-        continue-on-error: true
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -0,0 +1,189 @@
+name: Auto V2 Deploy on Push
+
+on:
+  push:
+    branches:
+      - V2
+      - deploy-on-v2-commit
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-v2-on-push:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: deploy-v2-push-V2
+      cancel-in-progress: true
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Get commit hashes for frontend and backend
+        id: commit-hashes
+        run: |
+          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
+          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$FRONTEND_HASH" ]; then
+            FRONTEND_HASH="no-frontend-changes"
+          fi
+
+          # Get last commit that touched backend code, docker/backend, or docker/compose
+          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$BACKEND_HASH" ]; then
+            BACKEND_HASH="no-backend-changes"
+          fi
+
+          echo "Frontend hash: $FRONTEND_HASH"
+          echo "Backend hash: $BACKEND_HASH"
+
+          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
+          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
+
+          # Short hashes for tags
+          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
+            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
+          else
+            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
+          fi
+
+          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
+            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
+          else
+            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check if frontend image exists
+        id: check-frontend
+        run: |
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Frontend image already exists, skipping build"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Frontend image needs to be built"
+          fi
+
+      - name: Check if backend image exists
+        id: check-backend
+        run: |
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Backend image already exists, skipping build"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Backend image needs to be built"
+          fi
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Build and push frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./docker/frontend/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-v2-frontend
+          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
+          tags: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push backend image
+        if: steps.check-backend.outputs.exists == 'false'
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./docker/backend/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-v2-backend
+          cache-to: type=gha,mode=max,scope=stirling-v2-backend
+          tags: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          chmod 600 ../private.key
+
+      - name: Deploy to VPS on port 3000
+        run: |
+          export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
+
+          cat > $UNIQUE_NAME << EOF
+          version: '3.3'
+          services:
+            backend:
+              container_name: stirling-v2-backend
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+              ports:
+                - "13000:8080"
+              volumes:
+                - /stirling/V2/data:/usr/share/tessdata:rw
+                - /stirling/V2/config:/configs:rw
+                - /stirling/V2/logs:/logs:rw
+              environment:
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
+                SYSTEM_DEFAULTLOCALE: en-US
+                UI_APPNAME: "Stirling-PDF V2"
+                UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
+                UI_APPNAMENAVBAR: "V2 Deployment"
+                SYSTEM_MAXFILESIZE: "100"
+                METRICS_ENABLED: "true"
+                SYSTEM_GOOGLEVISIBILITY: "false"
+                SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
+                baseUrl: "https://demo.stirlingpdf.cloud"
+              restart: on-failure:5
+
+            frontend:
+              container_name: stirling-v2-frontend
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+              ports:
+                - "3000:80"
+              environment:
+                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
+              depends_on:
+                - backend
+              restart: on-failure:5
+          EOF
+
+          # Copy to remote with unique name
+          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
+
+          # SSH and rename/move atomically to avoid interference
+          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+            mkdir -p /stirling/V2/{data,config,logs}
+            mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
+            cd /stirling/V2
+            docker-compose down || true
+            docker-compose pull
+            docker-compose up -d
+            docker system prune -af --volumes || true
+            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
+          ENDSSH
+
+      - name: Cleanup temporary files
+        if: always()
+        run: |
+          rm -f ../private.key
@@ -17,9 +17,6 @@ permissions:

 jobs:
  docker-compose-tests:
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    permissions:
      actions: write
@@ -28,27 +25,30 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      # When the PR changes the base image, test.sh builds it locally
      # (stirling-pdf-base:local) into the daemon image store. A buildx
      # container builder can't see that store, so skip it here and let
@@ -57,7 +57,7 @@ jobs:
      # runtime token isn't exposed) since the docker driver can't use it.
      - name: Set up Docker Buildx
        if: inputs.docker-base-changed != 'true'
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
      - name: Expose GitHub runtime for Buildx cache
@@ -66,11 +66,11 @@ jobs:

      - name: Install Docker Compose
        run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v5.4.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
          sudo chmod +x /usr/local/bin/docker-compose

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -11,33 +11,48 @@ permissions:

 jobs:
  playwright-e2e-live:
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"
-
+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+      # Gradle does not retry 429s, and a cold cache resolving the buildscript
+      # classpath is exactly where Maven Central rate-limits us. Retry it here,
+      # where a failure is cheap, instead of inside the backgrounded bootRun.
+      - name: Prime Gradle dependencies
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+        run: |
+          for attempt in 1 2 3; do
+            if ./gradlew --quiet -PnoSpotless :stirling-pdf:classes; then
+              exit 0
+            fi
+            echo "::warning::Gradle dependency resolution failed (attempt $attempt of 3)"
+            sleep $((attempt * 30))
+          done
+          echo "::error::Gradle could not resolve dependencies after 3 attempts"
+          exit 1
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
@@ -45,7 +60,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (production bundle for vite preview)
@@ -106,7 +121,7 @@ jobs:
          fi
      - name: Install uv
        if: always()
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -14,11 +14,6 @@ jobs:
  playwright-e2e:
    name: playwright-e2e (${{ matrix.browser }})
    runs-on: ubuntu-latest
-    # The image already contains the Playwright browsers and all Linux
-    # dependencies. This keeps the matrix for per-browser reporting while
-    # avoiding three concurrent `playwright install --with-deps` runs.
-    container:
-      image: mcr.microsoft.com/playwright:v1.58.2-noble@sha256:6446946a1d9fd62d9ae501312a2d76a43ee688542b21622056a372959b65d63d
    strategy:
      # One browser breaking must not mask a failure in another - report all.
      fail-fast: false
@@ -32,7 +27,7 @@ jobs:
            project: stubbed-webkit
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -44,24 +39,16 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+      - name: Install Playwright (${{ matrix.browser }})
+        run: task e2e:install -- ${{ matrix.browser }}
      - name: Build frontend (production bundle for vite preview)
        env:
          VITE_BUILD_FOR_PREVIEW: "1"
        run: task frontend:build
      - name: Run stubbed E2E tests (${{ matrix.browser }})
        env:
-          # The official Playwright image expects its browser runtime under
-          # the root home directory. Keep this scoped to Playwright and use a
-          # neutral Docker config path so Docker does not read /root/.docker.
-          HOME: /root
-          DOCKER_CONFIG: /tmp/playwright-docker-config
          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-          NPM_CONFIG_PREFER_OFFLINE: "true"
-          NPM_CONFIG_FETCH_RETRIES: "5"
-          NPM_CONFIG_FETCH_RETRY_FACTOR: "2"
-          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: "1000"
-          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: "120000"
        run: task e2e:stubbed-project PROJECT=${{ matrix.project }} -- --workers=3
      - name: Flag flaky tests
        # Runs regardless of the test outcome: a flaky test (passed on retry)
@@ -3,12 +3,17 @@ name: Frontend a11y regression gate
 # Reusable workflow called from build.yml when frontend sources change.
 #
 # Scans the stories this branch touches in real Chromium and runs axe against
-# each; the check fails on any axe violation, or on a story that fails to render
-# at all.
+# each. Existing violations are grandfathered in .storybook/a11y-baseline.json;
+# the check fails on a NEW violation — a story breaking a rule it wasn't already
+# breaking — or on a story that fails to render at all.
 #
 # Only changed stories, because a full sweep is ~30 minutes: far too slow to sit
 # in front of every merge. The whole suite is scanned nightly instead
 # (nightly.yml), which catches anything a branch didn't touch.
+#
+# Advisory for now: this is not in build.yml's all-checks-passed list, so a
+# failure reports without blocking. Promote it once a few weeks of runs show the
+# pass/fail is stable.
 on:
  workflow_call:

@@ -21,7 +26,7 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -36,7 +41,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: a11y gate (changed stories)
        run: task frontend:storybook:a11y:changed -- origin/${{ github.base_ref || 'main' }}
      - name: Upload scan reports
@@ -28,7 +28,7 @@ jobs:
      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -36,16 +36,12 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for file changes
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: changes
        with:
          filters: .github/config/.files.yaml

  generate-frontend-license-report:
-    # ci-bot, not bot-identity: this job runs on PRs too, and bot-identity is main-only.
-    environment:
-      name: ci-bot
-      deployment: false
    if: needs.files-changed.outputs.licenses-frontend == 'true'
    name: Generate Frontend License Report
    needs: files-changed
@@ -56,7 +52,7 @@ jobs:
      repository-projects: write # Required for enabling automerge
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -97,7 +93,7 @@ jobs:
        run: npm ci --ignore-scripts --audit=false --fund=false

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Generate frontend license report (Push only)
        if: github.event_name == 'push'
@@ -320,10 +316,6 @@ jobs:
          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

  generate-backend-license-report:
-    # ci-bot, not bot-identity: this job runs on PRs too, and bot-identity is main-only.
-    environment:
-      name: ci-bot
-      deployment: false
    if: needs.files-changed.outputs.licenses-backend == 'true'
    needs: files-changed
    name: Generate Backend License Report
@@ -334,7 +326,7 @@ jobs:
      repository-projects: write # Required for enabling automerge
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -352,22 +344,25 @@ jobs:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-license-report-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Check licenses and generate report
        id: license-check
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -27,7 +27,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Quality-check frontend
        id: frontend-check
        run: task frontend:check:all
@@ -107,7 +107,7 @@ jobs:
            }
      - name: Install uv
        if: always()
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -1,66 +0,0 @@
-name: Prime Gradle Cache
-
-on:
-  workflow_call:
-  push:
-    branches: ["main"]
-
-permissions:
-  contents: read
-
-jobs:
-  gradle-cache-prime:
-    environment:
-      name: ci-unsigned
-      deployment: false
-    name: Prime shared Gradle cache
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Calculate Gradle cache key
-        id: gradle-cache-key
-        shell: bash
-        run: |
-          echo "key=gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}" >> "$GITHUB_OUTPUT"
-
-      - name: Cache Gradle (lookup-only)
-        id: cache-gradle-restore
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ steps.gradle-cache-key.outputs.key }}
-          lookup-only: true
-
-      - name: Set up JDK 25
-        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Resolve backend dependencies
-        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
-        run: ./gradlew :stirling-pdf:classes --no-daemon
-        env:
-          STIRLING_FLAVOR: saas
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Save cache Gradle User Home
-        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ steps.gradle-cache-key.outputs.key }}
@@ -15,7 +15,7 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -38,9 +38,6 @@ permissions:

 jobs:
  determine-matrix:
-    environment:
-      name: ci-unsigned
-      deployment: false
    if: ${{ vars.CI_PROFILE != 'lite' }}
    runs-on: ubuntu-latest
    outputs:
@@ -48,28 +45,31 @@ jobs:
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Get version number
        id: versionNumber
        run: |
@@ -93,7 +93,7 @@ jobs:
          ALL="$WINDOWS,$WINDOWS_ARM64,$MACOS,$LINUX"

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${INPUT_PLATFORM}" in
+            case "${{ github.event.inputs.platform }}" in
              "windows")
                echo "matrix={\"include\":[$WINDOWS,$WINDOWS_ARM64]}" >> $GITHUB_OUTPUT
                ;;
@@ -115,12 +115,7 @@ jobs:
            echo "matrix={\"include\":[$ALL]}" >> $GITHUB_OUTPUT
          fi

-        env:
-          INPUT_PLATFORM: ${{ github.event.inputs.platform }}
  build-jars:
-    environment:
-      name: ci-unsigned
-      deployment: false
    needs: determine-matrix
    runs-on: ubuntu-latest
    strategy:
@@ -140,26 +135,29 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Setup Node.js
        if: matrix.variant.build_frontend == true
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -169,7 +167,7 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Build JAR
        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
@@ -196,7 +194,6 @@ jobs:
          retention-days: 1

  build:
-    environment: release-signing
    needs: determine-matrix
    strategy:
      fail-fast: false
@@ -204,10 +201,11 @@ jobs:
    runs-on: ${{ matrix.platform }}
    env:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
          allowed-endpoints: >
@@ -236,14 +234,6 @@ jobs:
          toolchain: stable
          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      # x86_64 JDK is set up first so the aarch64 step below can leave its
      # JAVA_HOME as the active one. The macOS universal JRE build needs
      # jmods from both arches; the x64 path is captured into the env
@@ -267,8 +257,19 @@ jobs:
          java-version: "25"
          distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      # Build the universal JRE before desktop:prepare so the jlink:runtime
      # task short-circuits on its `test -d runtime/jre` status check.
@@ -291,7 +292,7 @@ jobs:
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -301,22 +302,22 @@ jobs:
          SM_HOST: ${{ secrets.SM_HOST }}

      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
          Write-Host "Setting up DigiCert KeyLocker environment..."

          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("$env:SM_CLIENT_CERT_FILE_B64")
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
          $certPath = "D:\Certificate_pkcs12.p12"
          [IO.File]::WriteAllBytes($certPath, $certBytes)

          # Set environment variables
          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=$env:SM_HOST" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=$env:SM_API_KEY" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=$env:SM_KEYPAIR_ALIAS" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV

          # Get PKCS11 config path from DigiCert action
          $pkcs11Config = $env:PKCS11_CONFIG
@@ -334,14 +335,40 @@ jobs:
            }
          }

+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY == '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        env:
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -362,7 +389,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -378,7 +405,7 @@ jobs:
      # Without this, signCommand failures are opaque (Tauri captures but drops
      # smctl's stderr) - running these loudly surfaces auth/env/keypair issues.
      - name: Preflight smctl
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -409,7 +436,7 @@ jobs:
      # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
      # from env (set by prior DigiCert setup step). No --config-file needed.
      - name: Configure Windows code signing
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        shell: bash
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -430,7 +457,7 @@ jobs:
          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json

      - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        run: |
          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
          gpg --list-secret-keys --keyid-format=long
@@ -462,8 +489,8 @@ jobs:
          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or the release branch, when secret is present.
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')) && '1' || '0' }}
+          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or V2-master, when secret is present.
+          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -489,7 +516,7 @@ jobs:
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          GPG_SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')) && '1' || '0' }}
+          GPG_SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
        run: |
@@ -528,7 +555,7 @@ jobs:
          echo "Stripped bundled libwayland from $(basename "$AI")"

      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        env:
          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
        run: |
@@ -543,7 +570,7 @@ jobs:
      # artifact. Tauri signs a COPY when bundling into the MSI and leaves the raw
      # cargo output unsigned, so checking it produces false negatives.
      - name: Verify Windows Code Signature
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        timeout-minutes: 15
        shell: pwsh
        run: |
@@ -697,17 +724,6 @@ jobs:
          path: ./dist/*
          retention-days: 1

-      - name: Cleanup temporary files
-        if: always()
-        shell: bash
-        run: |
-          rm -f certificate.p12
-          rm -rf "$RUNNER_TEMP/msi-verify"
-          if [ "${{ matrix.platform }}" = "macos-15" ]; then
-            security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" 2>/dev/null || true
-          fi
-        continue-on-error: true
-
  collect-and-release:
    needs: [determine-matrix, build, build-jars]
    runs-on: ubuntu-latest
@@ -715,7 +731,7 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -863,7 +879,7 @@ jobs:
          PYEOF

      - name: Upload merged artifacts for review
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: release-artifacts
          path: ./artifacts/
@@ -872,7 +888,7 @@ jobs:
      # Gate publish on valid updater sigs. Runs after the review upload (so
      # artifacts survive for debugging) and before action-gh-release.
      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -886,11 +902,11 @@ jobs:
      # workflow_dispatch path requires platform=='all' so a single-platform
      # dispatch can't overwrite an existing release's full latest.json with a
      # partial one (action-gh-release defaults overwrite_files:true).
-      # release event / release branch always build the full matrix so no extra guard needed.
+      # release / V2-master always build the full matrix so no extra guard needed.
      # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
      # instead of silently shipping a broken auto-update.
      - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/release'
+        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
@@ -4,11 +4,6 @@ on:
  schedule:
    - cron: "0 2 * * *" # 2 AM UTC every night
  workflow_dispatch:
-  pull_request:
-    paths:
-      - .github/workflows/nightly.yml
-      - testing/cucumber/**
-      - docker/embedded/compose/test_cicd.yml

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -23,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -38,7 +33,7 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Install all Playwright browsers
        run: task e2e:install

@@ -64,17 +59,13 @@ jobs:
  # the story itself — a shared component, a theme token — still surfaces within
  # a day.
  a11y-all-stories:
-    name: a11y (every story)
-    strategy:
-      fail-fast: false
-      matrix:
-        theme: [light, dark]
+    name: a11y (every story, light + dark)
    runs-on: ubuntu-latest
-    # One full sweep (~30 minutes of browser time).
-    timeout-minutes: 60
+    # Two full sweeps (one per theme), each ~30 minutes of browser time.
+    timeout-minutes: 120
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -89,16 +80,16 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

-      - name: a11y gate (every story, ${{ matrix.theme }})
-        run: task frontend:storybook:a11y:${{ matrix.theme }}
+      - name: a11y gate (every story, light + dark)
+        run: task frontend:storybook:a11y

      - name: Upload scan reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: a11y-scan-nightly-${{ matrix.theme }}-${{ github.run_id }}
+          name: a11y-scan-nightly-${{ github.run_id }}
          path: frontend/.a11y-scan/
          retention-days: 14
          if-no-files-found: ignore
@@ -108,13 +99,8 @@ jobs:

  # Builds all desktop platforms on a schedule so the Rust dependency cache is
  # written on main, where PR and merge-queue tauri builds can restore it.
-  #
-  # The only job here still pinned to schedule/main: it primes a cache rather than
-  # testing anything, and Actions scopes a cache written on a PR branch to that PR
-  # alone, so a PR run costs three platform builds and produces nothing reusable.
  warm-tauri-cache:
    name: Warm Tauri Rust cache
-    if: github.event_name == 'schedule' || github.ref == 'refs/heads/main'
    permissions:
      contents: read
      pull-requests: write
@@ -123,75 +109,3 @@ jobs:
      platform: all
      sign: false
    secrets: inherit
-
-  # Runs the @nightly tag (conversion scenarios) plus a 10-shard concurrency run
-  # of every other feature.
-  cucumber-nightly:
-    environment:
-      name: ci-unsigned
-      deployment: false
-    name: Cucumber (nightly scenarios + full concurrency)
-    runs-on: ubuntu-latest
-    # Fork pull requests get no MAVEN_* secrets, so the image build cannot work.
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: read
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
-
-      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
-
-      - name: Start the fat image with login and storage enabled
-        run: docker compose -f docker/embedded/compose/test_cicd.yml up -d --build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Wait for the server
-        # Throwaway key from test_cicd.yml; out of the header literal for gitleaks.
-        env:
-          TEST_API_KEY: "123456789"
-        run: |
-          curl --retry 90 --retry-delay 3 --retry-connrefused --retry-all-errors \
-            -sf -H "X-API-KEY: $TEST_API_KEY" http://localhost:8080/api/v1/info/status
-
-      # Heavy LibreOffice/Calibre/Ghostscript conversions, excluded from the PR run.
-      # Both tasks install the behave deps themselves, so there is no separate uv sync step.
-      - name: Run @nightly scenarios
-        run: task cucumber:nightly
-
-      # Genuinely different payloads contending on one backend.
-      - name: Sharded concurrency validation
-        run: task cucumber:parallel SHARDS=10
-
-      - name: Container logs on failure
-        if: failure()
-        run: docker compose -f docker/embedded/compose/test_cicd.yml logs --tail 400
-
-      - name: Tear down
-        if: always()
-        run: docker compose -f docker/embedded/compose/test_cicd.yml down -v
@@ -28,7 +28,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -73,14 +73,13 @@ jobs:
          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"

  update-homebrew-and-scoop:
-    environment: package-publish
    needs: get-release-info
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -27,22 +27,29 @@ jobs:
    name: Label conflicted PRs
    runs-on: ubuntu-latest
    permissions:
-      contents: read # actions/checkout
-      issues: write # get/create the repo-level conflict label
-      pull-requests: write # pulls.get/list plus add/remove the label on PRs
+      contents: read
+      issues: write
+      pull-requests: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Check out the repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Set up stirling-bot token
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Apply conflict label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
          script: |
            const conflictLabel = process.env.CONFLICT_LABEL;
            const owner = context.repo.owner;
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -25,20 +25,16 @@ jobs:
          persist-credentials: false

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            engine/pyproject.toml
            engine/uv.lock
+          cache-suffix: pre-commit

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Run pre-commit checks
        run: task pre-commit
-
-      # The fixture corpus checks the comment rules themselves, so it runs here
-      # rather than on every local commit.
-      - name: Check the comment-lint fixture corpus
-        run: task pre-commit:comment-lint:selftest
@@ -17,9 +17,6 @@ permissions:

 jobs:
  push-base:
-    # Own environment: docker-publish is branch-locked to release/main,
-    # which excludes the baseDockerImage/accessIssueFix branches this runs on.
-    environment: docker-base-publish
    if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
    runs-on: ubuntu-24.04-8core
    permissions:
@@ -35,11 +32,9 @@ jobs:

      - name: Set version
        id: version
-        env:
-          INPUT_VERSION: ${{ github.event.inputs.version }}
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${INPUT_VERSION}"
+            VERSION="${{ github.event.inputs.version }}"
          elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
            VERSION="1.0.3"
          else
@@ -48,7 +43,7 @@ jobs:
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -69,7 +64,7 @@ jobs:

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
@@ -18,20 +18,12 @@ on:
        required: false
        type: boolean
        default: false
-      build_engine:
-        description: "Build & push the standalone stirling-engine image."
-        required: false
-        type: boolean
-        default: true
-      force_engine_rebuild:
-        description: "Rebuild stirling-engine even if its source hash is unchanged."
-        required: false
-        type: boolean
-        default: false
  push:
    branches:
-      - release
+      - master
      - main
+      - V2-master
+      - testMain

 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -50,7 +42,6 @@ permissions:

 jobs:
  push:
-    environment: docker-publish
    if: ${{ vars.CI_PROFILE != 'lite' }}
    runs-on: ubuntu-24.04-8core
    permissions:
@@ -60,35 +51,37 @@ jobs:
    env:
      RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
-      RUN_ENGINE: ${{ github.event_name != 'workflow_dispatch' || inputs.build_engine }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-push-docker-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -98,13 +91,13 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

      - name: Install cosign
-        if: github.ref == 'refs/heads/release'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"

      - name: Install cosign
-        if: github.ref == 'refs/heads/release'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"
@@ -140,8 +133,8 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/release' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}

      - name: Build and push Unified Dockerfile (latest variant)
        id: build-push-latest
@@ -165,7 +158,7 @@ jobs:
          sbom: true

      - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-latest.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
        env:
          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
@@ -189,8 +182,8 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/release' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}

      - name: Build and push Unified Dockerfile (fat variant)
        id: build-push-fat
@@ -211,7 +204,7 @@ jobs:
          sbom: true

      - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-fat.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
        env:
          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
          TAGS: ${{ steps.meta-fat.outputs.tags }}
@@ -233,8 +226,8 @@ jobs:
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/release' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}

      - name: Build and push Unified Dockerfile (ultra-lite variant)
        id: build-push-lite
@@ -255,7 +248,7 @@ jobs:
          sbom: true

      - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-lite.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
        env:
          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
          TAGS: ${{ steps.meta-lite.outputs.tags }}
@@ -267,7 +260,7 @@ jobs:
          done

      # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. release: publish <version>+latest
+      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
      # only when the version is new. main/testMain: republish :alpha only
      # when the source hash differs from the published image's annotation.
      - name: Read unoserver image version
@@ -326,7 +319,7 @@ jobs:
          fi

          case "$EFFECTIVE_REF" in
-            refs/heads/release)
+            refs/heads/master|refs/heads/V2-master)
              if [ "${FORCE_REBUILD}" = "true" ]; then
                echo "force_unoserver_rebuild=true — building stable regardless"
                mode="stable"
@@ -398,119 +391,3 @@ jobs:
          else
            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
          fi
-
-      # Standalone AI engine image, same shape as the unoserver image above.
-      - name: Compute engine image source hash
-        id: engineHash
-        if: env.RUN_ENGINE == 'true'
-        run: |
-          set -eu
-          hash=$( { cat engine/Dockerfile engine/pyproject.toml engine/uv.lock engine/.env; \
-                    find engine/src -type f -print0 | sort -z | xargs -0 cat; } \
-                  | sha256sum | cut -d' ' -f1)
-          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
-          echo "Engine source hash: ${hash}"
-
-      - name: Decide whether to publish engine image
-        id: engineDecision
-        if: env.RUN_ENGINE == 'true'
-        env:
-          ENGINE_VERSION: ${{ steps.versionNumber.outputs.versionNumber }}
-          ENGINE_HASH: ${{ steps.engineHash.outputs.hash }}
-          ENGINE_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-engine
-          ENGINE_HASH_ANNOTATION: org.stirlingpdf.engine-source-hash
-          FORCE_REBUILD: ${{ inputs.force_engine_rebuild }}
-          GH_REF: ${{ github.ref }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -eu
-          mode="skip"
-          tags=""
-
-          read_published_hash() {
-            local ref="$1"
-            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
-              | jq -r --arg key "$ENGINE_HASH_ANNOTATION" \
-                  '.annotations[$key] // empty' \
-              2>/dev/null || true
-          }
-
-          # Manual dispatch from any branch routes to the :alpha publish path.
-          EFFECTIVE_REF="$GH_REF"
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            EFFECTIVE_REF="refs/heads/testMain"
-          fi
-
-          case "$EFFECTIVE_REF" in
-            refs/heads/release)
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_engine_rebuild=true — building stable regardless"
-                mode="stable"
-                tags="${ENGINE_IMAGE}:${ENGINE_VERSION},${ENGINE_IMAGE}:latest"
-              elif docker manifest inspect "${ENGINE_IMAGE}:${ENGINE_VERSION}" >/dev/null 2>&1; then
-                echo "stirling-engine:${ENGINE_VERSION} already on GHCR — skipping"
-              else
-                echo "stirling-engine:${ENGINE_VERSION} is new — will publish"
-                mode="stable"
-                tags="${ENGINE_IMAGE}:${ENGINE_VERSION},${ENGINE_IMAGE}:latest"
-              fi
-              ;;
-            refs/heads/main|refs/heads/testMain)
-              published_hash=$(read_published_hash "${ENGINE_IMAGE}:alpha")
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_engine_rebuild=true — rebuilding :alpha regardless"
-                mode="alpha"
-                tags="${ENGINE_IMAGE}:alpha"
-              elif [ -n "$published_hash" ] && [ "$published_hash" = "$ENGINE_HASH" ]; then
-                echo "Published :alpha source hash matches (${published_hash}) — skipping"
-              else
-                if [ -z "$published_hash" ]; then
-                  echo ":alpha has no source-hash annotation (first publish) — will publish"
-                else
-                  echo "Source hash changed (was ${published_hash}, now ${ENGINE_HASH}) — will publish"
-                fi
-                mode="alpha"
-                tags="${ENGINE_IMAGE}:alpha"
-              fi
-              ;;
-            *)
-              echo "Branch ${GH_REF} does not publish engine image"
-              ;;
-          esac
-          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
-          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push engine image
-        id: build-push-engine
-        if: env.RUN_ENGINE == 'true' && steps.engineDecision.outputs.mode != 'skip'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-engine
-          cache-to: type=gha,mode=max,scope=stirling-engine
-          tags: ${{ steps.engineDecision.outputs.tags }}
-          # Manifest annotation read by the decision step above to detect drift.
-          annotations: |
-            index:org.stirlingpdf.engine-source-hash=${{ steps.engineHash.outputs.hash }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign engine image
-        if: env.RUN_ENGINE == 'true' && steps.engineDecision.outputs.mode == 'stable'
-        env:
-          DIGEST: ${{ steps.build-push-engine.outputs.digest }}
-          TAGS: ${{ steps.engineDecision.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping engine image signing"
-          fi
@@ -13,13 +13,12 @@ permissions:

 jobs:
  rollback:
-    environment: docker-publish
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -35,7 +35,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -17,12 +17,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: 30 days stale issues
-        uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-stale: 30
@@ -4,7 +4,7 @@ on:
  workflow_dispatch:
  push:
    branches:
-      - release
+      - master

 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -23,33 +23,33 @@ permissions:

 jobs:
  push:
-    # package-publish holds SWAGGERHUB_API_KEY. It requires reviewer approval and
-    # is limited to main / release / v* tags, so every push to release waits on one.
-    environment: package-publish
    if: ${{ vars.CI_PROFILE != 'lite' }}
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-swagger-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Generate Swagger documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs

@@ -63,7 +63,7 @@ jobs:
          SWAGGERHUB_USER: "Frooodle"

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -24,7 +24,6 @@ permissions:

 jobs:
  sync:
-    environment: bot-identity
    name: Sync docs manifest
    runs-on: ubuntu-latest
    timeout-minutes: 10
@@ -33,7 +32,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -33,11 +33,10 @@ permissions:

 jobs:
  sync-files:
-    environment: bot-identity
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -53,19 +52,20 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            engine/pyproject.toml
            engine/uv.lock
+          cache-suffix: sync-files

      - name: Install Python dependencies
        run: |
          uv sync --project engine --locked --group tools

      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Sync translation TOML files
        run: |
@@ -26,10 +26,6 @@ on:
        required: false
        type: boolean
        default: false
-      use_shared_cache:
-        required: false
-        type: boolean
-        default: false
  workflow_dispatch:
    inputs:
      platform:
@@ -61,18 +57,13 @@ permissions:

 jobs:
  determine-matrix:
-    # Only probes APPLE_CERTIFICATE for presence, so it stays on the unrestricted
-    # signing environment - release-signing would block every PR run.
-    environment:
-      name: ci-signing
-      deployment: false
    if: ${{ vars.CI_PROFILE != 'lite' }}
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -112,12 +103,6 @@ jobs:
          echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT

  build:
-    # Windows/GPG signing only runs on main (see the per-step gates below), so only
-    # that path needs the reviewer-gated release-signing environment. Everything else
-    # (PRs, merge queue, nightly) signs macOS only and uses ci-signing, which has no
-    # approval or branch restriction.
-    environment:
-      name: ${{ (inputs.sign && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))) && 'release-signing' || 'ci-signing' }}
    needs: determine-matrix
    strategy:
      fail-fast: false
@@ -125,6 +110,7 @@ jobs:
    runs-on: ${{ matrix.platform }}
    env:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
      # Per-platform sign gate. macOS signs on any run with the cert available,
@@ -134,7 +120,7 @@ jobs:
      SIGN_BUNDLE: ${{ inputs.sign && (matrix.platform == 'macos-15' && secrets.APPLE_CERTIFICATE != '' || github.ref == 'refs/heads/main') }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -164,7 +150,7 @@ jobs:
      # only recompiles the app crate. Written on main; PRs and the merge queue
      # restore from it.
      - name: Cache Rust build
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: frontend/editor/src-tauri
          # Stable key shared across workflows so the nightly warmer.
@@ -174,24 +160,6 @@ jobs:
          # Save the dependency cache even if a later step fails
          cache-on-failure: true

-      - name: Restore cache Gradle User Home
-        if: inputs.use_shared_cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
-      - name: Restore cache Gradle
-        if: inputs.use_shared_cache == false
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-build-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up x86_64 JDK 25 (macOS universal JRE)
        if: matrix.platform == 'macos-15'
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -211,8 +179,19 @@ jobs:
          java-version: "25"
          distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Setup Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Build universal macOS JRE
        if: matrix.platform == 'macos-15'
@@ -248,26 +227,20 @@ jobs:
      - name: Setup DigiCert KeyLocker Certificate
        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
        shell: pwsh
-        env:
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
          Write-Host "Setting up DigiCert KeyLocker environment..."

          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("$env:SM_CLIENT_CERT_FILE_B64")
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
          $certPath = "D:\Certificate_pkcs12.p12"
          [IO.File]::WriteAllBytes($certPath, $certBytes)

          # Set environment variables
          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=$env:SM_HOST" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=$env:SM_API_KEY" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=$env:SM_KEYPAIR_ALIAS" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV

          # Get PKCS11 config path from DigiCert action
          $pkcs11Config = $env:PKCS11_CONFIG
@@ -285,6 +258,38 @@ jobs:
            }
          }

+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
      - name: Import Apple Developer Certificate
        if: env.SIGN_BUNDLE == 'true' && matrix.platform == 'macos-15'
        env:
@@ -677,17 +682,6 @@ jobs:
            fi
          done

-      - name: Cleanup temporary files
-        if: always()
-        shell: bash
-        run: |
-          rm -f certificate.p12
-          rm -rf "$RUNNER_TEMP/msi-verify"
-          if [ "${{ matrix.platform }}" = "macos-15" ]; then
-            security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" 2>/dev/null || true
-          fi
-        continue-on-error: true
-
  pr-comment:
    needs: build
    runs-on: ubuntu-latest
@@ -703,7 +697,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -795,7 +789,7 @@ jobs:
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -22,45 +22,21 @@ permissions:
  contents: read

 jobs:
-  # A changed base image is shared by all three embedded-image builds. Build
-  # it once and transfer it as an artifact; the matrix jobs use the local
-  # Docker driver so the loaded image is visible to the build.
-  prepare-base-image:
-    if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-    environment:
-      name: ci-unsigned
-      deployment: false
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Build base image locally
-        run: docker build --platform linux/amd64 -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Export base image
-        run: docker save stirling-pdf-base:pr-test | gzip -1 > stirling-pdf-base-pr-test.tar.gz
-
-      - name: Upload base image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docker-base-pr-test
-          path: stirling-pdf-base-pr-test.tar.gz
-          retention-days: 1
-          if-no-files-found: error
-
+  # TODO: extract a pre-matrix `prepare` job that runs once and produces
+  # shared artifacts for the three matrix entries below to consume:
+  #   1. `task backend:build` — currently runs 3× in parallel with
+  #      identical env (DISABLE_ADDITIONAL_FEATURES=true,
+  #      STIRLING_PDF_DESKTOP_UI=false). Build once, upload the JAR as an
+  #      artifact, matrix entries download.
+  #   2. The base-image `docker build` (gated on docker-base-changed) —
+  #      currently runs 3× in parallel against the same Dockerfile and
+  #      context. Build once, `docker save` to an artifact, matrix entries
+  #      `docker load` before the embedded build.
+  # Saves ~2 full backend builds + 2 base-image builds per PR that touches
+  # docker. May also be reusable from backend-build.yml's jdk-25 +
+  # spring-security=true matrix entry if `task backend:build` and
+  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
  test-build-docker-images:
-    if: always() && (needs.prepare-base-image.result == 'success' || needs.prepare-base-image.result == 'skipped')
-    needs: [prepare-base-image]
-    environment:
-      name: ci-unsigned
-      deployment: false
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
@@ -77,7 +53,7 @@ jobs:
            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -102,32 +78,25 @@ jobs:
          docker system prune -af || true
          echo "Disk space after cleanup:" && df -h

-      - name: Download prepared base image
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: docker-base-pr-test
-
-      - name: Load prepared base image
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: gzip -dc stirling-pdf-base-pr-test.tar.gz | docker load
-
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
      - name: Set up JDK 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25"
          distribution: "temurin"

+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
      - name: Install Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
      - name: Build application
        run: task backend:build
        env:
@@ -142,7 +111,12 @@ jobs:

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build base image locally (PR base change only)
+        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
+        run: |
+          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base

      - name: Set base image and platform for this build
        id: build-params
@@ -217,7 +191,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

@@ -229,7 +203,7 @@ jobs:

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Build docker/unoserver/Dockerfile
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -0,0 +1,213 @@
+name: UI test with TestDriverAI
+
+on:
+  push:
+    branches: ["master", "UITest", "testdriver"]
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle User Home
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
+            gradle-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Build with Gradle
+        run: ./gradlew build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Build and push test image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64
+
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          sudo chmod 600 ../private.key
+
+      - name: Deploy to VPS
+        run: |
+          cat > docker-compose.yml << EOF
+          version: '3.3'
+          services:
+            stirling-pdf:
+              container_name: stirling-pdf-test-${{ github.sha }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
+              ports:
+                - "1337:8080"
+              volumes:
+                - /stirling/test-${{ github.sha }}/data:/usr/share/tessdata:rw
+                - /stirling/test-${{ github.sha }}/config:/configs:rw
+                - /stirling/test-${{ github.sha }}/logs:/logs:rw
+              environment:
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
+                SYSTEM_DEFAULTLOCALE: en-US
+                UI_APPNAME: "Stirling-PDF Test"
+                UI_HOMEDESCRIPTION: "Test Deployment"
+                UI_APPNAMENAVBAR: "Test"
+                SYSTEM_MAXFILESIZE: "100"
+                METRICS_ENABLED: "true"
+                SYSTEM_GOOGLEVISIBILITY: "false"
+                SYSTEM_ENABLEANALYTICS: "false"
+              restart: on-failure:5
+          EOF
+
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+            mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
+            mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
+            cd /stirling/test-${{ github.sha }}
+            docker-compose pull
+            docker-compose up -d
+          EOF
+
+  files-changed:
+    if: always()
+    name: detect what files changed
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    outputs:
+      frontend: ${{ steps.changes.outputs.frontend }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check for file changes
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        id: changes
+        with:
+          filters: ".github/config/.files.yaml"
+
+  test:
+    if: needs.files-changed.outputs.frontend == 'true'
+    needs: [deploy, files-changed]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Run TestDriver.ai
+        uses: testdriverai/action@f0d0f45fdd684db628baa843fe9313f3ca3a8aa8 #1.1.3
+        with:
+          key: ${{secrets.TESTDRIVER_API_KEY}}
+          prerun: |
+            choco install go-task -y
+            task frontend:build
+            cd frontend
+            npm install dashcam-chrome --save
+            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
+            Start-Sleep -Seconds 20
+          prompt: |
+            1. /run testing/testdriver/test.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          FORCE_COLOR: "3"
+
+  cleanup:
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          sudo chmod 600 ../private.key
+
+      - name: Cleanup deployment
+        if: always()
+        run: |
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+            cd /stirling/test-${{ github.sha }}
+            docker-compose down
+            cd /stirling
+            rm -rf test-${{ github.sha }}
+          EOF
+        continue-on-error: true # Ensure cleanup runs even if previous steps fail
@@ -1,112 +0,0 @@
-name: Update Gradle
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * 1"
-
-concurrency:
-  group: update-gradle
-  cancel-in-progress: true
-
-jobs:
-  update-gradle:
-    name: Update Gradle and Docker images
-    permissions:
-      contents: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Java
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-        with:
-          distribution: temurin
-          java-version: "25"
-
-      - name: Find latest Gradle release
-        id: gradle
-        shell: bash
-        run: |
-          set -euo pipefail
-          version=$(curl --fail --silent --show-error --retry 3 \
-            https://services.gradle.org/versions/current | jq -r '.version')
-          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
-            echo "Could not determine a stable Gradle version: $version" >&2
-            exit 1
-          }
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Find matching Docker image digest
-        id: docker
-        env:
-          GRADLE_VERSION: ${{ steps.gradle.outputs.version }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          tag="${GRADLE_VERSION}-jdk25"
-          digest=$(curl --fail --silent --show-error --retry 3 \
-            "https://hub.docker.com/v2/repositories/library/gradle/tags/${tag}" \
-            | jq -r '.digest // empty')
-          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || {
-            echo "Docker image gradle:${tag} was not found" >&2
-            exit 1
-          }
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "digest=$digest" >> "$GITHUB_OUTPUT"
-
-      - name: Update Gradle wrapper
-        env:
-          GRADLE_VERSION: ${{ steps.gradle.outputs.version }}
-        run: ./gradlew wrapper --gradle-version "$GRADLE_VERSION" --distribution-type bin
-
-      - name: Update Gradle Docker images
-        env:
-          DOCKER_TAG: ${{ steps.docker.outputs.tag }}
-          DOCKER_DIGEST: ${{ steps.docker.outputs.digest }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          find docker -type f -name 'Dockerfile*' -print0 |
-            xargs -0 sed -E -i \
-              "s#gradle:[^@[:space:]]+-jdk25(@sha256:[^[:space:]]+)?#gradle:${DOCKER_TAG}@${DOCKER_DIGEST}#g"
-
-      - name: Verify Gradle update
-        env:
-          EXPECTED_VERSION: ${{ steps.gradle.outputs.version }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          actual=$(./gradlew --version | sed -n 's/^Gradle \([0-9.]*\)$/\1/p')
-          [[ "$actual" == "$EXPECTED_VERSION" ]] || {
-            echo "Wrapper resolved Gradle $actual, expected $EXPECTED_VERSION" >&2
-            exit 1
-          }
-          if git diff --quiet; then
-            echo "Gradle is already up to date."
-            exit 0
-          fi
-          git diff --check
-
-      - name: Create pull request
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: automation/update-gradle
-          delete-branch: true
-          commit-message: "chore: update Gradle"
-          title: "chore: update Gradle to ${{ steps.gradle.outputs.version }}"
-          body: |
-            Automated update of the Gradle wrapper and Gradle Docker build images.
-
-            Gradle version: `${{ steps.gradle.outputs.version }}`
-            Docker image: `gradle:${{ steps.docker.outputs.tag }}`
-          labels: dependencies
@@ -26,7 +26,6 @@ watchedFolders/
 # also matches this frontend source component dir; keep the source tracked.
 !frontend/editor/src/proprietary/components/watchedFolders/
 clientWebUI/
-policy-webhook-spool/
 # Scratch dir used by local fixture-regeneration runs (see
 # app/proprietary/src/test/resources/db-migration-fixtures/README.md).
 # Holds downloaded JARs and disposable workdirs. Never committed.
@@ -39,7 +38,6 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 /testing/cucumber/junit/
 /testing/cucumber/report.html
-/testing/cucumber/.parallel/
 /testing/.failed_tests
 /.test-state/
 SwaggerDoc.json
@@ -65,23 +63,13 @@ app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
 app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/og-metadata.saas.json
 app/core/src/main/resources/static/sw-folder-retry.js
 app/core/src/main/resources/static/robots.txt
-app/core/src/main/resources/static/android-chrome-*.png
-app/core/src/main/resources/static/mstile-*.png
-app/core/src/main/resources/static/favicon.png
-app/core/src/main/resources/static/safari-pinned-tab.svg
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
 app/core/src/main/resources/static/**/*.gz
 app/core/src/main/resources/static/**/*.br
-app/core/src/main/resources/static/css/cookieconsent.css
-app/core/src/main/resources/static/css/cookieconsentCustomisation.css
-app/core/src/main/resources/static/mockServiceWorker.js
-app/core/src/main/resources/static/js/thirdParty/cookieconsent.umd.js
-app/core/src/main/resources/static/images/google-drive.svg
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.

 # Gradle
@@ -176,8 +164,6 @@ app/core/src/main/resources/static/images/google-drive.svg
 *.nar
 *.ear
 *.zip
-# Real backend archives the form-bundle reader is tested against.
-!frontend/editor/src/core/tools/formFill/__fixtures__/*.zip
 *.tar.gz
 *.rar
 *.db
@@ -298,13 +284,8 @@ docs/type3/signatures/

 **/application-dev-local.properties

-# Claude. Contents are ignored so personal config stays local, with the two
-# shared pieces re-included: settings.json (the comment-lint hook) and skills/.
-# The directory itself cannot be ignored or git will not look inside it.
-.claude/*
-!.claude/settings.json
-!.claude/skills/
-.claude/settings.local.json
+# Claude
+.claude/

 # Playwright MCP screenshots / traces
 .playwright-mcp/
@@ -27,8 +27,3 @@ app/core/src/main/java/stirling/software/SPDF/pdf/signature/CreateSignatureBase.
 # Supabase publishable key (public by design, RLS-protected) used as a CI fallback
 # default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
 .github/workflows/tauri-build.yml:generic-api-key:402
-
-# Staging Supabase publishable key (public by design). Ignored here rather than with an
-# inline gitleaks:allow because a trailing comment in a .properties file is part of the
-# value, so the pragma would end up inside the key.
-app/saas/src/main/resources/application-staging.properties:generic-api-key:16
@@ -1,7 +1,5 @@
 {
  "ignoredFiles": [
-    "frontend/editor/src-tauri/icons/macos/*",
-    "frontend/editor/src-tauri/icons/linux/*",
-    "frontend/editor/src-tauri/icons/windows/*"
+    "frontend/editor/src-tauri/icons/icon.png"
  ]
 }
@@ -40,15 +40,12 @@ tasks:
      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
      SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN | default ""}}'
-      # Set by dev:linked. Inline rather than in `env:` so an empty value emits nothing
-      # and cannot blank the committed default.
-      ACCOUNT_LINK_SAAS_BASE_URL: '{{.ACCOUNT_LINK_SAAS_BASE_URL | default ""}}'
    env:
      SERVER_PORT: '{{.PORT}}'
    cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .ACCOUNT_LINK_SAAS_BASE_URL}}STIRLING_BILLING_ACCOUNT_LINK_ENABLED=true STIRLING_BILLING_ACCOUNT_LINK_SAAS_BASE_URL={{.ACCOUNT_LINK_SAAS_BASE_URL}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .ACCOUNT_LINK_SAAS_BASE_URL}}STIRLING_BILLING_ACCOUNT_LINK_ENABLED=true STIRLING_BILLING_ACCOUNT_LINK_SAAS_BASE_URL={{.ACCOUNT_LINK_SAAS_BASE_URL}} {{end}}./gradlew :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}./gradlew :stirling-pdf:bootRun'
        platforms: [linux, darwin]

  dev:bundled:
@@ -60,128 +57,29 @@ tasks:
      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
        platforms: [linux, darwin]

-  # SaaS backend. dev:saas -> the PR's preview branch, staging:saas -> shared v3,
-  # PROFILES=none -> production against your own SAAS_DB_*. Production has no named
-  # task on purpose. Use `none`, not an empty value: Go template `default` treats ""
-  # as absent and would resolve back to dev.
-
  dev:saas:
-    desc: "Start SaaS backend against the current PR's Supabase preview branch"
+    desc: "Start backend in SaaS flavor against Supabase"
+    # `dotenv:` reads from the root Taskfile's directory (".") because this
+    # subtaskfile is included with `dir: .`.
    dotenv: ['app/.env.saas.local', 'app/.env.saas']
-    vars:
-      PROFILES: '{{.PROFILES | default "dev"}}'
-    cmds:
-      # Don't move this check into a `sh:` var: dotenv is visible in cmds but not
-      # during var evaluation, so the test would always see an empty value.
-      - cmd: |
-          if [ "{{.PROFILES}}" = "dev" ] && [ -z "${SAAS_DEV_PROJECT_REF:-}" ]; then
-            echo ">> SAAS_DEV_PROJECT_REF is not set."
-            echo ">> Testing a SaaS PR? Put its ref, DB password and publishable key in app/.env.saas.local."
-            echo ">> Wanted the shared v3 project? Use 'task backend:staging:saas' instead."
-            exit 1
-          fi
-      - task: _run:saas
-        vars:
-          PORT: '{{.PORT}}'
-          PROFILES: '{{.PROFILES}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-          APP_BASE_URL: '{{.APP_BASE_URL}}'
-          BASE_PATH: '{{.BASE_PATH}}'
-
-  staging:saas:
-    desc: "Start SaaS backend against the shared v3 staging project"
-    cmds:
-      - task: _run:saas
-        vars:
-          PORT: '{{.PORT}}'
-          PROFILES: staging
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-          APP_BASE_URL: '{{.APP_BASE_URL}}'
-          BASE_PATH: '{{.BASE_PATH}}'
-
-  dev:linked:
-    desc: "Self-hosted backend linked to a locally running SaaS backend (see task linked:*)"
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      SAAS_BASE_URL: '{{.SAAS_BASE_URL | default "http://localhost:8081"}}'
-    cmds:
-      - 'echo ">> self-hosted :{{.PORT}} linking to SaaS at {{.SAAS_BASE_URL}}"'
-      # The two backends run different STIRLING_FLAVOURs, which are different Gradle
-      # project graphs sharing one build/ tree. Waiting avoids overlapping builds; it
-      # does not make the sharing safe, so avoid rebuilding one while the other runs.
-      - cmd: |
-          n=0
-          while [ "$n" -lt 150 ]; do
-            if curl -s -m 2 "{{.SAAS_BASE_URL}}" >/dev/null 2>&1; then
-              echo ">> SaaS backend is up, starting self-hosted"
-              break
-            fi
-            n=$((n + 1))
-            {{if eq OS "windows"}}powershell -NoProfile -Command "Start-Sleep -Seconds 2"{{else}}sleep 2{{end}}
-          done
-          if [ "$n" -ge 150 ]; then
-            echo ">> SaaS backend never answered; starting anyway"
-          fi
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          ACCOUNT_LINK_SAAS_BASE_URL: '{{.SAAS_BASE_URL}}'
-
-  _run:saas:
-    internal: true
-    # The frontend files are here only for RUN_SUBPATH, which the authorize URL needs.
-    # Last, because dotenv is set-if-absent: app/* still decides everything else.
-    dotenv:
-      - 'app/.env.saas.local'
-      - 'app/.env.saas'
-      - 'frontend/editor/.env.saas.local'
-      - 'frontend/editor/.env.saas'
    ignore_error: true
    vars:
      PORT: '{{.PORT | default "8080"}}'
+      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
      PROFILES: '{{.PROFILES | default "dev"}}'
-      # Built here rather than inline in the cmds below: the Windows line is an
-      # unquoted YAML scalar wrapping a cmd.exe string, so a nested {{if ne .X
-      # "none"}} needs escaped quotes that reach the Go template as literal
-      # backslashes and fail with `unexpected "\" in operand`.
-      PROFILE_ARGS: '{{if ne .PROFILES "none"}}--spring.profiles.include={{.PROFILES}}{{end}}'
      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-      # Empty is the same as unset: the property defaults to empty and is blank-checked.
-      APP_BASE_URL: '{{.APP_BASE_URL | default ""}}'
-      # Relocates configs/pipeline/logs, for a second backend in the same directory.
-      # Empty is the same as unset: the reader blank-checks it.
-      BASE_PATH: '{{.BASE_PATH | default ""}}'
    env:
      SERVER_PORT: '{{.PORT}}'
      STIRLING_FLAVOR: saas
-      STIRLING_BASE_PATH: '{{.BASE_PATH}}'
      AIENGINE_URL: '{{.AIENGINE_URL}}'
      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-      # Appends RUN_SUBPATH: the approval page is at <base>/link, so a subpath build
-      # serves it at <base>/app/link. An explicit value still wins.
-      SYSTEM_FRONTENDURL:
-        sh: |
-          if [ -n "${SYSTEM_FRONTENDURL:-}" ]; then
-            echo "${SYSTEM_FRONTENDURL}"
-          elif [ -n "{{.APP_BASE_URL}}" ] && [ -n "${RUN_SUBPATH:-}" ]; then
-            echo "{{.APP_BASE_URL}}/${RUN_SUBPATH}"
-          else
-            echo "{{.APP_BASE_URL}}"
-          fi
    cmds:
-      # PROFILE_ARGS is empty when PROFILES=none, i.e. the bare `saas` profile
-      # against SAAS_DB_* (production).
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILE_ARGS}}--args=\"{{.PROFILE_ARGS}}\"{{end}}"
+      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILE_ARGS}}--args='{{.PROFILE_ARGS}}'{{end}}
+      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
        platforms: [linux, darwin]

  build:
@@ -1,44 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Sync the Python environment with the cucumber test dependencies"
-    run: once
-    # Deliberately no sources/status fingerprint: the engine venv is shared, so it can
-    # already exist while synced to a different dependency group. uv no-ops when correct.
-    cmds:
-      - uv sync --project ../../engine --locked --group cucumber
-
-  run:
-    desc: "Run the cucumber suite against a running server (BASE_URL, default localhost:8080)"
-    deps: [install]
-    cmds:
-      - uv run --project ../../engine --locked --group cucumber python -m behave --no-capture -f plain {{.CLI_ARGS}}
-
-  nightly:
-    desc: "Run the @nightly cucumber scenarios, excluded from the default run"
-    summary: |
-      Heavy LibreOffice/Calibre/Ghostscript conversions. behave.ini excludes @nightly,
-      so this opts back in explicitly.
-
-      Pass extra behave flags via -- :
-        task cucumber:nightly -- --tags=@convert
-    deps: [install]
-    cmds:
-      - uv run --project ../../engine --locked --group cucumber python -m behave --tags=@nightly --no-capture -f plain {{.CLI_ARGS}}
-
-  parallel:
-    desc: "Run the cucumber suite as concurrent shards against one server (SHARDS, default 10)"
-    summary: |
-      Splits the feature files across SHARDS concurrent behave processes hitting a single
-      backend, to shake out cross-request interference. Auth-coupled features are pinned
-      to one shard because they change the admin password mid-scenario.
-
-        task cucumber:parallel
-        task cucumber:parallel SHARDS=4
-        BASE_URL=http://localhost:8081 task cucumber:parallel
-    deps: [install]
-    vars:
-      SHARDS: '{{.SHARDS | default "10"}}'
-    cmds:
-      - bash run-parallel.sh {{.SHARDS}} {{if .CLI_ARGS}}-- {{.CLI_ARGS}}{{end}}
@@ -195,11 +195,7 @@ tasks:
      # `desktop:build` run `jlink:clean` first to force a fresh build.
      - cmd: chmod -R u+w runtime/jre
        platforms: [linux, darwin]
-      # Single-quoted so Task's shell leaves `$_` and `$false` alone. Double
-      # quotes let it expand them as its own variables, and since neither is
-      # set the command PowerShell actually received was
-      # `ForEach-Object { .IsReadOnly = }`, which fails on every file.
-      - cmd: powershell -NoProfile -Command 'Get-ChildItem -Recurse -File runtime/jre | ForEach-Object { $_.IsReadOnly = $false }'
+      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
        platforms: [windows]
    status:
      - test -f runtime/jre/release
@@ -5,14 +5,6 @@ version: '3'
 # mode flag) or use `--project editor/...` for tsc — so the editor lives
 # under frontend/editor/ without each task needing a cd.

-vars:
-  # Dev-only browser-tab label so concurrent worktrees are distinguishable. Only
-  # the worktree folder basename (e.g. "wt1") is exposed — never the full path,
-  # hostname, or user. Dropped from production builds.
-  DEV_LABEL:
-    sh: >-
-      {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
-
 tasks:
  install:
    desc: "Install dependencies"
@@ -23,7 +15,7 @@ tasks:
      - package-lock.json
      - package.json
    status:
-      - npm ls --depth=0
+      - test -d node_modules
    env:
      CI: '{{ .CI | default "false" }}'

@@ -88,52 +80,16 @@ tasks:
      OPEN: '{{.OPEN | default ""}}'
    env:
      BACKEND_URL: '{{.BACKEND_URL}}'
-      STIRLING_DEV_LABEL: '{{.DEV_LABEL}}'
+      # Dev-only browser-tab label so concurrent worktrees are distinguishable.
+      # Only the worktree folder basename (e.g. "wt1") is exposed — never the
+      # full path, hostname, or user. Consumed at dev-serve time by vite.config
+      # and dropped from production builds.
+      STIRLING_DEV_LABEL:
+        sh: >-
+          {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
    cmds:
      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}

-  # Separate from dev:_run rather than a flag on it: Task sets an `env:` key even
-  # when its value resolves to empty, and Vite treats an empty process.env VITE_* as
-  # authoritative over the committed editor/.env, so folding these in blanks Supabase
-  # config for the core, proprietary and desktop dev servers.
-  dev:_run:saas:
-    internal: true
-    ignore_error: true
-    # The backend's own env files, so both halves target one project. Paths are
-    # relative to this taskfile's dir, `frontend`.
-    dotenv: ['../app/.env.saas.local', '../app/.env.saas']
-    vars:
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      OPEN: '{{.OPEN | default ""}}'
-      SAAS_ENV: '{{.SAAS_ENV | default "dev"}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-      STIRLING_DEV_LABEL: '{{.DEV_LABEL}}'
-      SAAS_ENV: '{{.SAAS_ENV}}'
-      # A real process.env VITE_* beats a committed .env in Vite (loadEnv applies
-      # process.env last), which is what lets this override editor/.env.
-      #
-      # These must stay `sh:`, not Go templates: dotenv values are visible to Task's
-      # embedded shell but not to templates, where {{.SAAS_DEV_PROJECT_REF}} is
-      # always empty.
-      VITE_SUPABASE_URL:
-        sh: |
-          case "${SAAS_ENV:-dev}" in
-            staging) ref="${SAAS_STAGING_PROJECT_REF:?set it in app/.env.saas.local}" ;;
-            *)       ref="${SAAS_DEV_PROJECT_REF:?set it in app/.env.saas.local, or pass SAAS_ENV=staging}" ;;
-          esac
-          echo "https://${ref}.supabase.co"
-      VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY:
-        sh: |
-          case "${SAAS_ENV:-dev}" in
-            staging) echo "${SAAS_STAGING_PUBLISHABLE_KEY:?set it in app/.env.saas.local}" ;;
-            *)       echo "${SAAS_DEV_PUBLISHABLE_KEY:?set it in app/.env.saas.local, or pass SAAS_ENV=staging}" ;;
-          esac
-    cmds:
-      - 'echo ">> frontend {{.SAAS_ENV}}: Supabase $VITE_SUPABASE_URL, backend $BACKEND_URL"'
-      - npx vite editor --mode saas --port {{.PORT}}{{if .OPEN}} --open{{end}}
-
  dev:
    desc: "Start frontend dev server"
    cmds:
@@ -155,33 +111,13 @@ tasks:
        vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }

  dev:saas:
-    desc: "Start frontend dev server in SaaS mode (SAAS_ENV=dev|staging|prod)"
+    desc: "Start frontend dev server in SaaS mode"
    deps:
      - task: prepare
        vars: { MODE: saas }
-    vars:
-      SAAS_ENV: '{{.SAAS_ENV | default "dev"}}'
-      # prod routes to the plain runner, which sets no VITE_SUPABASE_* and so leaves
-      # the committed editor/.env alone.
-      RUNNER: '{{if eq .SAAS_ENV "prod"}}dev:_run{{else}}dev:_run:saas{{end}}'
    cmds:
-      - task: '{{.RUNNER}}'
-        vars:
-          MODE: saas
-          PORT: '{{.PORT}}'
-          BACKEND_URL: '{{.BACKEND_URL}}'
-          OPEN: '{{.OPEN}}'
-          SAAS_ENV: '{{.SAAS_ENV}}'
-
-  staging:saas:
-    desc: "Start frontend dev server against the shared v3 staging project"
-    cmds:
-      - task: dev:saas
-        vars:
-          SAAS_ENV: staging
-          PORT: '{{.PORT}}'
-          BACKEND_URL: '{{.BACKEND_URL}}'
-          OPEN: '{{.OPEN}}'
+      - task: dev:_run
+        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }

  dev:desktop:
    desc: "Start frontend dev server in desktop mode"
@@ -274,25 +210,14 @@ tasks:
      #   task frontend:storybook:test -- Button
      - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}

-  storybook:a11y:light:
-    desc: "a11y gate over every story in light mode"
-    deps: [prepare, storybook:browser]
-    cmds:
-      - node .storybook/a11y-scan.mjs {{.CLI_ARGS}}
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-
-  storybook:a11y:dark:
-    desc: "a11y gate over every story in dark mode"
-    deps: [prepare, storybook:browser]
-    cmds:
-      - SCAN_THEME=dark node .storybook/a11y-scan.mjs {{.CLI_ARGS}}
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json
-
  storybook:a11y:
-    desc: "a11y gate over every story, light and dark"
+    desc: "a11y regression gate over every story, light and dark: fail only on NEW axe violations"
+    deps: [prepare, storybook:browser]
    cmds:
-      - task: storybook:a11y:light
-      - task: storybook:a11y:dark
+      - node .storybook/a11y-scan.mjs
+      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
+      - SCAN_THEME=dark node .storybook/a11y-scan.mjs
+      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json

  storybook:a11y:changed:
    desc: "a11y gate over the stories this branch affects (default base origin/main)"
@@ -308,6 +233,7 @@ tasks:

      Pass a base ref through CLI_ARGS, e.g.
        task frontend:storybook:a11y:changed -- origin/release
+    deps: [prepare, storybook:browser]
    vars:
      BASE: '{{.CLI_ARGS | default "origin/main"}}'
      CHANGED:
@@ -318,10 +244,10 @@ tasks:
            echo "a11y: no story files affected vs {{.BASE}} — nothing to check"
            exit 0
          fi
-          rc=0
-          task frontend:storybook:a11y:light -- {{.CHANGED}} || rc=1
-          task frontend:storybook:a11y:dark -- {{.CHANGED}} || rc=1
-          exit $rc
+          node .storybook/a11y-scan.mjs {{.CHANGED}}
+          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
+          SCAN_THEME=dark node .storybook/a11y-scan.mjs {{.CHANGED}}
+          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json

  storybook:a11y:record:
    desc: "Re-record both a11y baselines (run after intentionally fixing/adding violations)"
@@ -385,13 +311,13 @@ tasks:
    desc: "Auto-fix code formatting"
    deps: [install]
    cmds:
-      - npx oxfmt --write .
+      - npx prettier --write .

  format:check:
    desc: "Check code formatting"
    deps: [install]
    cmds:
-      - npx oxfmt --check .
+      - npx prettier --check .

  fix:
    desc: "Auto-fix lint and format"
@@ -564,7 +490,6 @@ tasks:
    deps: [install, ":backend:swagger"]
    cmds:
      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --io-output editor/src/core/types/toolIO.ts
-      - task: format
    sources:
      - editor/scripts/generate-tool-api-types.mts
      - ../SwaggerDoc.json
@@ -574,9 +499,9 @@ tasks:

  tool-models:check:
    desc: "Fail if committed tool API types are out of date"
+    deps: [install, ":backend:swagger"]
    cmds:
-      - task: tool-models
-      - git diff --exit-code -- editor/src/core/types/toolApiTypes.ts editor/src/core/types/toolIO.ts
+      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --io-output editor/src/core/types/toolIO.ts --check

  licenses:generate:
    desc: "Generate frontend license report"
@@ -11,7 +11,6 @@ vars:
    '.github/scripts/*.py'
    'app/core/src/main/resources/static/python/*.py'
    ':(exclude)*split_photos.py'
-    ':(exclude)scripts/lint/fixtures/*'
  SPELL_FILES: >-
    '*.html'
    '*.css'
@@ -60,7 +59,6 @@ tasks:
      - task: gitleaks
      - task: whitespace
      - task: toml-sort
-      - task: comment-lint

  fix:
    desc: "Auto-fix formatting, spelling, and secrets issues across the repo"
@@ -77,7 +75,6 @@ tasks:
        vars: { FIX: '1' }
      - task: codespell
      - task: gitleaks
-      - task: comment-lint

  install:
    desc: "Install the pinned pre-commit Python tools"
@@ -133,85 +130,6 @@ tasks:
    cmds:
      - "{{.GITLEAKS_BIN}} git --pre-commit --redact --staged --verbose"

-  comment-lint:
-    desc: "Check comment quality on the lines this branch adds"
-    summary: |
-      Blocks a comment that restates the code below it, a section banner, or a
-      block of commented-out code. Everything else it reports is advisory.
-
-      Scoped to added lines, so touching an old file never surfaces the standing
-      backlog. The standard is devGuide/CODE_COMMENTS.md.
-
-      With no arguments it diffs the working tree against HEAD, which is what a
-      pre-commit run wants: the lines you are about to commit. On a CI pull request
-      it diffs against the target branch instead, via GITHUB_BASE_REF.
-
-      To ask what a whole branch adds instead, use the branch variant, which
-      needs no argument passing:
-        task comment-lint:branch
-
-      Full tree (report only):     task pre-commit:comment-lint:all
-      Fixture corpus:             task pre-commit:comment-lint:selftest
-    # Depends on the frontend install because the .ts/.tsx half of the rule set
-    # runs as an oxlint plugin. Without it the TS engine warns and skips, which
-    # would leave the frontend silently unchecked on CI.
-    deps: [":frontend:install"]
-    cmds:
-      - node scripts/lint/comment-lint.mjs {{.CLI_ARGS}}
-
-  comment-lint:branch:
-    desc: "Check comment quality on everything this branch adds over its base"
-    summary: |
-      Like `task comment-lint`, but scoped to the whole branch rather than to
-      uncommitted work, so it still reports after you commit.
-
-      Exists as its own task because passing `-- --since origin/main` through Task
-      is not portable: with the npm build of Task the launcher is a PowerShell
-      script, and PowerShell strips the `--` before Task sees it, leaving Task to
-      print its own usage.
-
-      Override the base with BASE=<ref>.
-    vars:
-      BASE: '{{.BASE | default "origin/main"}}'
-    deps: [":frontend:install"]
-    cmds:
-      - node scripts/lint/comment-lint.mjs --since {{.BASE}}
-
-  comment-lint:ci:
-    desc: "Comment gate as CI runs it: fixture corpus, then the diff"
-    summary: |
-      The corpus checks the rules themselves rather than the code under review, so
-      it belongs on CI and not on every local commit. Run this before changing a
-      rule, and let CI run it on every pull request.
-    deps: [":frontend:install"]
-    cmds:
-      - node scripts/lint/comment-lint.mjs --selftest
-      - node scripts/lint/comment-lint.mjs {{.CLI_ARGS}}
-
-  comment-lint:hook:
-    desc: "Comment gate for the editor hook: everything this turn changed"
-    summary: |
-      Same scope as `task comment-lint`, kept as its own name so the hook has a
-      stable entry point and the taskfile shows every way the linter is invoked.
-
-      Not in the frontend-install dependency chain on purpose: this runs at the end
-      of every turn, so it stays as short as it can be. If oxlint is missing the TS
-      half warns and skips.
-    cmds:
-      - node scripts/lint/comment-lint.mjs
-
-  comment-lint:all:
-    desc: "Report every comment finding in the tree (never fails)"
-    deps: [":frontend:install"]
-    cmds:
-      - node scripts/lint/comment-lint.mjs --all
-
-  comment-lint:selftest:
-    desc: "Check both comment-lint engines against the fixture corpus"
-    deps: [":frontend:install"]
-    cmds:
-      - node scripts/lint/comment-lint.mjs --selftest
-
  gitleaks-bin:
    internal: true
    desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
@@ -42,7 +42,7 @@
  "java.configuration.updateBuildConfiguration": "interactive",
  "java.format.enabled": true,
  "java.format.settings.profile": "GoogleStyle",
-  "java.format.settings.google.version": "1.35.0",
+  "java.format.settings.google.version": "1.28.0",
  "java.format.settings.google.extra": "--aosp --skip-sorting-imports --skip-javadoc-formatting",
  // (DE) Aktiviert Kommentare im Java-Format.
  // (EN) Enables comments in Java formatting.
@@ -73,52 +73,40 @@
    "stirling",
  ],
  "java.project.resourceFilters": [
-    ".cache/",
-    ".claude/",
    ".devcontainer/",
    ".git/",
-    ".git-blame-ignore-revs",
-    ".gitattributes",
    ".github/",
-    ".gitignore",
    ".gradle/",
-    ".pre-commit-config.yaml",
-    ".task/",
-    ".taskfiles/",
    ".venv/",
    ".venv*/",
    ".vscode/",
-    "app/.gitignore",
-    "app/build/",
-    "app/common/.gitignore",
-    "app/common/bin/",
-    "app/common/build/",
-    "app/core/.gitignore",
-    "app/core/bin/",
-    "app/core/configs/",
-    "app/core/customFiles/",
-    "app/core/LOCAL_APPDATA_FONTCONFIG_CACHE/",
-    "app/core/logs/",
-    "app/core/pipeline/",
-    "app/core/storage/",
-    "app/proprietary/.gitignore",
-    "app/proprietary/bin/",
-    "app/proprietary/storage/",
-    "app/saas/.gitignore",
-    "app/saas/bin/",
-    "app/saas/build/",
    "bin/",
+    "app/core/bin/",
+    "app/common/bin/",
+    "app/proprietary/bin/",
    "build/",
-    "devGuide/",
-    "devTools/",
-    "docker/",
+    "app/core/build/",
+    "app/common/build/",
+    "app/proprietary/build/",
+    "configs/",
+    "app/core/configs/",
+    "customFiles/",
+    "app/core/customFiles/",
    "docs/",
-    "engine/",
-    "frontend/",
+    "exampleYmlFiles",
    "gradle/",
    "images/",
+    "logs/",
+    "pipeline/",
    "scripts/",
    "testings/",
+    ".git-blame-ignore-revs",
+    ".gitattributes",
+    ".gitignore",
+    "app/core/.gitignore",
+    "app/common/.gitignore",
+    "app/proprietary/.gitignore",
+    ".pre-commit-config.yaml",
  ],
  // Enables signature help in Java.
  "java.signatureHelp.enabled": true,
@@ -147,57 +135,13 @@
  "html.format.indentHandlebars": true,
  "html.format.preserveNewLines": true,
  "html.format.maxPreserveNewLines": 2,
-  "stylelint.configFile": "${workspaceFolder}/devTools/.stylelintrc.json",
-  "css.lint.unknownAtRules": "ignore",
-  "scss.lint.unknownAtRules": "ignore",
-  "less.lint.unknownAtRules": "ignore",
+  "stylelint.configFile": "devTools/.stylelintrc.json",
  "java.project.sourcePaths": [
    "app/core/src/main/java",
    "app/common/src/main/java",
    "app/proprietary/src/main/java"
  ],
-  "[javascript]": {
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
-  "[javascriptreact]": {
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
  "[typescript]": {
-    "editor.defaultFormatter": "vscode.typescript-language-features",
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
-  "[typescriptreact]": {
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
-  "oxc.enable.oxlint": true,
-  "oxc.enable.oxfmt": false,
-  "oxc.configPath": "frontend/oxlint.config.ts",
-  "oxc.requireConfig": true,
-  "oxc.lint.run": "onType",
-  "oxc.fixKind": "safe_fix",
-  "[toml]": {
-    "editor.defaultFormatter": "tamasfe.even-better-toml",
-    // Keep TOML formatting compatible with .editorconfig and the pre-commit
-    // locale sorter. Key ordering itself is handled by task pre-commit:toml-sort.
-    "editor.insertSpaces": true,
-    "editor.tabSize": 4,
-    "editor.rulers": [127],
-    "evenBetterToml.formatter.alignEntries": false,
-    "evenBetterToml.formatter.alignComments": false,
-    "evenBetterToml.formatter.indentString": "    ",
-    "evenBetterToml.formatter.columnWidth": 127,
-    "evenBetterToml.formatter.reorderKeys": false,
-    "evenBetterToml.formatter.reorderArrays": false,
-    "evenBetterToml.formatter.reorderInlineTables": false,
-    "evenBetterToml.formatter.trailingNewline": true,
-    "evenBetterToml.formatter.crlf": false
+    "editor.defaultFormatter": "vscode.typescript-language-features"
  }
 }
@@ -21,43 +21,6 @@ Task `desc:` fields should describe **what** the task does, not **how** it does
 - `task docker:build` — build standard Docker image
 - `task docker:up` — start Docker compose stack

-## Comments
-
-A comment must carry information the code cannot. If a reader could derive it from the code in front of them, delete it.
-
-Comment the current state. Not what the code used to do, not what changed, not why it changed: git holds that. Where history explains the shape, state the reason instead, so "this used to reimplement the modal internals" becomes "thin wrapper over the shared Modal: duplicating its portal and focus trap is how dialogs drift apart". Future state goes in a TODO with an issue.
-
-Write a comment when it does one of these four jobs:
-
- **Contract.** What a caller must know that the signature cannot say: preconditions, invariants, units, ownership and lifetime, thread-safety, error semantics, side effects. Document the contract of everything a caller outside the file can reach, and nothing else. Goes on the type/method/module as Javadoc, JSDoc, or a docstring.
- **Why.** The constraint the code satisfies, the bug it avoids, the alternative rejected and the reason.
- **Hazard.** "Must stay in sync with X", "order matters because Y", "do not remove, it prevents Z".
- **Map.** A short orientation at the top of a genuinely complex file: what it owns, and what it deliberately does not.
-
-Never write:
-
- A comment that restates the next line. `// Handle drag start` above `handleDragStart` is noise.
- Section banners or position markers: `// --- Types ---`, `// Helpers`, `// =====`.
- Step narration in a function body (`// Step 1:`, `// Then we`). If the steps need labels they need names: extract functions. Numbering a genuinely numbered thing, like a wizard step, is fine.
- Commented-out code. Delete it.
- Doc tags that restate the signature. `@param blob - The blob` says nothing; omit the tag rather than pad it.
- Docs on self-explanatory members with no constraint to state.
-
-Two tests before keeping a comment:
-
- **Delete it.** Is any information lost? If not, it stays deleted.
- **Could a name carry it instead?** A better identifier, an extracted function, or a named constant beats a comment. Prefer the code change.
-
-A comment at the end of a line usually decodes that line, and that is worth keeping: `{0x25, 0x50} // "%PDF"`, `50L * 1024 * 1024 // 50 MB`. The rules that compare a comment against the code below it do not apply there, but a trailing TODO or a trailing bit of history is judged like any other.
-
-A reference is supplementary, never load-bearing: the comment must survive deleting it. `// See #1234` is a dead end; `// saving first loses every annotation (#6865)` is not. Prefer a spec (`RFC 3161`) or CVE where one applies.
-
-A TODO needs an issue, not an owner: `// TODO(#1234): re-enable the gate once account syncing lands`. If it is not worth an issue, it is not worth a TODO. A question is not a TODO.
-
-A comment block over ~12 lines outside a file or type header usually means the code needs restructuring, or that the prose is product documentation and belongs in the docs repo.
-
-`task comment-lint` checks the mechanical part of this on the lines you add, and runs inside `task pre-commit`. Reasoning, worked examples and the linter's own rules: @devGuide/CODE_COMMENTS.md
-
 ## Common Development Commands

 ### Build and Test
@@ -107,7 +70,7 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 - Avoid nested functions and nested classes unless the language construct requires them.
 - Prefer composition to inheritance when combining concepts.
 - Avoid speculative abstractions. Add a layer only when it removes real duplication or clarifies lifecycle.
- Comments follow the repo-wide rules in the "Comments" section above.
+- Add comments sparingly and only when they explain non-obvious intent.

 #### Python Typing and Models
 - Deserialize into Pydantic models as early as possible.
@@ -2,13 +2,6 @@

 Thank you for your interest in contributing to Stirling-PDF! There are many ways to contribute other than writing code. For example, reporting bugs, creating suggestions, and adding or modifying translations.

-## License
-
-By contributing to this project, you agree that your contributions will be licensed under the project [license](LICENSE), which follows an open-core model. 
-The codebase is a mix of MIT and source-available code, so your contribution is licensed according to the directory it is committed to.
-
-PRs are welcome in any directory by any user, just be aware of which license applies to the code you change.
-
 ## Issue Guidelines

 Issues can be used to report bugs, request features, or ask questions. If you have a question, you could also ask us in our [Discord](https://discord.gg/FJUSXUSYec).
@@ -42,7 +35,6 @@ Please make sure your Pull Request adheres to the following guidelines:
 - Keep commits atomic. One commit should contain one change. If you want to make multiple changes, submit multiple Pull Requests.
 - Commits should be clear, concise, and easy to understand.
 - References to the Issue number in the Pull Request and/or Commit message.
- Every comment in the diff should say something the code does not. See [Code comments](devGuide/CODE_COMMENTS.md); `task comment-lint` checks the mechanical part.

 ## Translations

@@ -71,3 +63,7 @@ For technical guides, setup instructions, and development resources:
 For configuration and usage guides, see:
 - [Database Guide](DATABASE.md) - Database setup and configuration
 - [OCR Guide](HowToUseOCR.md) - OCR setup and configuration
+
+## License
+
+By contributing to this project, you agree that your contributions will be licensed under the [MIT License](LICENSE).
@@ -46,8 +46,8 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Docker
 - Git
 - Java JDK 25
- Node.js 22+ and npm (required for frontend development)
- Gradle 9.0 or later (Included within the repo)
+- Node.js 18+ and npm (required for frontend development)
+- Gradle 7.0 or later (Included within the repo)
 - [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)
@@ -25,9 +25,6 @@ includes:
  e2e:
    taskfile: .taskfiles/e2e.yml
    dir: .
-  cucumber:
-    taskfile: .taskfiles/cucumber.yml
-    dir: testing/cucumber
  pre-commit:
    taskfile: .taskfiles/pre-commit.yml
    dir: .
@@ -99,122 +96,22 @@ tasks:
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
          OPEN: "true"

-  # Set SAAS_DEV_PROJECT_REF in app/.env.saas.local to pick the PR.
  dev:saas:
-    desc: "Start SaaS backend + frontend + engine against the current PR's preview branch"
+    desc: "Start SaaS backend + frontend concurrently on free ports"
    cmds:
      - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas, SAAS_ENV: dev }
-
-  staging:saas:
-    desc: "Start SaaS backend + frontend + engine against the shared v3 staging project"
-    cmds:
-      - task: dev:_all
-        vars:
-          FRONTEND: saas
-          BACKEND: saas
-          BACKEND_TASK: backend:staging:saas
-          SAAS_ENV: staging
+        vars: { FRONTEND: saas, BACKEND: saas }

  dev:all:
    desc: "Start backend + frontend + engine concurrently on free ports"
    cmds:
      - task: dev:_all

-  # No engine: linking never calls it.
-  linked:staging:
-    desc: "SaaS on the shared v3 project + a self-hosted instance linked to it"
-    cmds:
-      - task: linked:_all
-        vars: { SAAS_ENV: staging }
-
-  linked:dev:
-    desc: "SaaS on the current PR's preview branch + a self-hosted instance linked to it"
-    cmds:
-      - task: linked:_all
-        vars: { SAAS_ENV: dev }
-
-  linked:_all:
-    internal: true
-    vars:
-      SAAS_ENV: '{{.SAAS_ENV | default "staging"}}'
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8081 5174 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8081 5174 8080 5173{{end}}'
-      SAAS_BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      SAAS_FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-      APP_BACKEND_PORT: '{{index (splitList "\n" .PORTS) 2}}'
-      APP_FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 3}}'
-    deps:
-      # APP_BASE_URL is the SaaS *frontend*: the approval page is served by vite, not
-      # by the API. BASE_PATH moves this backend's configs/pipeline aside so it does not
-      # race the self-hosted one, which keeps ./configs and its existing database.
-      - task: 'backend:{{.SAAS_ENV}}:saas'
-        vars:
-          PORT: '{{.SAAS_BACKEND_PORT}}'
-          APP_BASE_URL: 'http://localhost:{{.SAAS_FRONTEND_PORT}}'
-          BASE_PATH: 'tmp/linked-saas'
-      - task: frontend:dev:saas
-        vars:
-          PORT: '{{.SAAS_FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.SAAS_BACKEND_PORT}}'
-          SAAS_ENV: '{{.SAAS_ENV}}'
-      - task: backend:dev:linked
-        vars:
-          PORT: '{{.APP_BACKEND_PORT}}'
-          SAAS_BASE_URL: 'http://localhost:{{.SAAS_BACKEND_PORT}}'
-      - task: frontend:dev:proprietary
-        vars:
-          PORT: '{{.APP_FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.APP_BACKEND_PORT}}'
-          OPEN: "true"
-      - task: linked:_ready
-        vars:
-          SAAS_BACKEND_PORT: '{{.SAAS_BACKEND_PORT}}'
-          SAAS_FRONTEND_PORT: '{{.SAAS_FRONTEND_PORT}}'
-          APP_BACKEND_PORT: '{{.APP_BACKEND_PORT}}'
-          APP_FRONTEND_PORT: '{{.APP_FRONTEND_PORT}}'
-
-  # Waits for all four to answer, then prints where they landed.
-  linked:_ready:
-    internal: true
-    cmds:
-      - cmd: |
-          n=0
-          ok=0
-          while [ "$n" -lt 150 ]; do
-            ok=1
-            for u in "http://localhost:{{.SAAS_BACKEND_PORT}}" \
-                     "http://localhost:{{.SAAS_FRONTEND_PORT}}" \
-                     "http://localhost:{{.APP_BACKEND_PORT}}" \
-                     "http://localhost:{{.APP_FRONTEND_PORT}}"; do
-              # Not -o /dev/null: Windows curl.exe treats it as a real path and exits 23.
-              curl -s -m 2 "$u" >/dev/null 2>&1 || ok=0
-            done
-            if [ "$ok" = 1 ]; then break; fi
-            n=$((n + 1))
-            # `sleep` is a binary, not a builtin, and Windows has none.
-            {{if eq OS "windows"}}powershell -NoProfile -Command "Start-Sleep -Seconds 2"{{else}}sleep 2{{end}}
-          done
-          echo ""
-          if [ "$ok" = 1 ]; then
-            echo ">> all four answering"
-          else
-            echo ">> still waiting on one or more after 5 minutes; addresses below anyway"
-          fi
-          echo ">>   self-hosted UI  http://localhost:{{.APP_FRONTEND_PORT}}/processor"
-          echo ">>   self-hosted api http://localhost:{{.APP_BACKEND_PORT}}"
-          echo ">>   saas UI         http://localhost:{{.SAAS_FRONTEND_PORT}}"
-          echo ">>   saas api        http://localhost:{{.SAAS_BACKEND_PORT}}"
-          echo ""
-
  dev:_all:
    internal: true
    vars:
      FRONTEND: '{{.FRONTEND | default "proprietary"}}'
      BACKEND: '{{.BACKEND | default "proprietary"}}'
-      BACKEND_TASK: '{{.BACKEND_TASK | default (printf "backend:dev:%s" .BACKEND)}}'
-      # Only meaningful to the saas frontend; every other flavor ignores it.
-      SAAS_ENV: '{{.SAAS_ENV | default ""}}'
      PORTS:
        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -224,7 +121,7 @@ tasks:
      - task: engine:dev
        vars:
          PORT: '{{.ENGINE_PORT}}'
-      - task: '{{.BACKEND_TASK}}'
+      - task: 'backend:dev:{{.BACKEND}}'
        vars:
          PORT: '{{.BACKEND_PORT}}'
          AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
@@ -234,7 +131,6 @@ tasks:
          PORT: '{{.FRONTEND_PORT}}'
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
          OPEN: "true"
-          SAAS_ENV: '{{.SAAS_ENV}}'

  # ============================================================
  # Build
@@ -266,20 +162,6 @@ tasks:
    cmds:
      - task: frontend:lint
      - task: engine:lint
-      - task: comment-lint
-
-  comment-lint:
-    desc: "Check comment quality on the lines this branch adds"
-    aliases: [comments]
-    cmds:
-      - task: pre-commit:comment-lint
-        vars: { CLI_ARGS: '{{.CLI_ARGS}}' }
-
-  comment-lint:branch:
-    desc: "Check comment quality on everything this branch adds over its base"
-    cmds:
-      - task: pre-commit:comment-lint:branch
-        vars: { BASE: '{{.BASE}}' }

  fix:
    desc: "Auto-fix all components"
@@ -4,11 +4,6 @@ This guide explains how to set up Windows code signing for Stirling-PDF desktop

 ## Overview

-Releases are signed with **DigiCert KeyLocker**, a cloud HSM: the private key never
-leaves DigiCert, and the runner signs through a PKCS#11 provider. The older approach
-of uploading a base64 `.pfx` to a repository secret has been removed from the
-workflows - the sections below describe KeyLocker, which is what actually runs.
-
 Windows code signing is essential for:
 - Preventing Windows SmartScreen warnings
 - Building trust with users
@@ -54,19 +49,29 @@ openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certifica

 ### Required Secrets

-Navigate to your GitHub repository → Settings → Environments → `release-signing`.
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions

-These live in the `release-signing` environment, not at repository scope. That
-environment requires reviewer approval and is limited to `main`, `release`,
-`hotfix/*` and `v*` tags. All five come from the DigiCert ONE console.
+Add the following secrets:

-| Secret | Description |
-| --- | --- |
-| `SM_API_KEY` | KeyLocker API key. Also acts as the on/off switch: signing steps are gated on it being non-empty. |
-| `SM_CLIENT_CERT_FILE_B64` | Base64-encoded PKCS#12 client authentication certificate. |
-| `SM_CLIENT_CERT_PASSWORD` | Password for that client certificate. |
-| `SM_KEYPAIR_ALIAS` | Alias of the signing keypair to use. |
-| `SM_HOST` | DigiCert ONE host, e.g. `https://clientauth.one.digicert.com`. |
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file

 ### Optional Secrets for Tauri Updater

@@ -105,23 +110,23 @@ The Windows signing configuration is already set up:

 ### 2. GitHub Workflow (.github/workflows/tauri-build.yml)

-The workflow includes four Windows signing steps, all gated on `SM_API_KEY` being
-set and the ref being the release branch:
+The workflow includes three Windows signing steps:

-1. **Setup DigiCert KeyLocker**: Installs the DigiCert signing tools via `digicert/ssm-code-signing`
-2. **Setup DigiCert KeyLocker Certificate**: Writes the client cert and exports the PKCS#11 config
-3. **Configure Windows code signing / Build Tauri app**: Signs through the PKCS#11 provider
-4. **Verify Windows Code Signature**: Validates that the .exe and .msi are properly signed
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed

 ## Testing the Setup

 ### 1. Local Testing (Windows Only)

-KeyLocker is CI-only. To check signing locally, install your own certificate into
-the Windows store and point Tauri at it; the build no longer reads any certificate
-from an environment variable.
+Before pushing to GitHub, test locally:

 ```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
 # Build the application
 cd frontend
 npm run tauri build
@@ -186,10 +191,9 @@ Look for:
 - Consider EV certificate for immediate reputation

 ### Certificate Not Found During Build
- Verify `SM_API_KEY` is present in the `release-signing` environment. If it is empty
-  the signing steps skip silently and the build succeeds unsigned.
- Check `SM_CLIENT_CERT_FILE_B64` base64 encoding is correct (no extra whitespace)
- Ensure `SM_CLIENT_CERT_PASSWORD` and `SM_KEYPAIR_ALIAS` match the DigiCert keypair
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct

 ## Security Best Practices

@@ -216,10 +220,11 @@ Look for:
 ## Certificate Lifecycle

 ### Before Expiration
-1. Renew the certificate in the DigiCert ONE console (typically annual)
-2. If the keypair alias changed, update `SM_KEYPAIR_ALIAS` in the `release-signing` environment
-3. If the client authentication certificate was reissued, update `SM_CLIENT_CERT_FILE_B64` and `SM_CLIENT_CERT_PASSWORD`
-4. Test build to verify the new certificate works
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works

 ### Expired Certificates
 - Signed binaries remain valid (timestamp proves signing time)
@@ -1,16 +1,15 @@
-# Stirling-PDF SaaS environment defaults. Committed, non-secret. Real values for secrets go in
-# .env.saas.local, which is loaded first and wins. Do not commit that file.
+###############################################################################
+# Stirling-PDF SaaS environment defaults.
 #
-# Three environments, each deriving its Supabase URLs, JWT issuer and JWKS from one project ref:
+# This file is committed and provides non-secret defaults loaded by
+# `task backend:dev:saas`. Put real values for secrets (passwords, project
+# refs, edge function secrets) in `.env.saas.local` - any variable set there
+# takes precedence over what's defined here.
 #
-#   prod     PROFILES=none       SAAS_DB_*          the live project
-#   staging  PROFILES=staging    SAAS_STAGING_*     pinned to v3, always there
-#   dev      PROFILES=dev        SAAS_DEV_*         follows a SaaS PR's preview branch
-#
-# dev is the default for `task backend:dev:saas`. Use staging for somewhere stable; use dev when
-# testing an open SaaS PR, since its preview branch is the only place those migrations are applied.
+# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
+###############################################################################

-# ---------- Supabase project (prod / no-profile) ----------
+# ---------- Supabase project ----------
 # Project reference (the subdomain part of <ref>.supabase.co). Required.
 # Set in .env.saas.local.
 SAAS_DB_PROJECT_REF=
@@ -18,35 +17,18 @@ SAAS_DB_PROJECT_REF=
 # Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
 SUPABASE_EDGE_FUNCTION_SECRET=

-# ---------- Database (no profile) ----------
-# Direct JDBC URL to the Supabase Postgres. Required when running without
-# `--spring.profiles.include=...`.
+# ---------- Database (saas profile) ----------
+# Direct JDBC URL to the Supabase Postgres. Required when running the plain
+# `saas` profile (i.e. without `--spring.profiles.include=dev`).
 # Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
 SAAS_DB_URL=
 SAAS_DB_USERNAME=postgres
 SAAS_DB_PASSWORD=

-# ---------- staging profile ----------
-# The shared long-lived v3 project. application-staging.properties defaults the ref,
-# URL, database host and meter endpoint, so staging needs only the password, in
-# .env.saas.local. Set SAAS_STAGING_PROJECT_REF to repoint it; everything derives.
-#
-# The ref and publishable key are duplicated here because the task derives the
-# frontend's VITE_SUPABASE_* from them and a shell cannot read a Spring default.
-# Neither is secret: the ref is a public subdomain, the key ships in the bundle.
-SAAS_STAGING_PROJECT_REF=qacaivhsjtftfwtgjvva
-SAAS_STAGING_PUBLISHABLE_KEY=sb_publishable_nIM8y-9ARPE7EzQwAQHKMg_40fCN6kY # gitleaks:allow
-SAAS_STAGING_DB_USERNAME=postgres
-SAAS_STAGING_DB_PASSWORD=
-
-# ---------- dev profile ----------
-# The SaaS PR's Supabase preview branch. Take the ref from that PR's "Supabase
-# Preview" check; the profile derives URL, JWT issuer, JWKS, meter endpoint and
-# database host from it, so this one value follows a different PR.
-#
-# A preview branch has its own password and keys; the parent project's will not
-# authenticate. Both go in .env.saas.local, along with the ref.
-SAAS_DEV_PROJECT_REF=
-SAAS_DEV_PUBLISHABLE_KEY=
+# ---------- Database (dev profile overrides) ----------
+# Used when `--spring.profiles.include=dev` is active. The dev profile
+# defaults the URL/username to the shared dev Supabase project, but the
+# password must still be provided in .env.saas.local.
+SAAS_DEV_DB_URL=
 SAAS_DEV_DB_USERNAME=postgres
 SAAS_DEV_DB_PASSWORD=
@@ -3,10 +3,6 @@ bootRun {
    enabled = false
 }
 dependencies {
-    // Security-hardening utilities (zip-slip, SSRF, filename sanitization, command injection).
-    // Declared as api here so core + proprietary (which depend on common) get it transitively,
-    // keeping it off modules that don't need it (e.g. saas).
-    api 'io.github.pixee:java-security-toolkit:1.2.3'
    api "com.google.guava:guava:${guavaVersion}"
    api 'org.springframework.boot:spring-boot-starter-webmvc'
    api 'org.springframework.boot:spring-boot-starter-aspectj'
@@ -22,14 +18,11 @@ dependencies {
    api "org.apache.pdfbox:preflight:$pdfboxVersion"
    api 'com.github.junrar:junrar:8.0.0' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
-    api 'org.snakeyaml:snakeyaml-engine:3.1.1'
+    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
-    api 'org.simplejavamail:simple-java-mail:9.3.2'
-    // MSG file support; exclude commons-math3 (only HSSF/formula needs it, MSG parsing doesn't)
-    api('org.simplejavamail:outlook-module:9.3.2') {
-        exclude group: 'org.apache.commons', module: 'commons-math3'
-    }
+    api 'org.simplejavamail:simple-java-mail:9.2.0'
+    api 'org.simplejavamail:outlook-module:9.2.0' // MSG file support
    api 'jakarta.mail:jakarta.mail-api:2.1.5'
    runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'

@@ -43,30 +36,12 @@ dependencies {

    api "com.stirling:jpdfium:${jpdfiumVersion}"

-    // -PjpdfiumPlatforms=auto|all|none|<csv of linux-x64,linux-arm64,linux-musl-x64,linux-musl-arm64,darwin-x64,darwin-arm64,windows-x64> (windows-arm64 natives not published yet)
-    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'auto').toString().trim()
-    def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'linux-musl-x64', 'linux-musl-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
+    // -PjpdfiumPlatforms=all|none|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
+    // 'none' skips natives entirely (windows-arm64 builds, until JPDFium ships that platform).
+    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
+    def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
    def jpdfiumPlatforms
-    if (jpdfiumPlatformsProp == 'auto') {
-        def osName = System.getProperty('os.name').toLowerCase()
-        def osArch = System.getProperty('os.arch').toLowerCase()
-        def isArm64 = osArch.contains('aarch64') || osArch.contains('arm64')
-        if (osName.contains('linux')) {
-            jpdfiumPlatforms = isArm64 ? ['linux-arm64'] : ['linux-x64']
-        } else if (osName.contains('mac')) {
-            jpdfiumPlatforms = isArm64 ? ['darwin-arm64'] : ['darwin-x64']
-        } else if (osName.contains('win')) {
-            if (isArm64) {
-                logger.lifecycle("JPDFium natives are not available for windows-arm64; set -PjpdfiumPlatforms=none to skip bundling natives.")
-                jpdfiumPlatforms = []
-            } else {
-                jpdfiumPlatforms = ['windows-x64']
-            }
-        } else {
-            // Fallback: bundle all platforms when host can't be determined
-            jpdfiumPlatforms = jpdfiumAllPlatforms
-        }
-    } else if (jpdfiumPlatformsProp == 'all') {
+    if (jpdfiumPlatformsProp == 'all') {
        jpdfiumPlatforms = jpdfiumAllPlatforms
    } else if (jpdfiumPlatformsProp == 'none') {
        jpdfiumPlatforms = []
@@ -76,7 +51,7 @@ dependencies {
    def jpdfiumInvalid = jpdfiumPlatforms.findAll { !jpdfiumAllPlatforms.contains(it) }
    if (jpdfiumInvalid) {
        throw new GradleException("Unknown jpdfiumPlatforms value(s): ${jpdfiumInvalid.join(', ')}. " +
-                "Valid: ${jpdfiumAllPlatforms.join(', ')}, 'auto', 'all' or 'none'.")
+                "Valid: ${jpdfiumAllPlatforms.join(', ')}, 'all' or 'none'.")
    }
    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms ? jpdfiumPlatforms.join(', ') : 'none'}")
    jpdfiumPlatforms.each { platform ->
@@ -6,7 +6,6 @@ import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;

-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.stereotype.Service;

@@ -14,7 +13,6 @@ import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.service.PdfaLevelAServiceInterface;

@Service
@Slf4j
@@ -48,21 +46,17 @@ public class EndpointConfiguration {
    private final ApplicationProperties applicationProperties;
    @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
    private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
-    private Set<String> disabledGroups = ConcurrentHashMap.newKeySet();
+    private Set<String> disabledGroups = new HashSet<>();
    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
    private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
    private final boolean runningProOrHigher;
-    private final boolean pdfUaAvailable;

    public EndpointConfiguration(
            ApplicationProperties applicationProperties,
-            @Qualifier("runningProOrHigher") boolean runningProOrHigher,
-            @Autowired(required = false) PdfaLevelAServiceInterface pdfaLevelAService) {
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
        this.applicationProperties = applicationProperties;
        this.runningProOrHigher = runningProOrHigher;
-        // The PDF/UA tagger ships in the proprietary module, and so do its endpoints.
-        this.pdfUaAvailable = pdfaLevelAService != null;
        init();
        processEnvironmentConfigs();
    }
@@ -174,8 +168,7 @@ public class EndpointConfiguration {
                    && disabledGroups.contains(group)
                    && entry.getValue().contains(endpoint)) {
                log.debug(
-                        "isEndpointEnabled('{}') -> false (single tool group '{}' disabled, no"
-                                + " alternatives)",
+                        "isEndpointEnabled('{}') -> false (single tool group '{}' disabled, no alternatives)",
                        original,
                        group);
                return false;
@@ -334,8 +327,7 @@ public class EndpointConfiguration {
                    String.join(", ", functionallyDisabledEndpoints));
        } else if (!disabledToolGroups.isEmpty()) {
            log.info(
-                    "No endpoints disabled despite missing tools - fallback implementations"
-                            + " available");
+                    "No endpoints disabled despite missing tools - fallback implementations available");
        }
    }

@@ -364,7 +356,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Convert", "pdf-to-img");
        addEndpointToGroup("Convert", "img-to-pdf");
        addEndpointToGroup("Convert", "pdf-to-pdfa");
-        addEndpointToGroup("Convert", "pdf-to-ua");
        addEndpointToGroup("Convert", "file-to-pdf");
        addEndpointToGroup("Convert", "pdf-to-word");
        addEndpointToGroup("Convert", "pdf-to-presentation");
@@ -404,7 +395,6 @@ public class EndpointConfiguration {
        // Backend-only endpoints (not in frontend tool registry endpoints)
        addEndpointToGroup("Security", "redact");
        addEndpointToGroup("Security", "verify-pdf");
-        addEndpointToGroup("Security", "accessibility-report");
        addEndpointToGroup("Security", "sign");

        // Adding endpoints to "Other" group
@@ -539,8 +529,6 @@ public class EndpointConfiguration {
        addEndpointToGroup("Java", "json-to-pdf");
        addEndpointToGroup("Java", "pdf-to-video");
        addEndpointToGroup("Java", "verify-pdf");
-        addEndpointToGroup("Java", "pdf-to-ua");
-        addEndpointToGroup("Java", "accessibility-report");
        addEndpointToGroup("Java", "flatten");
        addEndpointToGroup("Java", "unlock-pdf-forms");
        addEndpointToGroup("Java", "validate-signature");
@@ -612,8 +600,6 @@ public class EndpointConfiguration {

        // veraPDF dependent endpoints
        addEndpointToGroup("veraPDF", "verify-pdf");
-        addEndpointToGroup("veraPDF", "pdf-to-ua");
-        addEndpointToGroup("veraPDF", "accessibility-report");

        // Pdftohtml dependent endpoints
        addEndpointToGroup("Pdftohtml", "pdf-to-html");
@@ -644,11 +630,6 @@ public class EndpointConfiguration {
            disableGroup("enterprise");
        }

-        if (!pdfUaAvailable) {
-            disableEndpoint("pdf-to-ua");
-            disableEndpoint("accessibility-report");
-        }
-
        if (!applicationProperties.getSystem().isEnableUrlToPDF()) {
            disableEndpoint("url-to-pdf");
        }
@@ -237,7 +237,7 @@ public class TabulaTableParser implements TableParser {
            score -= 0.3f;
        }

-        return Math.clamp(score, 0f, 1f);
+        return Math.max(0f, Math.min(1f, score));
    }

    private Bounds tableBounds(Table table) {
@@ -2,9 +2,7 @@ package stirling.software.common.aop;

 import java.io.IOException;
 import java.time.Duration;
-import java.util.ArrayList;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
@@ -85,8 +83,7 @@ public class AutoJobAspect {
                                    return joinPoint.proceed(args);
                                } catch (Throwable ex) {
                                    log.error(
-                                            "AutoJobAspect caught exception during job execution:"
-                                                    + " {}",
+                                            "AutoJobAspect caught exception during job execution: {}",
                                            ex.getMessage(),
                                            ex);
                                    // Rethrow RuntimeException as-is to preserve exception type
@@ -166,8 +163,8 @@ public class AutoJobAspect {
                                } catch (Throwable ex) {
                                    lastException = ex;
                                    log.error(
-                                            "AutoJobAspect caught exception during job execution"
-                                                    + " (attempt {}/{}): {}",
+                                            "AutoJobAspect caught exception during job execution (attempt"
+                                                    + " {}/{}): {}",
                                            currentAttempt,
                                            maxRetries,
                                            ex.getMessage(),
@@ -184,8 +181,7 @@ public class AutoJobAspect {
                                            String jobId = jobIdRef.get();
                                            if (jobId != null) {
                                                log.debug(
-                                                        "Recording retry attempt for job {} in"
-                                                                + " TaskManager",
+                                                        "Recording retry attempt for job {} in TaskManager",
                                                        jobId);
                                                // Retry info is tracked in TaskManager for REST API
                                                // access
@@ -277,7 +273,6 @@ public class AutoJobAspect {

                        // Store the fileId for later reference
                        pdfFile.setFileId(fileId);
-                        recordPendingInputFile(fileId);

                        // Replace the original MultipartFile with our persistent copy
                        MultipartFile persistentFile = fileStorage.retrieveFile(fileId);
@@ -295,29 +290,6 @@ public class AutoJobAspect {
        return originalArgs;
    }

-    /**
-     * Queue an input copy for attribution to the job. The job id does not exist yet at this point,
-     * so {@link JobExecutorService} drains this list once it mints one.
-     */
-    @SuppressWarnings("unchecked")
-    private void recordPendingInputFile(String fileId) {
-        try {
-            Object existing = request.getAttribute(JobExecutorService.PENDING_INPUT_FILE_IDS_ATTR);
-            List<String> ids;
-            if (existing instanceof List<?> list) {
-                ids = (List<String>) list;
-            } else {
-                ids = new ArrayList<>();
-                request.setAttribute(JobExecutorService.PENDING_INPUT_FILE_IDS_ATTR, ids);
-            }
-            ids.add(fileId);
-        } catch (RuntimeException ex) {
-            // Without a bound request the copy cannot be attributed; the periodic sweep is the
-            // only backstop, so make the miss visible rather than silently leaking the file.
-            log.warn("Could not record input copy {} for cleanup: {}", fileId, ex.getMessage());
-        }
-    }
-
    private String getJobIdFromContext() {
        try {
            return (String) request.getAttribute("jobId");
@@ -43,9 +43,9 @@ public class ClusterConfig {
        } else if ("inprocess".equalsIgnoreCase(backplane)) {
            // enabled+inprocess only coordinates the local JVM; cross-node lookups will 410.
            log.warn(
-                    "cluster.enabled=true with backplane=inprocess - only the local JVM is"
-                            + " coordinated. Cross-node lookups and the file proxy will fail. Use"
-                            + " backplane=valkey for real multi-node deployments.");
+                    "cluster.enabled=true with backplane=inprocess - only the local"
+                            + " JVM is coordinated. Cross-node lookups and the file proxy will fail."
+                            + " Use backplane=valkey for real multi-node deployments.");
        } else {
            // Fail fast on typos like "valky" so Spring doesn't later report a cryptic
            // "no ClusterBackplane bean" - the operator-facing error names the bad value.
@@ -73,7 +73,7 @@ public class RuntimePathConfig {
                        defaultWatchedFolders,
                        watchedFoldersDirs,
                        pipeline != null ? pipeline.getWatchedFoldersDir() : null);
-        this.pipelineWatchedFoldersPath = this.pipelineWatchedFoldersPaths.getFirst();
+        this.pipelineWatchedFoldersPath = this.pipelineWatchedFoldersPaths.get(0);
        this.pipelineFinishedFoldersPath =
                resolvePath(
                        defaultFinishedFolders,
@@ -230,14 +230,12 @@ public class RuntimePathConfig {
                // Check if one path is a parent of the other
                if (path1.startsWith(path2)) {
                    log.warn(
-                            "Watched folder path '{}' is nested inside '{}' - this may cause"
-                                    + " duplicate processing",
+                            "Watched folder path '{}' is nested inside '{}' - this may cause duplicate processing",
                            path1,
                            path2);
                } else if (path2.startsWith(path1)) {
                    log.warn(
-                            "Watched folder path '{}' is nested inside '{}' - this may cause"
-                                    + " duplicate processing",
+                            "Watched folder path '{}' is nested inside '{}' - this may cause duplicate processing",
                            path2,
                            path1);
                }
@@ -255,24 +253,21 @@ public class RuntimePathConfig {
                // Check if watched folder is same as finished folder
                if (watchedPath.equals(finishedPath)) {
                    log.error(
-                            "CRITICAL: Watched folder '{}' is the same as finished folder '{}' -"
-                                    + " this will cause processing loops!",
+                            "CRITICAL: Watched folder '{}' is the same as finished folder '{}' - this will cause processing loops!",
                            watchedPath,
                            finishedPath);
                }
                // Check if watched folder contains finished folder
                else if (finishedPath.startsWith(watchedPath)) {
                    log.warn(
-                            "Finished folder '{}' is nested inside watched folder '{}' - this may"
-                                    + " cause issues",
+                            "Finished folder '{}' is nested inside watched folder '{}' - this may cause issues",
                            finishedPath,
                            watchedPath);
                }
                // Check if finished folder contains watched folder
                else if (watchedPath.startsWith(finishedPath)) {
                    log.error(
-                            "CRITICAL: Watched folder '{}' is nested inside finished folder '{}' -"
-                                    + " this will cause processing loops!",
+                            "CRITICAL: Watched folder '{}' is nested inside finished folder '{}' - this will cause processing loops!",
                            watchedPath,
                            finishedPath);
                }
@@ -300,17 +295,15 @@ public class RuntimePathConfig {
                // Warn if manual endpoint count doesn't match sessionLimit
                if (configured.size() != sessionLimit) {
                    log.warn(
-                            "Manual UNO endpoint count ({}) differs from libreOfficeSessionLimit"
-                                    + " ({}). Concurrency will be limited by endpoint count, not"
-                                    + " sessionLimit.",
+                            "Manual UNO endpoint count ({}) differs from libreOfficeSessionLimit ({}). "
+                                    + "Concurrency will be limited by endpoint count, not sessionLimit.",
                            configured.size(),
                            sessionLimit);
                }
                return configured;
            }
            log.warn(
-                    "autoUnoServer disabled but no unoServerEndpoints configured; defaulting to"
-                            + " 127.0.0.1:2003.");
+                    "autoUnoServer disabled but no unoServerEndpoints configured; defaulting to 127.0.0.1:2003.");
            return Collections.singletonList(
                    new ApplicationProperties.ProcessExecutor.UnoServerEndpoint());
        }
@@ -144,8 +144,7 @@ public class ApplicationProperties {
                                    sizeInMB);
                        } else {
                            log.warn(
-                                    "SYSTEM_MAXFILESIZE value {} is out of valid range (1-999),"
-                                            + " ignoring",
+                                    "SYSTEM_MAXFILESIZE value {} is out of valid range (1-999), ignoring",
                                    sizeInMB);
                        }
                    } catch (NumberFormatException e) {
@@ -1317,7 +1316,7 @@ public class ApplicationProperties {
    public static class Ui {
        private String appNameNavbar;
        private List<String> languages;
-        private String logoStyle = "modern"; // Options: "modern" (default) or "classic"
+        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
        private boolean defaultHideUnavailableTools = false;
        private boolean defaultHideUnavailableConversions = false;
        private HideDisabledTools hideDisabledTools = new HideDisabledTools();
@@ -1328,10 +1327,10 @@ public class ApplicationProperties {

        public String getLogoStyle() {
            // Validate and return either "modern" or "classic"
-            if ("classic".equalsIgnoreCase(logoStyle)) {
-                return "classic";
+            if ("modern".equalsIgnoreCase(logoStyle)) {
+                return "modern";
            }
-            return "modern"; // default
+            return "classic"; // default
        }

        @Data
@@ -62,15 +62,6 @@ public class FormFieldWithCoordinates {
    @Schema(description = "Widget coordinates on each page (fields can have multiple widgets)")
    private List<WidgetCoordinates> widgets;

-    @Schema(description = "Maximum character count for a text field (/MaxLen); null when unset")
-    private Integer maxLength;
-
-    @Schema(
-            description =
-                    "Push button activation action as a spec string:"
-                            + " 'reset', 'print', 'uri:<url>' or 'submit:<url>'")
-    private String buttonActionSpec;
-
    /**
     * Coordinates for a single widget annotation (visual representation of the field). A field can
     * have multiple widgets if it appears on multiple pages.
@@ -103,12 +94,5 @@ public class FormFieldWithCoordinates {

        @Schema(description = "Font size in PDF points")
        private Float fontSize;
-
-        @Schema(
-                description =
-                        "CropBox height in PDF points. Lets the frontend reverse the backend's"
-                                + " Y-flip when sending new widget coordinates back for"
-                                + " create/modify operations.")
-        private Float cropBoxHeight;
    }
 }
@@ -24,8 +24,7 @@ public class PDFFile {

    @Schema(
            description =
-                    "File ID for server-side files (can be used instead of fileInput if job was"
-                            + " previously done on file in async mode)")
+                    "File ID for server-side files (can be used instead of fileInput if job was previously done on file in async mode)")
    private String fileId;

    @AssertTrue(message = "Either fileInput or fileId must be provided")
@@ -52,13 +52,6 @@ public class JobResult {
    /** Key/value metadata that survives the write-through into the shared job store. */
    private final Map<String, String> metadata = new ConcurrentHashMap<>();

-    /**
-     * File ids of the persistent input copies made for this job. An async submit copies the upload
-     * into FileStorage so the job can still read it after the request returns; without tracking
-     * them here nothing would ever delete those copies.
-     */
-    @JsonIgnore private final List<String> inputFileIds = new CopyOnWriteArrayList<>();
-
    /**
     * Create a new JobResult with the given job ID
     *
@@ -174,22 +167,6 @@ public class JobResult {
        return Collections.unmodifiableList(notes);
    }

-    /** Record a persistent input copy so job cleanup deletes it alongside the results. */
-    public void addInputFileId(String fileId) {
-        if (fileId != null && !fileId.isBlank() && !inputFileIds.contains(fileId)) {
-            this.inputFileIds.add(fileId);
-        }
-    }
-
-    /**
-     * File ids of this job's persistent input copies.
-     *
-     * @return An unmodifiable view of the input file ids
-     */
-    public List<String> getInputFileIds() {
-        return Collections.unmodifiableList(inputFileIds);
-    }
-
    /** Attach a metadata value, e.g. a policy id so cluster peers can identify a policy run. */
    public void putMetadata(String key, String value) {
        if (key != null && value != null) {
@@ -60,40 +60,54 @@ public class Provider {
    }

    private UsernameAttribute validateUsernameAttribute(UsernameAttribute usernameAttribute) {
-        return switch (name) {
-            case "google" -> validateGoogleUsernameAttribute(usernameAttribute);
-            case "github" -> validateGitHubUsernameAttribute(usernameAttribute);
-            case "keycloak" -> validateKeycloakUsernameAttribute(usernameAttribute);
-            default -> usernameAttribute;
-        };
+        switch (name) {
+            case "google" -> {
+                return validateGoogleUsernameAttribute(usernameAttribute);
+            }
+            case "github" -> {
+                return validateGitHubUsernameAttribute(usernameAttribute);
+            }
+            case "keycloak" -> {
+                return validateKeycloakUsernameAttribute(usernameAttribute);
+            }
+            default -> {
+                return usernameAttribute;
+            }
+        }
    }

    private UsernameAttribute validateKeycloakUsernameAttribute(
            UsernameAttribute usernameAttribute) {
-        return switch (usernameAttribute) {
-            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME, PREFERRED_USERNAME -> usernameAttribute;
+        switch (usernameAttribute) {
+            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME, PREFERRED_USERNAME -> {
+                return usernameAttribute;
+            }
            default ->
                    throw new UnsupportedClaimException(
                            String.format(EXCEPTION_MESSAGE, usernameAttribute, clientName));
-        };
+        }
    }

    private UsernameAttribute validateGoogleUsernameAttribute(UsernameAttribute usernameAttribute) {
-        return switch (usernameAttribute) {
-            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME -> usernameAttribute;
+        switch (usernameAttribute) {
+            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME -> {
+                return usernameAttribute;
+            }
            default ->
                    throw new UnsupportedClaimException(
                            String.format(EXCEPTION_MESSAGE, usernameAttribute, clientName));
-        };
+        }
    }

    private UsernameAttribute validateGitHubUsernameAttribute(UsernameAttribute usernameAttribute) {
-        return switch (usernameAttribute) {
-            case LOGIN, EMAIL, NAME -> usernameAttribute;
+        switch (usernameAttribute) {
+            case LOGIN, EMAIL, NAME -> {
+                return usernameAttribute;
+            }
            default ->
                    throw new UnsupportedClaimException(
                            String.format(EXCEPTION_MESSAGE, usernameAttribute, clientName));
-        };
+        }
    }

    @Override
@@ -361,8 +361,8 @@ public class PdfMarkdownConverter {
        if (xs.isEmpty()) {
            return List.of(lines);
        }
-        float minX = xs.getFirst();
-        float maxX = xs.getLast();
+        float minX = xs.get(0);
+        float maxX = xs.get(xs.size() - 1);
        float splitAt = (minX + maxX) / 2f;
        float biggestGap = 0;
        for (int i = 1; i < xs.size(); i++) {
@@ -492,7 +492,7 @@ public class PdfMarkdownConverter {

        List<List<Line>> anchorGroups = new ArrayList<>();
        List<Line> current = new ArrayList<>();
-        current.add(cands.getFirst());
+        current.add(cands.get(0));
        for (int i = 1; i < cands.size(); i++) {
            float gap = cands.get(i - 1).y - cands.get(i).y;
            if (gap > splitThreshold) {
@@ -513,8 +513,8 @@ public class PdfMarkdownConverter {
            if (anchors.size() < 2) {
                continue;
            }
-            float top = anchors.getFirst().y;
-            float bottom = anchors.getLast().y;
+            float top = anchors.get(0).y;
+            float bottom = anchors.get(anchors.size() - 1).y;

            // Each anchor seeds a row; absorb wrapped continuation lines (non-anchors within the
            // run's vertical span, with a little slack below the last row) into the anchor above.
@@ -674,8 +674,8 @@ public class PdfMarkdownConverter {
        float minGutter = Math.max(10f, charWidth * 2.5f);
        List<float[]> merged = new ArrayList<>();
        for (float[] band : columns) {
-            if (!merged.isEmpty() && band[0] - merged.getLast()[1] < minGutter) {
-                merged.getLast()[1] = band[1];
+            if (!merged.isEmpty() && band[0] - merged.get(merged.size() - 1)[1] < minGutter) {
+                merged.get(merged.size() - 1)[1] = band[1];
            } else {
                merged.add(new float[] {band[0], band[1]});
            }
@@ -734,7 +734,7 @@ public class PdfMarkdownConverter {
            }
        }
        StringBuilder sb = new StringBuilder();
-        sb.append(buildGfmRow(rows.getFirst(), widths, cols)).append('\n');
+        sb.append(buildGfmRow(rows.get(0), widths, cols)).append('\n');
        sb.append('|');
        for (int c = 0; c < cols; c++) {
            sb.append('-').append("-".repeat(widths[c])).append('-').append('|');
@@ -910,8 +910,8 @@ public class PdfMarkdownConverter {
        }
        // Only merge a sentence continuation between two text paragraphs, never into/out of a
        // table.
-        if (!(output.getLast() instanceof String last)
-                || !(pageItems.getFirst() instanceof String first)) {
+        if (!(output.get(output.size() - 1) instanceof String last)
+                || !(pageItems.get(0) instanceof String first)) {
            return;
        }
        if (!first.isEmpty()
@@ -932,13 +932,13 @@ public class PdfMarkdownConverter {
        for (Object e : elements) {
            if (e instanceof TableBlock tb
                    && !out.isEmpty()
-                    && out.getLast() instanceof TableBlock prev
+                    && out.get(out.size() - 1) instanceof TableBlock prev
                    && columnsMatch(flatten(prev.rows()), flatten(tb.rows()))) {
                List<List<Line>> merged = new ArrayList<>(prev.rows());
                List<List<Line>> tail = tb.rows();
                if (!tail.isEmpty()
                        && !prev.rows().isEmpty()
-                        && rowText(tail.getFirst()).equals(rowText(prev.rows().getFirst()))) {
+                        && rowText(tail.get(0)).equals(rowText(prev.rows().get(0)))) {
                    tail = tail.subList(1, tail.size());
                }
                merged.addAll(tail);
@@ -971,7 +971,7 @@ public class PdfMarkdownConverter {
                continue;
            }
            if (e instanceof TableBlock tb && !tb.rows().isEmpty()) {
-                return rowText(tb.rows().getFirst());
+                return rowText(tb.rows().get(0));
            }
            return null;
        }
@@ -729,32 +729,4 @@ public class CustomPDFDocumentFactory {
        p.toFile().deleteOnExit();
        return p;
    }
-
-    /** A custom RandomAccessRead implementation that deletes the file when closed */
-    private static class DeletingRandomAccessFile extends RandomAccessReadBufferedFile {
-        private final Path tempFilePath;
-
-        public DeletingRandomAccessFile(File file) throws IOException {
-            super(file);
-            this.tempFilePath = file.toPath();
-        }
-
-        @Override
-        public void close() throws IOException {
-            try {
-                super.close();
-            } finally {
-                try {
-                    boolean deleted = Files.deleteIfExists(tempFilePath);
-                    if (deleted) {
-                        log.info("Successfully deleted temp file: {}", tempFilePath);
-                    } else {
-                        log.warn("Failed to delete temp file (may not exist): {}", tempFilePath);
-                    }
-                } catch (IOException e) {
-                    log.error("Error deleting temp file: {}", tempFilePath, e);
-                }
-            }
-        }
-    }
 }
@@ -179,21 +179,6 @@ public class FileStorage {
        return fileStore.delete(fileId);
    }

-    /**
-     * Delete a stored file without the per-file ownership check.
-     *
-     * <p>Job cleanup authorises at the job level and then deletes that job's own files, so the
-     * deleter is legitimately not their owner - an admin sweeping every user's jobs, or the
-     * unauthenticated scheduled task. Routing those through {@link #deleteFile(String)} makes the
-     * ownership check throw and silently orphans the files on disk.
-     *
-     * <p>Only ever pass file ids read back off a job that the caller has already been authorised
-     * for; never a caller-supplied id.
-     */
-    public boolean deleteFileAsSystem(String fileId) {
-        return fileStore.delete(fileId);
-    }
-
    public boolean fileExists(String fileId) {
        enforceOwnership(fileId);
        return fileStore.exists(fileId);
@@ -157,7 +157,7 @@ public class InternalApiClient {
        boolean hasFilePart =
                body.values().stream()
                        .flatMap(java.util.List::stream)
-                        .anyMatch(Resource.class::isInstance);
+                        .anyMatch(v -> v instanceof Resource);
        if (isAiTool && !hasFilePart) {
            headers.setContentType(MediaType.MULTIPART_FORM_DATA);
        }
@@ -1,7 +1,6 @@
 package stirling.software.common.service;

 import java.io.IOException;
-import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.CompletableFuture;
@@ -34,14 +33,6 @@ import stirling.software.common.util.RegexPatternUtils;
@Slf4j
 public class JobExecutorService {

-    /**
-     * Request attribute holding the FileStorage ids of persistent input copies made for the job
-     * about to be created. Populated before the job id exists (the aspect copies the upload while
-     * processing arguments), drained onto the JobResult as soon as the task is created so cleanup
-     * can delete them.
-     */
-    public static final String PENDING_INPUT_FILE_IDS_ATTR = "autoJobPendingInputFileIds";
-
    private final TaskManager taskManager;
    private final FileStorage fileStorage;
    private final HttpServletRequest request;
@@ -142,7 +133,6 @@ public class JobExecutorService {
                    resourceWeight);

            taskManager.createTask(jobId);
-            registerPendingInputFiles(jobId);

            final String capturedJobIdForQueue = jobId;
            Supplier<Object> wrappedWork =
@@ -173,7 +163,6 @@ public class JobExecutorService {
            return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
        } else if (async) {
            taskManager.createTask(jobId);
-            registerPendingInputFiles(jobId);

            final String capturedJobId = jobId;

@@ -495,30 +484,4 @@ public class JobExecutorService {
        }
        return baseJobId;
    }
-
-    /**
-     * Hand the input copies made while processing arguments to the freshly created job, so job
-     * cleanup deletes them. Drains the attribute so a retry cannot attribute the same ids twice.
-     */
-    @SuppressWarnings("unchecked")
-    private void registerPendingInputFiles(String jobId) {
-        if (request == null) {
-            return;
-        }
-        Object pending;
-        try {
-            pending = request.getAttribute(PENDING_INPUT_FILE_IDS_ATTR);
-            request.removeAttribute(PENDING_INPUT_FILE_IDS_ATTR);
-        } catch (RuntimeException ex) {
-            // No request bound to this thread (e.g. an internally dispatched job).
-            log.debug("Could not read pending input file ids: {}", ex.getMessage());
-            return;
-        }
-        if (!(pending instanceof List<?> ids)) {
-            return;
-        }
-        for (String fileId : (List<String>) ids) {
-            taskManager.registerInputFile(jobId, fileId);
-        }
-    }
 }
@@ -1,22 +0,0 @@
-package stirling.software.common.service;
-
-import java.util.List;
-
-/**
- * Raises a converted PDF/A file from conformance level B to level A, which needs the tagging the
- * PDF/UA tagger does. Implemented only in the proprietary module; core builds convert at level B.
- */
-public interface PdfaLevelAServiceInterface {
-
-    /**
-     * @param levelA true only when the file was tagged and validated, so the claim is never a guess
-     */
-    record Result(byte[] pdfBytes, boolean levelA, List<String> warnings) {}
-
-    /**
-     * @param part PDF/A part, 1 to 3; part 1 keeps its PDF 1.4 version
-     * @param alsoDeclareUa additionally claim PDF/UA, but only if it validates
-     */
-    Result upgradeToLevelA(
-            byte[] pdfBytes, int part, String language, String title, boolean alsoDeclareUa);
-}
@@ -209,8 +209,7 @@ public class ResourceMonitor {
                    return (double) m.invoke(osMXBean);
                } catch (Exception e2) {
                    log.trace(
-                            "Could not get CPU load through reflection, assuming moderate load"
-                                    + " (0.5)");
+                            "Could not get CPU load through reflection, assuming moderate load (0.5)");
                    return 0.5;
                }
            }
@@ -17,7 +17,6 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
-import java.util.function.Predicate;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;

@@ -235,24 +234,6 @@ public class TaskManager {
        return false;
    }

-    /**
-     * Record a persistent input copy against a job so cleanup deletes it with the results.
-     *
-     * @param jobId The job ID
-     * @param fileId The FileStorage id of the input copy
-     * @return true if the job exists and the id was recorded
-     */
-    public boolean registerInputFile(String jobId, String fileId) {
-        JobResult jobResult = jobResults.get(jobId);
-        if (jobResult == null) {
-            log.warn("Attempted to register an input file against non-existent job ID: {}", jobId);
-            return false;
-        }
-        jobResult.addInputFileId(fileId);
-        log.debug("Registered input file {} for job {}", fileId, jobId);
-        return true;
-    }
-
    /** Attach metadata to a job and write it through to the shared store for cluster peers. */
    public boolean putMetadata(String jobId, String key, String value) {
        JobResult jobResult = jobResults.get(jobId);
@@ -348,59 +329,25 @@ public class TaskManager {
        return jobResults.computeIfAbsent(jobId, JobResult::createNew);
    }

-    /**
-     * What a cleanup pass removed. Returned by the on-demand cleanup so callers can assert on it.
-     */
-    public record CleanupSummary(int jobsRemoved, int filesDeleted, int jobsRetained) {}
-
    /** Clean up old completed job results. No-op in cluster mode; the backplane TTL owns expiry. */
-    public CleanupSummary cleanupOldJobs() {
+    public void cleanupOldJobs() {
        if (clusterBackplane != null && !clusterBackplane.shouldRunLocalCleanup()) {
-            return new CleanupSummary(0, 0, jobResults.size());
+            return;
        }
-        return cleanupJobs(false, jobId -> true);
-    }
-
-    /**
-     * Force-expire this node's finished jobs now, ignoring the age threshold. Jobs still running
-     * are left alone - deleting their files mid-flight would break them - and are reported as
-     * retained.
-     *
-     * <p>Unlike {@link #cleanupOldJobs()} this always runs locally: it is an explicit request to
-     * release this node's storage, not the scheduled sweep the backplane TTL owns.
-     *
-     * @param jobIdFilter Only jobs whose id passes this predicate are considered, so a caller can
-     *     restrict the sweep to jobs the requester is allowed to touch
-     * @return What was removed
-     */
-    public CleanupSummary cleanupFinishedJobsNow(Predicate<String> jobIdFilter) {
-        return cleanupJobs(true, jobIdFilter);
-    }
-
-    private CleanupSummary cleanupJobs(boolean force, Predicate<String> filter) {
        LocalDateTime expiryThreshold =
                LocalDateTime.now().minus(jobResultExpiryMinutes, ChronoUnit.MINUTES);
        LocalDateTime pendingExpiryThreshold =
                LocalDateTime.now().minus(pendingJobExpiryMinutes, ChronoUnit.MINUTES);
        int removedCount = 0;
-        int filesDeleted = 0;
-        int retainedCount = 0;

        try {
            for (Map.Entry<String, JobResult> entry : jobResults.entrySet()) {
                JobResult result = entry.getValue();

-                if (!filter.test(entry.getKey())) {
-                    retainedCount++;
-                    continue;
-                }
-
                boolean expiredCompletedJob =
                        result.isComplete()
-                                && (force
-                                        || (result.getCompletedAt() != null
-                                                && result.getCompletedAt()
-                                                        .isBefore(expiryThreshold)));
+                                && result.getCompletedAt() != null
+                                && result.getCompletedAt().isBefore(expiryThreshold);
                boolean abandonedPendingJob =
                        !result.isComplete()
                                && result.getCreatedAt() != null
@@ -413,7 +360,7 @@ public class TaskManager {

                    // Clean up file results
                    if (expiredCompletedJob) {
-                        filesDeleted += cleanupJobFiles(result, entry.getKey());
+                        cleanupJobFiles(result, entry.getKey());
                    }

                    // Remove the job result
@@ -422,22 +369,15 @@ public class TaskManager {
                        jobStore.delete(entry.getKey());
                    }
                    removedCount++;
-                } else {
-                    retainedCount++;
                }
            }

            if (removedCount > 0) {
-                log.info(
-                        "Cleaned up {} {} job results ({} files deleted)",
-                        removedCount,
-                        force ? "finished" : "expired",
-                        filesDeleted);
+                log.info("Cleaned up {} expired job results", removedCount);
            }
        } catch (Exception e) {
            log.error("Error during job cleanup: {}", e.getMessage(), e);
        }
-        return new CleanupSummary(removedCount, filesDeleted, retainedCount);
    }

    /** Mirror the in-memory {@code JobResult} into the cluster-visible {@link JobStore}. */
@@ -585,43 +525,22 @@ public class TaskManager {
        }
    }

-    /**
-     * Clean up files associated with a job result: both the results and the persistent input copy
-     * an async submit made of the upload.
-     *
-     * @return The number of files actually deleted
-     */
-    private int cleanupJobFiles(JobResult result, String jobId) {
-        int deleted = 0;
+    /** Clean up files associated with a job result */
+    private void cleanupJobFiles(JobResult result, String jobId) {
        // Clean up all result files
        if (result.hasFiles()) {
            for (ResultFile resultFile : result.getAllResultFiles()) {
-                if (deleteJobFile(resultFile.getFileId(), jobId)) {
-                    deleted++;
+                try {
+                    fileStorage.deleteFile(resultFile.getFileId());
+                } catch (Exception e) {
+                    log.warn(
+                            "Failed to delete file {} for job {}: {}",
+                            resultFile.getFileId(),
+                            jobId,
+                            e.getMessage());
                }
            }
        }
-        for (String inputFileId : result.getInputFileIds()) {
-            if (deleteJobFile(inputFileId, jobId)) {
-                deleted++;
-            }
-        }
-        return deleted;
-    }
-
-    /**
-     * Deletes as the system, not as the caller: an admin sweeping another user's jobs, or the
-     * scheduled task running with no security context, is not the file's owner, and the
-     * ownership-checked delete would throw and leave the file orphaned on disk. The job itself is
-     * already authorised by the time we get here, and these ids come off that job, not the request.
-     */
-    private boolean deleteJobFile(String fileId, String jobId) {
-        try {
-            return fileStorage.deleteFileAsSystem(fileId);
-        } catch (Exception e) {
-            log.warn("Failed to delete file {} for job {}: {}", fileId, jobId, e.getMessage());
-            return false;
-        }
    }

    /** Find the ResultFile metadata for a given file ID by searching through all job results */
@@ -167,8 +167,7 @@ public class TempFileCleanupService {
                || unregisteredDeletedCount > 0
                || directoriesDeletedCount > 0) {
            log.info(
-                    "Scheduled cleanup complete. Deleted {} registered files, {} unregistered"
-                            + " files, {} directories",
+                    "Scheduled cleanup complete. Deleted {} registered files, {} unregistered files, {} directories",
                    registeredDeletedCount,
                    unregisteredDeletedCount,
                    directoriesDeletedCount);
@@ -253,8 +252,7 @@ public class TempFileCleanupService {
                                                dirDeletedCount.incrementAndGet();
                                                if (log.isDebugEnabled()) {
                                                    log.debug(
-                                                            "Deleted temp file during {} cleanup:"
-                                                                    + " {}",
+                                                            "Deleted temp file during {} cleanup: {}",
                                                            phase,
                                                            path);
                                                }
@@ -41,8 +41,7 @@ public class AttachmentUtils {
                viewerPrefs.setBoolean(COSName.getPDFName("DisplayDocTitle"), true);

                log.info(
-                        "Set PDF PageMode to UseAttachments to automatically show attachments"
-                                + " pane");
+                        "Set PDF PageMode to UseAttachments to automatically show attachments pane");
            }
        } catch (Exception e) {
            log.error("Failed to set catalog viewer preferences for attachments", e);
@@ -140,25 +140,20 @@ public class ChecksumUtils {

        for (String algorithm : algorithms) {
            String key = algorithm; // keep original key for output
-            Object digestOrChecksum =
-                    switch (algorithm.toUpperCase(Locale.ROOT)) {
-                        case "CRC32" -> new CRC32();
-                        case "ADLER32" -> new Adler32();
-                        default -> {
-                            try {
-                                // For MessageDigest, pass the original name (case-insensitive
-                                // per JCA)
-                                yield MessageDigest.getInstance(algorithm);
-                            } catch (NoSuchAlgorithmException e) {
-                                throw new IllegalStateException(
-                                        "Unsupported algorithm: " + algorithm, e);
-                            }
-                        }
-                    };
-            if (digestOrChecksum instanceof Checksum checksum) {
-                checksums.put(key, checksum);
-            } else {
-                digests.put(key, (MessageDigest) digestOrChecksum);
+            switch (algorithm.toUpperCase(Locale.ROOT)) {
+                case "CRC32":
+                    checksums.put(key, new CRC32());
+                    break;
+                case "ADLER32":
+                    checksums.put(key, new Adler32());
+                    break;
+                default:
+                    try {
+                        // For MessageDigest, pass the original name (case-insensitive per JCA)
+                        digests.put(key, MessageDigest.getInstance(algorithm));
+                    } catch (NoSuchAlgorithmException e) {
+                        throw new IllegalStateException("Unsupported algorithm: " + algorithm, e);
+                    }
            }
        }

@@ -342,26 +342,26 @@ public class EmlProcessingUtils {

    private String getFallbackStyles() {
        return """
-        /* Minimal fallback - main CSS resource failed to load */
-        body {
-            font-family: var(--font-family, Helvetica, sans-serif);
-            font-size: var(--font-size, 12px);
-            line-height: var(--line-height, 1.4);
-            color: var(--text-color, #202124);
-            margin: 0;
-            padding: 20px;
-            word-wrap: break-word;
-        }
-        .email-container { max-width: 100%; }
-        .email-header { border-bottom: 1px solid #ccc; margin-bottom: 16px; padding-bottom: 12px; }
-        .email-header h1 { margin: 0 0 8px 0; font-size: 18px; }
-        .email-meta { font-size: 12px; color: #666; }
-        .email-body { line-height: 1.6; }
-        .attachment-section { margin-top: 20px; padding: 12px; background: #f5f5f5; border-radius: 4px; }
-        .attachment-item { padding: 6px 0; border-bottom: 1px solid #ddd; }
-        .no-content { padding: 20px; text-align: center; color: #888; font-style: italic; }
-        img { max-width: 100%; height: auto; }
-        """;
+            /* Minimal fallback - main CSS resource failed to load */
+            body {
+                font-family: var(--font-family, Helvetica, sans-serif);
+                font-size: var(--font-size, 12px);
+                line-height: var(--line-height, 1.4);
+                color: var(--text-color, #202124);
+                margin: 0;
+                padding: 20px;
+                word-wrap: break-word;
+            }
+            .email-container { max-width: 100%; }
+            .email-header { border-bottom: 1px solid #ccc; margin-bottom: 16px; padding-bottom: 12px; }
+            .email-header h1 { margin: 0 0 8px 0; font-size: 18px; }
+            .email-meta { font-size: 12px; color: #666; }
+            .email-body { line-height: 1.6; }
+            .attachment-section { margin-top: 20px; padding: 12px; background: #f5f5f5; border-radius: 4px; }
+            .attachment-item { padding: 6px 0; border-bottom: 1px solid #ddd; }
+            .no-content { padding: 20px; text-align: center; color: #888; font-style: italic; }
+            img { max-width: 100%; height: auto; }
+            """;
    }

    private void appendAttachmentsSection(
@@ -290,8 +290,7 @@ public class ExceptionUtils {
        // Additional safety check: warn about very large images (> 1GB estimated)
        if (estimatedBytes > 1024L * 1024 * 1024) {
            log.warn(
-                    "Page {} will create a very large image: {}x{} pixels (~{} MB) at {} DPI. This"
-                            + " may cause memory issues.",
+                    "Page {} will create a very large image: {}x{} pixels (~{} MB) at {} DPI. This may cause memory issues.",
                    pageNumber,
                    widthInPixels,
                    heightInPixels,
@@ -395,8 +394,7 @@ public class ExceptionUtils {
            message = getMessage(contextKey, defaultMsg, context);
        } else {
            message =
-                    "PDF file appears to be corrupted or damaged. Please try using the 'Repair PDF'"
-                        + " feature first to fix the file before proceeding with this operation.";
+                    "PDF file appears to be corrupted or damaged. Please try using the 'Repair PDF' feature first to fix the file before proceeding with this operation.";
        }

        return new PdfCorruptedException(message, cause, ErrorCode.PDF_CORRUPTED.getCode());
@@ -753,7 +751,7 @@ public class ExceptionUtils {
        String targetDescription;
        if (errorInfo.affectedPages() != null && !errorInfo.affectedPages().isEmpty()) {
            if (errorInfo.affectedPages().size() == 1) {
-                targetDescription = "page " + errorInfo.affectedPages().getFirst();
+                targetDescription = "page " + errorInfo.affectedPages().get(0);
            } else {
                targetDescription =
                        "pages "
@@ -850,7 +848,7 @@ public class ExceptionUtils {
            }

            // Use the first page number, or null if none found
-            Integer pageNumber = affectedPages.isEmpty() ? null : affectedPages.getFirst();
+            Integer pageNumber = affectedPages.isEmpty() ? null : affectedPages.get(0);

            return new GhostscriptErrorInfo(
                    ErrorCode.GHOSTSCRIPT_PAGE_DRAWING,
@@ -1121,25 +1119,19 @@ public class ExceptionUtils {
        PDF_CORRUPTED(
                "E001",
                "error.pdfCorrupted",
-                "PDF file appears to be corrupted or damaged. Please try using the 'Repair PDF'"
-                        + " feature first to fix the file before proceeding with this operation."),
+                "PDF file appears to be corrupted or damaged. Please try using the 'Repair PDF' feature first to fix the file before proceeding with this operation."),
        PDF_MULTIPLE_CORRUPTED(
                "E002",
                "error.multiplePdfCorrupted",
-                "One or more PDF files appear to be corrupted or damaged. Please try using the"
-                    + " 'Repair PDF' feature on each file first before attempting to merge them."),
+                "One or more PDF files appear to be corrupted or damaged. Please try using the 'Repair PDF' feature on each file first before attempting to merge them."),
        PDF_ENCRYPTION(
                "E003",
                "error.pdfEncryption",
-                "The PDF appears to have corrupted encryption data. This can happen when the PDF"
-                        + " was created with incompatible encryption methods. Please try using the"
-                        + " 'Repair PDF' feature first, or contact the document creator for a new"
-                        + " copy."),
+                "The PDF appears to have corrupted encryption data. This can happen when the PDF was created with incompatible encryption methods. Please try using the 'Repair PDF' feature first, or contact the document creator for a new copy."),
        PDF_PASSWORD(
                "E004",
                "error.pdfPassword",
-                "The PDF Document is passworded and either the password was not provided or was"
-                        + " incorrect"),
+                "The PDF Document is passworded and either the password was not provided or was incorrect"),
        PDF_NO_PAGES("E005", "error.pdfNoPages", "PDF file contains no pages"),
        PDF_NOT_PDF("E006", "error.notPdfFile", "File must be in PDF format"),

@@ -1147,25 +1139,20 @@ public class ExceptionUtils {
        CBR_INVALID_FORMAT(
                "E010",
                "error.cbrInvalidFormat",
-                "Invalid or corrupted CBR/RAR archive. The file may be corrupted, use an"
-                        + " unsupported RAR format (RAR5+), encrypted, or may not be a valid RAR"
-                        + " archive."),
+                "Invalid or corrupted CBR/RAR archive. The file may be corrupted, use an unsupported RAR format (RAR5+), encrypted, or may not be a valid RAR archive."),
        CBR_NO_IMAGES(
                "E012",
                "error.cbrNoImages",
-                "No valid images found in the CBR file. The archive may be empty, or all images may"
-                        + " be corrupted or in unsupported formats."),
+                "No valid images found in the CBR file. The archive may be empty, or all images may be corrupted or in unsupported formats."),
        CBR_NOT_CBR("E014", "error.notCbrFile", "File must be a CBR or RAR archive"),
        CBZ_INVALID_FORMAT(
                "E015",
                "error.cbzInvalidFormat",
-                "Invalid or corrupted CBZ/ZIP archive. The file may be empty, corrupted, or may not"
-                        + " be a valid ZIP archive."),
+                "Invalid or corrupted CBZ/ZIP archive. The file may be empty, corrupted, or may not be a valid ZIP archive."),
        CBZ_NO_IMAGES(
                "E016",
                "error.cbzNoImages",
-                "No valid images found in the CBZ file. The archive may be empty, or all images may"
-                        + " be corrupted or in unsupported formats."),
+                "No valid images found in the CBZ file. The archive may be empty, or all images may be corrupted or in unsupported formats."),
        CBZ_NOT_CBZ("E018", "error.notCbzFile", "File must be a CBZ or ZIP archive"),

        // EML errors
@@ -1218,8 +1205,7 @@ public class ExceptionUtils {
        FFMPEG_REQUIRED(
                "E063",
                "error.ffmpegRequired",
-                "FFmpeg must be installed to convert PDFs to video. Install FFmpeg and ensure it is"
-                        + " available on the system PATH."),
+                "FFmpeg must be installed to convert PDFs to video. Install FFmpeg and ensure it is available on the system PATH."),

        // Validation errors
        INVALID_ARGUMENT("E070", "error.invalidArgument", "Invalid argument ''{0}'': {1}"),
@@ -1235,10 +1221,7 @@ public class ExceptionUtils {
        OUT_OF_MEMORY_DPI(
                "E081",
                "error.outOfMemoryDpi",
-                "Out of memory or image-too-large error while rendering PDF page {0} at {1} DPI."
-                    + " This can occur when the resulting image exceeds Java's array/memory limits"
-                    + " (e.g., NegativeArraySizeException). Please use a lower DPI value"
-                    + " (recommended: 150 or less) or process the document in smaller chunks.");
+                "Out of memory or image-too-large error while rendering PDF page {0} at {1} DPI. This can occur when the resulting image exceeds Java's array/memory limits (e.g., NegativeArraySizeException). Please use a lower DPI value (recommended: 150 or less) or process the document in smaller chunks.");

        private final String code;
        private final String messageKey;
@@ -3,20 +3,14 @@ package stirling.software.common.util;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Optional;
 import java.util.function.Function;
-import java.util.regex.Pattern;
 import java.util.stream.Collectors;

 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.pdmodel.graphics.color.PDColor;
 import org.apache.pdfbox.pdmodel.graphics.color.PDDeviceRGB;
-import org.apache.pdfbox.pdmodel.interactive.action.PDActionNamed;
-import org.apache.pdfbox.pdmodel.interactive.action.PDActionResetForm;
-import org.apache.pdfbox.pdmodel.interactive.action.PDActionSubmitForm;
-import org.apache.pdfbox.pdmodel.interactive.action.PDActionURI;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAppearanceCharacteristicsDictionary;
 import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
@@ -65,24 +59,6 @@ public enum FormFieldTypeSupport {
                List<String> options)
                throws IOException {
            PDTextField textField = (PDTextField) field;
-            if (definition.fontSize() != null && definition.fontSize() > 0) {
-                textField.setDefaultAppearance("/Helv " + definition.fontSize() + " Tf 0 g");
-            }
-            if (Boolean.TRUE.equals(definition.multiline())) {
-                textField.setMultiline(true);
-            }
-            // Comb field: evenly spaced character cells (e.g. SSN, phone). Requires
-            // a positive MaxLen and is mutually exclusive with multiline.
-            if (definition.maxLength() != null && definition.maxLength() > 0) {
-                textField.setMaxLen(definition.maxLength());
-                if (!Boolean.TRUE.equals(definition.multiline())) {
-                    try {
-                        textField.setComb(true);
-                    } catch (Exception e) {
-                        log.debug("Unable to set comb flag: {}", e.getMessage());
-                    }
-                }
-            }
            String defaultValue = Optional.ofNullable(definition.defaultValue()).orElse("");
            if (!defaultValue.isBlank()) {
                FormUtils.setTextValue(textField, defaultValue);
@@ -138,7 +114,7 @@ public enum FormFieldTypeSupport {
                    return;
                }

-                PDAnnotationWidget widget = checkBox.getWidgets().getFirst();
+                PDAnnotationWidget widget = checkBox.getWidgets().get(0);

                PDAppearanceCharacteristicsDictionary appearanceChars =
                        widget.getAppearanceCharacteristics();
@@ -296,108 +272,14 @@ public enum FormFieldTypeSupport {
        PDTerminalField createField(PDAcroForm acroForm) {
            return new PDSignatureField(acroForm);
        }
-
-        @Override
-        boolean doesNotsupportsDefinitionCreation() {
-            return false;
-        }
-        // Empty signature placeholder: no value to apply (signed later by a sign tool).
    },
    BUTTON("button", "pushButton", PDPushButton.class) {
        @Override
        PDTerminalField createField(PDAcroForm acroForm) {
            return new PDPushButton(acroForm);
        }
-
-        @Override
-        boolean doesNotsupportsDefinitionCreation() {
-            return false;
-        }
-
-        @Override
-        void applyNewFieldDefinition(
-                PDTerminalField field,
-                FormUtils.NewFormFieldDefinition definition,
-                List<String> options)
-                throws IOException {
-            if (field.getWidgets().isEmpty()) {
-                return;
-            }
-            PDAnnotationWidget widget = field.getWidgets().get(0);
-
-            // Visible caption (/MK /CA).
-            String caption = definition.label();
-            if (caption == null || caption.isBlank()) {
-                caption = definition.name();
-            }
-            if (caption != null && !caption.isBlank()) {
-                PDAppearanceCharacteristicsDictionary mk = widget.getAppearanceCharacteristics();
-                if (mk == null) {
-                    mk = new PDAppearanceCharacteristicsDictionary(widget.getCOSObject());
-                    widget.setAppearanceCharacteristics(mk);
-                }
-                mk.setNormalCaption(caption);
-            }
-            widget.setPrinted(true);
-
-            applyButtonAction(widget, definition.buttonAction());
-        }
    };

-    /**
-     * Writes a push button's activation action from a "reset"/"print"/"uri:"/"submit:" spec,
-     * returning why it could not, or null on success. A blank spec clears the action.
-     */
-    public static String applyButtonAction(PDAnnotationWidget widget, String action) {
-        if (action == null) {
-            return null;
-        }
-        if (action.isBlank()) {
-            // An explicit blank clears the action rather than leaving the old one behind.
-            widget.getCOSObject().removeItem(COSName.A);
-            return null;
-        }
-        String spec = action.trim();
-        if (!ACTION_SPEC.matcher(spec).matches()) {
-            return "'" + action + "' is not a button action this editor understands";
-        }
-        // The editor emits "uri:" the moment that kind is picked, before a URL is typed; an
-        // empty target is not yet an action, so clear rather than write an inert one.
-        int colon = spec.indexOf(':');
-        if (colon >= 0 && spec.substring(colon + 1).isBlank()) {
-            widget.getCOSObject().removeItem(COSName.A);
-            return null;
-        }
-        try {
-            String lower = spec.toLowerCase(Locale.ROOT);
-            if (lower.equals("reset")) {
-                widget.getCOSObject().setItem(COSName.A, new PDActionResetForm().getCOSObject());
-            } else if (lower.equals("print")) {
-                PDActionNamed named = new PDActionNamed();
-                named.setN("Print");
-                widget.getCOSObject().setItem(COSName.A, named.getCOSObject());
-            } else if (lower.startsWith("uri:")) {
-                PDActionURI uri = new PDActionURI();
-                uri.setURI(spec.substring(4));
-                widget.getCOSObject().setItem(COSName.A, uri.getCOSObject());
-            } else if (lower.startsWith("submit:")) {
-                PDActionSubmitForm submit = new PDActionSubmitForm();
-                // Store the target URL on the action dictionary's /F entry.
-                submit.getCOSObject().setString(COSName.F, spec.substring(7));
-                widget.getCOSObject().setItem(COSName.A, submit.getCOSObject());
-            }
-            return null;
-        } catch (Exception e) {
-            log.debug("Unable to apply button action '{}': {}", action, e.getMessage());
-            return e.getMessage();
-        }
-    }
-
-    /** The spec forms applyButtonAction understands; anything else is reported, not dropped. */
-    private static final Pattern ACTION_SPEC =
-            Pattern.compile(
-                    "^(reset|print|uri:.*|submit:.*)$", Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
-
    private static final Map<String, FormFieldTypeSupport> BY_TYPE =
            Arrays.stream(values())
                    .collect(
@@ -12,7 +12,6 @@ import java.nio.file.*;
 import java.nio.file.attribute.BasicFileAttributes;
 import java.security.MessageDigest;
 import java.util.*;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;

@@ -55,10 +54,6 @@ public class GeneralUtils {

    private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";
    private final String PYTHON_SCRIPTS_DIR = "python";
-
-    // Extracted once per run. Rewriting a script while another request is exec-ing it
-    // races wherever rename is not atomic, such as 9p or NFS bind mounts.
-    private final Map<String, Path> EXTRACTED_SCRIPTS = new ConcurrentHashMap<>();
    private final RegexPatternUtils patternCache = RegexPatternUtils.getInstance();
    // Valid size units used for convertSizeToBytes validation and parsing
    private final Set<String> VALID_SIZE_UNITS = Set.of("B", "KB", "MB", "GB", "TB");
@@ -1030,30 +1025,17 @@ public class GeneralUtils {
        }

        Path scriptsDir = Path.of(InstallationPathConfig.getScriptsPath(), PYTHON_SCRIPTS_DIR);
+        Files.createDirectories(scriptsDir);
+
        Path target = scriptsDir.resolve(scriptName);
-
-        Path cached = EXTRACTED_SCRIPTS.get(scriptName);
-        if (cached != null && Files.isRegularFile(cached)) {
-            return cached;
-        }
-
-        synchronized (EXTRACTED_SCRIPTS) {
-            cached = EXTRACTED_SCRIPTS.get(scriptName);
-            if (cached != null && Files.isRegularFile(cached)) {
-                return cached;
-            }
-
-            Files.createDirectories(scriptsDir);
-            ClassPathResource res =
-                    new ClassPathResource("static/" + PYTHON_SCRIPTS_DIR + "/" + scriptName);
-            if (!res.exists()) {
-                log.error("Resource not found: {}", res.getPath());
-                throw new IOException("Resource not found: " + res.getPath());
-            }
-            copyResourceToFile(res, target);
-            EXTRACTED_SCRIPTS.put(scriptName, target);
-            return target;
+        ClassPathResource res =
+                new ClassPathResource("static/" + PYTHON_SCRIPTS_DIR + "/" + scriptName);
+        if (!res.exists()) {
+            log.error("Resource not found: {}", res.getPath());
+            throw new IOException("Resource not found: " + res.getPath());
        }
+        copyResourceToFile(res, target);
+        return target;
    }

    /*
@@ -26,27 +26,29 @@ import lombok.extern.slf4j.Slf4j;
 public class ImageProcessingUtils {

    static BufferedImage convertColorType(BufferedImage sourceImage, String colorType) {
-        return switch (colorType) {
-            case "greyscale" -> {
-                BufferedImage convertedImage =
+        BufferedImage convertedImage;
+        switch (colorType) {
+            case "greyscale":
+                convertedImage =
                        new BufferedImage(
                                sourceImage.getWidth(),
                                sourceImage.getHeight(),
                                BufferedImage.TYPE_BYTE_GRAY);
                convertedImage.getGraphics().drawImage(sourceImage, 0, 0, null);
-                yield convertedImage;
-            }
-            case "blackwhite" -> {
-                BufferedImage convertedImage =
+                break;
+            case "blackwhite":
+                convertedImage =
                        new BufferedImage(
                                sourceImage.getWidth(),
                                sourceImage.getHeight(),
                                BufferedImage.TYPE_BYTE_BINARY);
                convertedImage.getGraphics().drawImage(sourceImage, 0, 0, null);
-                yield convertedImage;
-            }
-            default -> sourceImage;
-        };
+                break;
+            default: // full color
+                convertedImage = sourceImage;
+                break;
+        }
+        return convertedImage;
    }

    public static byte[] getImageData(BufferedImage image) {
@@ -330,7 +330,7 @@ public class PDFToFile {

                if (outputFiles.size() == 1) {
                    // Return single output file
-                    File outputFile = outputFiles.getFirst();
+                    File outputFile = outputFiles.get(0);
                    if ("txt:Text".equals(outputFormat)) {
                        outputFormat = "txt";
                    }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Anthony Stirling	c22bc24a74	Merge remote-tracking branch 'origin/main' into security/frontend-cves # Conflicts: # frontend/package-lock.json # frontend/package.json	2026-08-12 12:07:18 +01:00
Frooodle	1756f653ac	Merge branch 'main' into security/frontend-cves	2026-08-05 09:57:59 +01:00
Frooodle	3a969e69da	Merge branch 'main' into security/frontend-cves	2026-08-02 02:31:52 +01:00
Anthony Stirling	ce85999f6e	Patch brace-expansion and vitest advisories, drop stale overrides	2026-07-31 14:18:29 +01:00
Anthony Stirling	646451e44c	Merge remote-tracking branch 'origin/main' into pr6803-refresh	2026-07-31 14:07:07 +01:00
Frooodle	05a2908c39	Merge branch 'main' into security/frontend-cves	2026-07-30 15:48:45 +01:00
Frooodle	afd288caf8	Merge branch 'main' into security/frontend-cves	2026-07-13 09:16:02 +01:00
Frooodle	915c76fc10	merge main	2026-07-10 10:55:00 +01:00
Frooodle	35e0fdc18f	merge main	2026-07-06 19:14:43 +01:00
Frooodle	f37a46fbb6	merge main	2026-07-02 10:07:48 +01:00
Frooodle	3fe6e664f1	merge main	2026-07-01 08:58:31 +01:00
Frooodle	3967c28c50	merge main	2026-06-30 08:36:48 +01:00
Frooodle	f39ff2d360	merge main	2026-06-29 11:33:00 +01:00
Frooodle	33bb7f18f0	merge main	2026-06-27 08:29:06 +01:00
Frooodle	cffbcb5d79	fix frontend lint	2026-06-25 14:45:04 +01:00
Anthony Stirling	a2aa43d71c	Patch CVEs in frontend dependencies	2026-06-25 10:33:44 +01:00