Merge remote-tracking branch 'origin/main' into pr-28851-merge-fix

# Conflicts:
#	apps/comments-ui/package.json

Author: 9larsons

.github/hooks/pre-commit.bash

@@ -99,72 +99,3 @@ if [[ -n "$MOD_SUBMODULES" ]]; then
 else
     echo "No submodules in commit, continuing..."
 fi
-
-##
-## 3) Suggest shipping a new version of @tryghost/activitypub when changes are detected
-##    The intent is to ship smaller changes more frequently to production
-##
-
-increment_version() {
-    local package_json_path=$1
-    local version_type=$2
-
-    local current_version
-    current_version=$(grep '"version":' "$package_json_path" | awk -F '"' '{print $4}')
-
-    IFS='.' read -r major minor patch <<< "$current_version"
-
-    case "$version_type" in
-        major) ((major++)); minor=0; patch=0 ;;
-        minor) ((minor++)); patch=0 ;;
-        patch) ((patch++)) ;;
-        *) echo "Invalid version type"; exit 1 ;;
-    esac
-
-    new_version="$major.$minor.$patch"
-
-    # Update package.json with new version
-    if [[ "$OSTYPE" == "darwin"* ]]; then
-        # macOS
-        sed -i '' -E "s/\"version\": \"[0-9]+\.[0-9]+\.[0-9]+\"/\"version\": \"$new_version\"/" "$package_json_path"
-    else
-        # Linux and others
-        sed -i -E "s/\"version\": \"[0-9]+\.[0-9]+\.[0-9]+\"/\"version\": \"$new_version\"/" "$package_json_path"
-    fi
-
-    echo "Updated version to $new_version in $package_json_path"
-}
-
-AP_BUMP_NEEDED=false
-MODIFIED_FILES=$(git diff --cached --name-only)
-
-for FILE in $MODIFIED_FILES; do
-    if [[ "$FILE" == apps/activitypub/* ]]; then
-        AP_BUMP_NEEDED=true
-        break
-    fi
-done
-
-if [[ "$AP_BUMP_NEEDED" == true ]]; then
-    echo -e "\nYou have made changes to @tryghost/activitypub."
-    echo -e "Would you like to ship a new version? (yes)"
-    read -r new_version </dev/tty
-
-    if [[ -z "$new_version" || "$new_version" == "yes" || "$new_version" == "y" ]]; then
-        echo -e "Is that a patch, minor or major? (patch)"
-        read -r version_type </dev/tty
-
-        # Default to patch
-        if [[ -z "$version_type" ]]; then
-            version_type="patch"
-        fi
-
-        if [[ "$version_type" != "patch" && "$version_type" != "minor" && "$version_type" != "major" ]]; then
-            echo -e "${red}Invalid input. Skipping version bump.${no_color}"
-        else
-            echo "Bumping version ($version_type)..."
-            increment_version "apps/activitypub/package.json" "$version_type"
-            git add apps/activitypub/package.json
-        fi
-    fi
-fi

.github/workflows/ci.yml

@@ -550,7 +550,7 @@ jobs:
           if [ "${{ matrix.env.DB }}" = "sqlite3" ]; then
             pnpm nx run ghost:test:ci:e2e
           else
-            pnpm nx run ghost:test:ci:e2e:no-coverage
+            pnpm nx run ghost:test:e2e
           fi
 
       - name: Start MinIO for integration tests
@@ -577,7 +577,7 @@ jobs:
           if [ "${{ matrix.env.DB }}" = "sqlite3" ]; then
             pnpm nx run ghost:test:ci:integration
           else
-            pnpm nx run ghost:test:ci:integration:no-coverage
+            pnpm nx run ghost:test:integration
           fi
 
       - name: Check for unexpected file changes
@@ -672,7 +672,7 @@ jobs:
           echo "database__connection__password=root" >> $GITHUB_ENV
 
       - name: Legacy tests
-        run: pnpm nx run ghost:test:ci:legacy
+        run: pnpm nx run ghost:test:legacy
 
       - name: Check for unexpected file changes
         run: |
@@ -1583,8 +1583,8 @@ jobs:
         job_build_e2e_public_apps,
         job_build_e2e_image,
         job_e2e_tests,
-        build_packages,
-        publish_packages
+        build_public_apps,
+        publish_public_apps
       ]
     if: always()
     runs-on: ubuntu-latest
@@ -1601,34 +1601,17 @@ jobs:
   # Runs on PRs and pushes. Intentionally has no `id-token: write` — PR-controlled
   # code (nx build) must never execute in a job that can mint an npm OIDC token.
   # The privileged publish flow lives in publish_packages below, gated to main pushes.
-  build_packages:
+  build_public_apps:
     needs: [
       job_setup,
       job_lint,
       job_unit-tests
     ]
-    name: Build ${{ matrix.package_name }}
+    name: Build Public Apps
     runs-on: ubuntu-latest
     if: always() && github.repository == 'TryGhost/Ghost' && needs.job_setup.result == 'success' && needs.job_lint.result == 'success' && needs.job_unit-tests.result == 'success' && needs.job_setup.outputs.run_e2e == 'true'
     permissions:
       contents: read
-    strategy:
-      matrix:
-        include:
-          - package_name: '@tryghost/activitypub'
-            package_path: 'apps/activitypub'
-          - package_name: '@tryghost/portal'
-            package_path: 'apps/portal'
-          - package_name: '@tryghost/sodo-search'
-            package_path: 'apps/sodo-search'
-          - package_name: '@tryghost/comments-ui'
-            package_path: 'apps/comments-ui'
-          - package_name: '@tryghost/signup-form'
-            package_path: 'apps/signup-form'
-          - package_name: '@tryghost/announcement-bar'
-            package_path: 'apps/announcement-bar'
-          - package_name: '@tryghost/admin-toolbar'
-            package_path: 'apps/admin-toolbar'
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -1644,17 +1627,17 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build the package
-        run: pnpm nx build ${{ matrix.package_name }}
+        run: pnpm nx run-many --target=build --projects='tag:public-app'
 
   # Publishes @tryghost/* public apps to npm via OIDC trusted publishing.
   # Runs only on push-to-main — never on pull_request — so the `id-token: write`
   # permission is never exposed to PR-controlled code (ref: ONC-1677).
-  publish_packages:
+  publish_public_apps:
     needs: [
       job_setup,
       job_lint,
       job_unit-tests,
-      build_packages
+      build_public_apps
     ]
     name: Publish ${{ matrix.package_name }}
     runs-on: ubuntu-latest
@@ -1665,15 +1648,12 @@ jobs:
       && needs.job_setup.result == 'success'
       && needs.job_lint.result == 'success'
       && needs.job_unit-tests.result == 'success'
-      && needs.build_packages.result == 'success'
+      && needs.build_public_apps.result == 'success'
     permissions:
       id-token: write
     strategy:
       matrix:
         include:
-          - package_name: '@tryghost/activitypub'
-            package_path: 'apps/activitypub'
-            cdn_paths: 'https://cdn.jsdelivr.net/ghost/activitypub@CURRENT_MAJOR/dist/activitypub.js'
           - package_name: '@tryghost/portal'
             package_path: 'apps/portal'
             cdn_paths: 'https://cdn.jsdelivr.net/ghost/portal@~CURRENT_MINOR/umd/portal.min.js'
@@ -1765,12 +1745,6 @@ jobs:
         if: steps.version_check.outputs.version_changed == 'true'
         run: echo "${{ steps.cdn_paths.outputs.cdn_paths }}"
 
-      - name: Wait before purging jsDelivr cache
-        if: steps.version_check.outputs.version_changed == 'true' && matrix.package_name == '@tryghost/activitypub'
-        run: |
-          echo "Purging jsDelivr cache immediately after publishing a new version on NPM is unreliable. Waiting 1 minute before purging cache..."
-          sleep 60
-
       - name: Purge jsDelivr cache
         if: steps.version_check.outputs.version_changed == 'true'
         uses: gacts/purge-jsdelivr-cache@8d92aea944f1a3e8ad70505379e1a8ac72d56b73 # v1

.gitignore

@@ -144,6 +144,9 @@ Caddyfile
 # Admin
 /ghost/admin/dist
 
+# Admin Toolbar
+/apps/admin-toolbar/umd
+
 # Comments-UI
 /apps/comments-ui/umd
 /apps/comments-ui/playwright-report

AGENTS.md

@@ -254,6 +254,25 @@ Public-facing apps (`comments-ui`, `signup-form`, `sodo-search`, `portal`, `anno
 ### Commit Messages
 When the user asks you to create a commit or draft a commit message, load and follow the `commit` skill from `.agents/skills/commit`.
 
+### ESLint Config
+Source of truth: [eslint.shared.mjs](eslint.shared.mjs) at the repo root. Two factories cover most workspaces — `reactAppConfig` (every `apps/*` workspace) and `nodeLibConfig` (Node libs in `ghost/`). Each factory has full JSDoc with `@example`s; hover the call site in your editor.
+
+Minimal example for a new admin React app (`apps/new-feature/eslint.config.js`):
+
+```js
+import {reactAppConfig} from '../../eslint.shared.mjs';
+export default await reactAppConfig({
+    tailwindCssPath: `${import.meta.dirname}/../admin/src/index.css`,
+    shadeRestricted: true
+});
+```
+
+Conventions:
+- **Rules are `'error'` or `'off'` — never `'warn'`.** Warnings get ignored and pollute output. Applies to every workspace covered by the factories above + the standalones; `e2e/` has its own setup (see [e2e/CLAUDE.md](e2e/CLAUDE.md)) and currently still uses warn-level Playwright rules — a separate cleanup.
+- **Params prefixed `legacy*`** (`legacyTailwindV3ConfigPath`, `legacyJsTsSplit`) are escape hatches for migrations that haven't shipped yet. Intentional and visible — PRs to remove them are scoped.
+- **Standalone configs** (`ghost/core`, `ghost/admin`, `apps/admin`, `apps/admin-toolbar`) exist because their rule sets genuinely don't fit a factory — read the file directly. They import shared atoms (`correctnessRules`, `nodeLibRules`, `localFilenamesPlugin`, `strictLinterOptions`) where applicable.
+- **Plugin deps**: workspaces that use Tailwind must list `tailwindcss` as a (dev)Dependency themselves; other eslint plugins are root devDeps because the factory imports them dynamically.
+
 ### When Working on Admin UI
 - **New features:** Build in React (`apps/admin-x-*` or `apps/posts`)
 - **Use:** `admin-x-framework` for API hooks (`useBrowse`, `useEdit`, etc.)

apps/activitypub/eslint.config.js

@@ -1,98 +1,7 @@
-import js from '@eslint/js';
-import globals from 'globals';
-import ghostPlugin from 'eslint-plugin-ghost';
-import reactPlugin from 'eslint-plugin-react';
-import reactHooksPlugin from 'eslint-plugin-react-hooks';
-import reactRefreshPlugin from 'eslint-plugin-react-refresh';
-import tailwindcssPlugin from 'eslint-plugin-tailwindcss';
-import tseslint from 'typescript-eslint';
+import {reactAppConfig} from '../../eslint.shared.mjs';
 
-import {
-    correctnessRules,
-    mochaRulesOff,
-    reactDefaultsOff,
-    reactStrictRules,
-    shadeLayeredImportsRule,
-    sortImportsRule,
-    tailwindRulesV4,
-    tsUnusedVarsRule
-} from '../../eslint.shared.mjs';
-
-const tailwindCssConfig = `${import.meta.dirname}/../admin/src/index.css`;
-
-const reactFlat = reactPlugin.configs.flat.recommended;
-
-export default tseslint.config(
-    {
-        ignores: ['dist/**/*']
-    },
-    {
-        files: ['src/**/*.{js,ts,cjs,tsx}'],
-        extends: [...tseslint.configs.recommended],
-        languageOptions: {
-            ...reactFlat.languageOptions,
-            ecmaVersion: 2022,
-            sourceType: 'module',
-            globals: {
-                ...globals.browser,
-                ...globals.node
-            }
-        },
-        plugins: {
-            ...reactFlat.plugins,
-            ghost: ghostPlugin,
-            'react-hooks': reactHooksPlugin,
-            'react-refresh': reactRefreshPlugin,
-            tailwindcss: tailwindcssPlugin
-        },
-        settings: {
-            react: {version: 'detect'},
-            tailwindcss: {config: tailwindCssConfig}
-        },
-        rules: {
-            ...js.configs.recommended.rules,
-            ...reactFlat.rules,
-            ...reactHooksPlugin.configs.recommended.rules,
-            ...correctnessRules,
-            ...tsUnusedVarsRule,
-            ...reactDefaultsOff,
-            ...reactStrictRules,
-            ...sortImportsRule,
-            ...shadeLayeredImportsRule,
-            ...tailwindRulesV4,
-            'no-undef': 'off',
-            'no-redeclare': 'off',
-            'no-unexpected-multiline': 'off',
-            'no-shadow': 'off',
-            '@typescript-eslint/no-shadow': 'error',
-            'react-refresh/only-export-components': 'off',
-            '@typescript-eslint/no-inferrable-types': 'off',
-            '@typescript-eslint/no-non-null-assertion': 'off',
-            '@typescript-eslint/no-empty-function': 'off'
-        }
-    },
-    {
-        files: ['test/**/*.{js,ts,cjs,tsx}'],
-        extends: [...tseslint.configs.recommended],
-        languageOptions: {
-            ecmaVersion: 2022,
-            sourceType: 'module',
-            globals: {
-                ...globals.browser,
-                ...globals.node,
-                ...globals.vitest,
-                vi: 'readonly'
-            }
-        },
-        plugins: {
-            ghost: ghostPlugin
-        },
-        rules: {
-            ...correctnessRules,
-            ...tsUnusedVarsRule,
-            ...mochaRulesOff(ghostPlugin),
-            'no-undef': 'off',
-            '@typescript-eslint/no-inferrable-types': 'off'
-        }
-    }
-);
+export default await reactAppConfig({
+    tailwindCssPath: `${import.meta.dirname}/../admin/src/index.css`,
+    shadeRestricted: true,
+    sortImports: true
+});

apps/activitypub/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tryghost/activitypub",
   "type": "module",
-  "version": "3.1.46",
+  "version": "3.1.52",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -84,7 +84,10 @@
           "test:acceptance"
         ]
       }
-    }
+    },
+    "tags": [
+      "public-app"
+    ]
   },
   "dependencies": {
     "@hookform/resolvers": "5.4.0",

apps/activitypub/src/views/preferences/components/bluesky-sharing.tsx

@@ -60,7 +60,6 @@ const BlueskySharing: React.FC = () => {
                 setHandleConfirmed(true);
             }
         });
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []); // Empty deps - mutations are stable in practice
 
     useEffect(() => {
@@ -107,7 +106,6 @@ const BlueskySharing: React.FC = () => {
         }, CONFIRMATION_INTERVAL);
 
         return () => clearInterval(confirmHandleInterval);
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [account?.blueskyEnabled, account?.blueskyHandleConfirmed, confirmHandle]); // disableBlueskyMutation is stable
 
     if (isLoadingAccount) {

apps/activitypub/src/views/profile/components/profile-page.tsx

@@ -279,7 +279,7 @@ const ProfilePage:React.FC<ProfilePageProps> = ({
                                     </>
                                 }
                                 {customFields?.map((attachment: {name: string, value: string}) => (
-                                    <span className='mt-3 line-clamp-1 flex flex-col text-[1.5rem]'>
+                                    <span key={attachment.name} className='mt-3 line-clamp-1 flex flex-col text-[1.5rem]'>
                                         <span className={`text-xs font-semibold`}>{attachment.name}</span>
                                         <span dangerouslySetInnerHTML={{__html: sanitizeHtml(attachment.value)}} className='ap-profile-content truncate'/>
                                     </span>