From 409e546ab694d385c310cc0418618f9fe29a7763 Mon Sep 17 00:00:00 2001
From: Danila Fominykh <d@m8sh.su>
Date: Mon, 8 Jun 2026 20:25:36 +0300
Subject: [PATCH 1/4] Merge branch 'main'

---
 .github/workflows/cache-seeder.yml            |   4 +-
 .github/workflows/cron-licenses.yml           |   2 +-
 .github/workflows/cron-renovate.yml           |   2 +-
 .github/workflows/cron-translations.yml       |   2 +-
 .github/workflows/files-changed.yml           |   2 +-
 .github/workflows/pull-compliance.yml         |  10 +-
 .github/workflows/pull-db-tests.yml           |  12 +-
 .github/workflows/pull-docker-dryrun.yml      |   6 +-
 .github/workflows/pull-e2e-tests.yml          |   2 +-
 .github/workflows/pull-labeler.yml            |   2 +-
 .../workflows/release-nightly-snapcraft.yml   |   2 +-
 .github/workflows/release-nightly.yml         |   6 +-
 .github/workflows/release-tag-rc.yml          |   6 +-
 .github/workflows/release-tag-version.yml     |   6 +-
 README.md                                     | 221 +----
 models/actions/run_job.go                     |  21 +-
 models/actions/run_job_test.go                |  66 ++
 models/issues/pull.go                         |   8 +
 models/issues/pull_test.go                    |  19 +
 options/locale/locale_en-US.json              |   1 +
 package.json                                  |  28 +-
 pnpm-lock.yaml                                | 906 ++++++++---------
 public/assets/img/svg/octicon-vscode.svg      |   2 +-
 routers/api/v1/api.go                         |   8 +-
 routers/api/v1/org/org.go                     |   4 +-
 routers/api/v1/repo/action.go                 |  24 +-
 routers/api/v1/repo/actions_run.go            |  15 +-
 routers/api/v1/repo/branch.go                 |   6 +-
 routers/api/v1/repo/commits.go                |   2 +-
 routers/api/v1/repo/file.go                   |  25 +-
 routers/api/v1/repo/issue.go                  |  14 +-
 routers/api/v1/repo/issue_comment.go          |  18 +-
 routers/api/v1/repo/issue_dependency.go       |  24 +-
 routers/api/v1/repo/issue_lock.go             |  12 +-
 routers/api/v1/repo/issue_reaction.go         |  12 +-
 routers/api/v1/repo/issue_tracked_time.go     |  38 +-
 routers/api/v1/repo/notes.go                  |   6 +-
 routers/api/v1/repo/pull.go                   |   6 +-
 routers/api/v1/repo/pull_review.go            |  44 +-
 routers/api/v1/repo/release_attachment.go     |   2 +-
 routers/api/v1/repo/wiki.go                   |  18 +-
 routers/api/v1/shared/block.go                |   6 +-
 routers/api/v1/shared/runners.go              |   6 +-
 routers/api/v1/user/gpg_key.go                |   5 +-
 routers/api/v1/user/helper.go                 |   2 +-
 routers/api/v1/user/key.go                    |   5 +-
 routers/api/v1/user/user.go                   |   2 +-
 routers/web/devtest/mock_actions.go           |  71 +-
 routers/web/repo/actions/actions.go           |  45 +-
 services/actions/reusable_workflow.go         |  26 +-
 services/actions/reusable_workflow_test.go    |  44 +
 services/context/api.go                       |  24 +-
 services/issue/pull.go                        |  14 +
 services/wiki/wiki.go                         |   4 +-
 templates/devtest/repo-action-view.tmpl       |  10 +-
 tests/integration/api_user_org_perm_test.go   |   4 +-
 web_src/js/components/ActionRunJobView.vue    |  36 +-
 web_src/js/components/ActionRunView.ts        |   6 -
 web_src/js/components/RepoActionView.vue      |  48 +-
 .../js/components/WorkflowGraph.utils.test.ts | 197 ++++
 web_src/js/components/WorkflowGraph.utils.ts  | 559 +++++++++++
 web_src/js/components/WorkflowGraph.vue       | 916 ++++++++----------
 web_src/js/features/user-auth-gpg-signup.ts   |  40 +
 63 files changed, 2029 insertions(+), 1655 deletions(-)
 create mode 100644 web_src/js/components/WorkflowGraph.utils.test.ts
 create mode 100644 web_src/js/components/WorkflowGraph.utils.ts
 create mode 100644 web_src/js/features/user-auth-gpg-signup.ts

diff --git a/.github/workflows/cache-seeder.yml b/.github/workflows/cache-seeder.yml
index 8ec7adee07..4e2988adb4 100644
--- a/.github/workflows/cache-seeder.yml
+++ b/.github/workflows/cache-seeder.yml
@@ -29,7 +29,7 @@ jobs:
   gobuild:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - run: make deps-backend deps-tools
       - run: TAGS="bindata" make backend
@@ -59,7 +59,7 @@ jobs:
         include:
           - { tags: "bindata", target: "lint-backend" }
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
         with:
           lint-cache: "true"
diff --git a/.github/workflows/cron-licenses.yml b/.github/workflows/cron-licenses.yml
index edb6f2e157..2d4e926288 100644
--- a/.github/workflows/cron-licenses.yml
+++ b/.github/workflows/cron-licenses.yml
@@ -12,7 +12,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index a50af530f2..4db83a336d 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository == 'go-gitea/gitea' # prevent running on forks
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
         with:
           renovate-version: ${{ env.RENOVATE_VERSION }}
diff --git a/.github/workflows/cron-translations.yml b/.github/workflows/cron-translations.yml
index 17f29d4e0c..7c215b2c17 100644
--- a/.github/workflows/cron-translations.yml
+++ b/.github/workflows/cron-translations.yml
@@ -12,7 +12,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
         with:
           upload_sources: true
diff --git a/.github/workflows/files-changed.yml b/.github/workflows/files-changed.yml
index c17afbca97..3c0603974e 100644
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -49,7 +49,7 @@ jobs:
       e2e: ${{ steps.changes.outputs.e2e }}
       shell: ${{ steps.changes.outputs.shell }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
diff --git a/.github/workflows/pull-compliance.yml b/.github/workflows/pull-compliance.yml
index 801966e144..6c41b6b4c1 100644
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -19,7 +19,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
         with:
           lint-cache: "true"
@@ -31,7 +31,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
         with:
           cache: "false"
@@ -62,7 +62,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - run: make deps-backend deps-tools
       - run: make --always-make checks-backend # ensure the "go-licenses" make target runs
@@ -72,7 +72,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/node-setup
       - run: make deps-frontend
       - run: make lint-frontend
@@ -85,7 +85,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - run: make deps-backend generate-go
       # no frontend build here as backend should be able to build, even without any frontend files
diff --git a/.github/workflows/pull-db-tests.yml b/.github/workflows/pull-db-tests.yml
index cbf86247ce..4cc8d25bbb 100644
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -42,7 +42,7 @@ jobs:
         ports:
           - "9000:9000"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - uses: ./.github/actions/pgsql-shard
         with:
@@ -78,7 +78,7 @@ jobs:
         ports:
           - "9000:9000"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - uses: ./.github/actions/pgsql-shard
         with:
@@ -90,7 +90,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - run: make deps-backend
       - run: make backend
@@ -151,7 +151,7 @@ jobs:
         ports:
           - 10000:10000
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - name: Add hosts to /etc/hosts
         run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
@@ -208,7 +208,7 @@ jobs:
           - "587:587"
           - "993:993"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - name: Add hosts to /etc/hosts
         run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
@@ -241,7 +241,7 @@ jobs:
         ports:
           - 10000:10000
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - name: Add hosts to /etc/hosts
         run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
diff --git a/.github/workflows/pull-docker-dryrun.yml b/.github/workflows/pull-docker-dryrun.yml
index 43a4f48669..f7483132b5 100644
--- a/.github/workflows/pull-docker-dryrun.yml
+++ b/.github/workflows/pull-docker-dryrun.yml
@@ -21,7 +21,7 @@ jobs:
     needs: [files-changed]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/docker-dryrun
         with:
           platform: linux/amd64
@@ -31,7 +31,7 @@ jobs:
     needs: [files-changed]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/docker-dryrun
         with:
           platform: linux/arm64
@@ -41,7 +41,7 @@ jobs:
     needs: [files-changed]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/docker-dryrun
         with:
           platform: linux/riscv64
diff --git a/.github/workflows/pull-e2e-tests.yml b/.github/workflows/pull-e2e-tests.yml
index f0283f4022..bcd5eba381 100644
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -19,7 +19,7 @@ jobs:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/go-setup
       - uses: ./.github/actions/node-setup
       - run: make deps-frontend
diff --git a/.github/workflows/pull-labeler.yml b/.github/workflows/pull-labeler.yml
index 34395c8d9e..dd19055162 100644
--- a/.github/workflows/pull-labeler.yml
+++ b/.github/workflows/pull-labeler.yml
@@ -30,7 +30,7 @@ jobs:
       pull-requests: write
     steps:
       # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.base.sha }}
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/release-nightly-snapcraft.yml b/.github/workflows/release-nightly-snapcraft.yml
index 0f9ac1d423..46ea663f83 100644
--- a/.github/workflows/release-nightly-snapcraft.yml
+++ b/.github/workflows/release-nightly-snapcraft.yml
@@ -17,7 +17,7 @@ jobs:
       SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install snapcraft
         run: sudo snap install snapcraft --classic
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index d156132943..70251bb091 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
@@ -57,7 +57,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6.1.2
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -75,7 +75,7 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml
index 3e7655027c..34ed45b281 100644
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -15,7 +15,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
@@ -58,7 +58,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6.1.2
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -86,7 +86,7 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml
index 66a2984def..394c524b75 100644
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
@@ -61,7 +61,7 @@ jobs:
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6.1.2
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -89,7 +89,7 @@ jobs:
       contents: read
       packages: write # to publish to ghcr.io
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
diff --git a/README.md b/README.md
index 3aa5138dac..6d099684e1 100644
--- a/README.md
+++ b/README.md
@@ -1,208 +1,23 @@
-# Gitea
+# M8SH - decentralized swiss knife
 
-[![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
-[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
-[![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
-[![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
-[![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
-[![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
-[![](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com "Crowdin")
+Project is under development.
 
-[繁體中文](./README.zh-tw.md) | [简体中文](./README.zh-cn.md)
+Roadmap:
 
-## Purpose
+- decentralized GPG-based registration, authorization and authentication (further when clients are developed - GPG would be integrated into client and invoked via secure bridge for fully password-less and input-less flow, preseving security level of GPG) (usage of external email domain assumes it's an external user and decetralized features will be disabled)
+- integrated email server (ui, rest)
+- integrated messenger (ui, rest)
+- integrated search engine (seach over external gitea instances repositories, specific tags for repos to be indexed, view external things from home instance)
+- integrated posts, articles
+- integrated videos, reels
+- integrated music player
+- integrated VPN (amnesia)
 
-The goal of this project is to make the easiest, fastest, and most
-painless way of setting up a self-hosted Git service.
 
-As Gitea is written in Go, it works across **all** the platforms and
-architectures that are supported by Go, including Linux, macOS, and
-Windows on x86, amd64, ARM and PowerPC architectures.
-This project has been
-[forked](https://blog.gitea.com/welcome-to-gitea/) from
-[Gogs](https://gogs.io) since November of 2016, but a lot has changed.
-
-For online demonstrations, you can visit [demo.gitea.com](https://demo.gitea.com).
-
-For accessing free Gitea service (with a limited number of repositories), you can visit [gitea.com](https://gitea.com/user/login).
-
-To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at [cloud.gitea.com](https://cloud.gitea.com).
-
-## Documentation
-
-You can find comprehensive documentation on our official [documentation website](https://docs.gitea.com/).
-
-It includes installation, administration, usage, development, contributing guides, and more to help you get started and explore all features effectively.
-
-If you have any suggestions or would like to contribute to it, you can visit the [documentation repository](https://gitea.com/gitea/docs)
-
-## Building
-
-From the root of the source tree, run:
-
-    TAGS="bindata" make build
-
-The `build` target is split into two sub-targets:
-
-- `make backend` which requires [Go Stable](https://go.dev/dl/), the required version is defined in [go.mod](/go.mod).
-- `make frontend` which requires [Node.js LTS](https://nodejs.org/en/download/) or greater and [pnpm](https://pnpm.io/installation).
-
-Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the `frontend` target will not be triggered, making it possible to build without Node.js.
-
-More info: https://docs.gitea.com/installation/install-from-source
-
-## Using
-
-After building, a binary file named `gitea` will be generated in the root of the source tree by default. To run it, use:
-
-    ./gitea web
-
-> [!NOTE]
-> If you're interested in using our APIs, we have experimental support with [documentation](https://docs.gitea.com/api).
-
-## Contributing
-
-Expected workflow is: Fork -> Patch -> Push -> Pull Request
-
-> [!NOTE]
->
-> 1. **YOU MUST READ THE [CONTRIBUTORS GUIDE](CONTRIBUTING.md) BEFORE STARTING TO WORK ON A PULL REQUEST.**
-> 2. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!
-
-## Translating
-
-[![Crowdin](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com)
-
-Translations are done through [Crowdin](https://translate.gitea.com). If you want to translate to a new language, ask one of the managers in the Crowdin project to add a new language there.
-
-You can also just create an issue for adding a language or ask on Discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty, but we hope to fill it as questions pop up.
-
-Get more information from [documentation](https://docs.gitea.com/contributing/localization).
-
-## Official and Third-Party Projects
-
-We provide an official [go-sdk](https://gitea.com/gitea/go-sdk), a CLI tool called [tea](https://gitea.com/gitea/tea) and an [action runner](https://gitea.com/gitea/act_runner) for Gitea Action.
-
-We maintain a list of Gitea-related projects at [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea), where you can discover more third-party projects, including SDKs, plugins, themes, and more.
-
-## Communication
-
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-
-If you have questions that are not covered by the [documentation](https://docs.gitea.com/), you can get in contact with us on our [Discord server](https://discord.gg/Gitea) or create a post in the [discourse forum](https://forum.gitea.com/).
-
-## Authors
-
-- [Maintainers](https://github.com/orgs/go-gitea/people)
-- [Contributors](https://github.com/go-gitea/gitea/graphs/contributors)
-- [Translators](options/locale/TRANSLATORS)
-
-## Backers
-
-Thank you to all our backers! 🙏 [[Become a backer](https://opencollective.com/gitea#backer)]
-
-<a href="https://opencollective.com/gitea#backers" target="_blank"><img src="https://opencollective.com/gitea/backers.svg?width=890"></a>
-
-## Sponsors
-
-Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/gitea#sponsor)]
-
-<a href="https://opencollective.com/gitea/sponsor/0/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/0/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/1/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/1/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/2/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/2/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/3/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/3/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/4/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/4/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/5/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/5/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/6/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/6/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/7/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/7/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/8/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/8/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/9/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/9/avatar.svg"></a>
-
-## FAQ
-
-**How do you pronounce Gitea?**
-
-Gitea is pronounced [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY) as in "gi-tea" with a hard g.
-
-**Why is this not hosted on a Gitea instance?**
-
-We're [working on it](https://github.com/go-gitea/gitea/issues/1029).
-
-**Where can I find the security patches?**
-
-In the [release log](https://github.com/go-gitea/gitea/releases) or the [change log](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md), search for the keyword `SECURITY` to find the security patches.
-
-## License
-
-This project is licensed under the MIT License.
-See the [LICENSE](https://github.com/go-gitea/gitea/blob/main/LICENSE) file
-for the full license text.
-
-## Further information
-
-<details>
-<summary>Looking for an overview of the interface? Check it out!</summary>
-
-### Login/Register Page
-
-![Login](https://dl.gitea.com/screenshots/login.png)
-![Register](https://dl.gitea.com/screenshots/register.png)
-
-### User Dashboard
-
-![Home](https://dl.gitea.com/screenshots/home.png)
-![Issues](https://dl.gitea.com/screenshots/issues.png)
-![Pull Requests](https://dl.gitea.com/screenshots/pull_requests.png)
-![Milestones](https://dl.gitea.com/screenshots/milestones.png)
-
-### User Profile
-
-![Profile](https://dl.gitea.com/screenshots/user_profile.png)
-
-### Explore
-
-![Repos](https://dl.gitea.com/screenshots/explore_repos.png)
-![Users](https://dl.gitea.com/screenshots/explore_users.png)
-![Orgs](https://dl.gitea.com/screenshots/explore_orgs.png)
-
-### Repository
-
-![Home](https://dl.gitea.com/screenshots/repo_home.png)
-![Commits](https://dl.gitea.com/screenshots/repo_commits.png)
-![Branches](https://dl.gitea.com/screenshots/repo_branches.png)
-![Labels](https://dl.gitea.com/screenshots/repo_labels.png)
-![Milestones](https://dl.gitea.com/screenshots/repo_milestones.png)
-![Releases](https://dl.gitea.com/screenshots/repo_releases.png)
-![Tags](https://dl.gitea.com/screenshots/repo_tags.png)
-
-#### Repository Issue
-
-![List](https://dl.gitea.com/screenshots/repo_issues.png)
-![Issue](https://dl.gitea.com/screenshots/repo_issue.png)
-
-#### Repository Pull Requests
-
-![List](https://dl.gitea.com/screenshots/repo_pull_requests.png)
-![Pull Request](https://dl.gitea.com/screenshots/repo_pull_request.png)
-![File](https://dl.gitea.com/screenshots/repo_pull_request_file.png)
-![Commits](https://dl.gitea.com/screenshots/repo_pull_request_commits.png)
-
-#### Repository Actions
-
-![List](https://dl.gitea.com/screenshots/repo_actions.png)
-![Details](https://dl.gitea.com/screenshots/repo_actions_run.png)
-
-#### Repository Activity
-
-![Activity](https://dl.gitea.com/screenshots/repo_activity.png)
-![Contributors](https://dl.gitea.com/screenshots/repo_contributors.png)
-![Code Frequency](https://dl.gitea.com/screenshots/repo_code_frequency.png)
-![Recent Commits](https://dl.gitea.com/screenshots/repo_recent_commits.png)
-
-### Organization
-
-![Home](https://dl.gitea.com/screenshots/org_home.png)
-
-</details>
+<!-- 
+- integrated cloud storage
+- integrated calls
+- integrated video-conferences
+- integrated stickers
+- integrated NFT assets, crypto-wallets
+-->
diff --git a/models/actions/run_job.go b/models/actions/run_job.go
index caf66ca451..df01546fd8 100644
--- a/models/actions/run_job.go
+++ b/models/actions/run_job.go
@@ -4,6 +4,7 @@
 package actions
 
 import (
+	"cmp"
 	"context"
 	"fmt"
 	"slices"
@@ -671,18 +672,18 @@ func cancelOneJob(ctx context.Context, job *ActionRunJob) (*ActionRunJob, error)
 func cancelReusableCaller(ctx context.Context, caller *ActionRunJob) ([]*ActionRunJob, error) {
 	cancelledJobs := make([]*ActionRunJob, 0)
 
-	if c, err := cancelOneJob(ctx, caller); err != nil {
-		return cancelledJobs, err
-	} else if c != nil {
-		cancelledJobs = append(cancelledJobs, c)
-	}
-
 	attemptJobs, err := GetRunJobsByRunAndAttemptID(ctx, caller.RunID, caller.RunAttemptID)
 	if err != nil {
 		return cancelledJobs, err
 	}
 
-	for _, c := range CollectAllDescendantJobs(caller, attemptJobs) {
+	// Cancel descendants deepest-first, then the caller: a caller's status is aggregated from its children,
+	// so each child must reach its final state before its parent caller is re-aggregated.
+	// A child's ID always exceeds its parent's, so descending ID is a valid deepest-first order.
+	descendants := CollectAllDescendantJobs(caller, attemptJobs)
+	slices.SortFunc(descendants, func(a, b *ActionRunJob) int { return cmp.Compare(b.ID, a.ID) })
+
+	for _, c := range descendants {
 		cancelled, err := cancelOneJob(ctx, c)
 		if err != nil {
 			return cancelledJobs, err
@@ -691,5 +692,11 @@ func cancelReusableCaller(ctx context.Context, caller *ActionRunJob) ([]*ActionR
 			cancelledJobs = append(cancelledJobs, cancelled)
 		}
 	}
+
+	if c, err := cancelOneJob(ctx, caller); err != nil {
+		return cancelledJobs, err
+	} else if c != nil {
+		cancelledJobs = append(cancelledJobs, c)
+	}
 	return cancelledJobs, nil
 }
diff --git a/models/actions/run_job_test.go b/models/actions/run_job_test.go
index a9e07ce0cf..4437b5906d 100644
--- a/models/actions/run_job_test.go
+++ b/models/actions/run_job_test.go
@@ -131,3 +131,69 @@ func TestGetPriorAttemptChildrenByParent(t *testing.T) {
 		assertAttempt1Children(t, out)
 	})
 }
+
+// A reusable caller subtree with a Blocked descendant (e.g. a nested caller stuck on an invalid `uses:`) must aggregate to Cancelled, when the run is cancelled.
+func TestCancelJobs_NestedBlockedReusableCaller(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	run := &ActionRun{
+		Title:         "cancel-nested-caller",
+		RepoID:        4,
+		Index:         9701,
+		OwnerID:       1,
+		WorkflowID:    "caller.yaml",
+		TriggerUserID: 1,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		EventPayload:  "{}",
+		Status:        StatusBlocked,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+
+	attempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1, Status: StatusBlocked}
+	require.NoError(t, db.Insert(ctx, attempt))
+	run.LatestAttemptID = attempt.ID
+	require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
+
+	newJob := func(name string, attemptJobID, parentID int64, callUses string) *ActionRunJob {
+		job := &ActionRunJob{
+			RunID:            run.ID,
+			RunAttemptID:     attempt.ID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             name,
+			JobID:            name,
+			Attempt:          1,
+			Status:           StatusBlocked,
+			AttemptJobID:     attemptJobID,
+			IsReusableCaller: true,
+			CallUses:         callUses,
+			ParentJobID:      parentID,
+		}
+		require.NoError(t, db.Insert(ctx, job))
+		return job
+	}
+
+	// outer: a valid top-level caller that expanded; inner: a nested caller stuck Blocked (invalid uses, never expands).
+	outer := newJob("outer", 1, 0, "./.gitea/workflows/lib.yml")
+	inner := newJob("inner", 2, outer.ID, "https://other.example.com/o/r/.gitea/workflows/ci.yml@v1")
+
+	// Cancel all jobs of the attempt, ordered by id (parent before child).
+	jobs, err := GetRunJobsByRunAndAttemptID(ctx, run.ID, attempt.ID)
+	require.NoError(t, err)
+	_, err = CancelJobs(ctx, jobs)
+	require.NoError(t, err)
+
+	for _, j := range []*ActionRunJob{outer, inner} {
+		got := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: j.ID})
+		assert.Equal(t, StatusCancelled, got.Status, "job %q should be cancelled", j.JobID)
+	}
+	gotAttempt := unittest.AssertExistsAndLoadBean(t, &ActionRunAttempt{ID: attempt.ID})
+	assert.Equal(t, StatusCancelled, gotAttempt.Status, "attempt must aggregate to Cancelled")
+	gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
+	assert.Equal(t, StatusCancelled, gotRun.Status, "run must aggregate to Cancelled, not stay Blocked")
+}
diff --git a/models/issues/pull.go b/models/issues/pull.go
index 7dbcef0d3f..2b93b926b0 100644
--- a/models/issues/pull.go
+++ b/models/issues/pull.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
@@ -860,6 +861,11 @@ func GetCodeOwnersFromContent(ctx context.Context, data string) ([]*CodeOwnerRul
 	return rules, warnings
 }
 
+// codeOwnerMatchTimeout bounds a single pattern match so a crafted pattern
+// cannot stall via catastrophic backtracking. See also the aggregate budget
+// enforced by the caller across the whole rules×files match loop.
+const codeOwnerMatchTimeout = 150 * time.Millisecond
+
 type CodeOwnerRule struct {
 	Rule     *regexp2.Regexp // it supports negative lookahead, does better for end users
 	Negative bool
@@ -888,6 +894,8 @@ func ParseCodeOwnersLine(ctx context.Context, tokens []string) (*CodeOwnerRule,
 		warnings = append(warnings, fmt.Sprintf("incorrect codeowner regexp: %s", err))
 		return nil, warnings
 	}
+	// Bound matching time so user-supplied patterns cannot stall PR creation via catastrophic backtracking.
+	rule.Rule.MatchTimeout = codeOwnerMatchTimeout
 
 	for _, user := range tokens[1:] {
 		user = strings.TrimPrefix(user, "@")
diff --git a/models/issues/pull_test.go b/models/issues/pull_test.go
index 166fdd8482..bd7499fa80 100644
--- a/models/issues/pull_test.go
+++ b/models/issues/pull_test.go
@@ -4,7 +4,9 @@
 package issues_test
 
 import (
+	"strings"
 	"testing"
+	"time"
 
 	"gitea.dev/models/db"
 	issues_model "gitea.dev/models/issues"
@@ -39,6 +41,7 @@ func TestPullRequest(t *testing.T) {
 	t.Run("DeleteOrphanedObjects", testDeleteOrphanedObjects)
 	t.Run("ParseCodeOwnersLine", testParseCodeOwnersLine)
 	t.Run("CodeOwnerAbsolutePathPatterns", testCodeOwnerAbsolutePathPatterns)
+	t.Run("CodeOwnerPatternMatchTimeout", testCodeOwnerPatternMatchTimeout)
 	t.Run("GetApprovers", testGetApprovers)
 	t.Run("GetPullRequestByMergedCommit", testGetPullRequestByMergedCommit)
 	t.Run("Migrate_InsertPullRequests", testMigrateInsertPullRequests)
@@ -376,6 +379,22 @@ func testCodeOwnerAbsolutePathPatterns(t *testing.T) {
 	}
 }
 
+// testCodeOwnerPatternMatchTimeout ensures user-supplied CODEOWNERS patterns
+// cannot stall pull request processing through catastrophic regex backtracking:
+// each compiled rule must enforce a bounded match time.
+func testCodeOwnerPatternMatchTimeout(t *testing.T) {
+	rules, _ := issues_model.GetCodeOwnersFromContent(t.Context(), "(a+)+ @user5\n")
+	require.Len(t, rules, 1)
+
+	maliciousInput := strings.Repeat("a", 30) + "X"
+	start := time.Now()
+	_, err := rules[0].Rule.MatchString(maliciousInput)
+	elapsed := time.Since(start)
+
+	require.Error(t, err, "expected MatchTimeout error on pathological input")
+	assert.Less(t, elapsed, time.Second, "match timeout did not bound regex evaluation; took %s", elapsed)
+}
+
 func testGetApprovers(t *testing.T) {
 	pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 5})
 	// Official reviews are already deduplicated. Allow unofficial reviews
diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
index 51a9797742..9595baebed 100644
--- a/options/locale/locale_en-US.json
+++ b/options/locale/locale_en-US.json
@@ -3774,6 +3774,7 @@
   "actions.runs.no_matching_online_runner_helper": "No matching online runner with label: %s",
   "actions.runs.no_job_without_needs": "The workflow must contain at least one job without dependencies.",
   "actions.runs.no_job": "The workflow must contain at least one job",
+  "actions.runs.invalid_reusable_workflow_uses": "Invalid reusable workflow \"uses\": %s",
   "actions.runs.actor": "Actor",
   "actions.runs.status": "Status",
   "actions.runs.actors_no_select": "All actors",
diff --git a/package.json b/package.json
index 8a915ea795..cc6c270a84 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "type": "module",
-  "packageManager": "pnpm@11.4.0",
+  "packageManager": "pnpm@11.5.1",
   "engines": {
     "node": ">= 22.18.0",
     "pnpm": ">= 11.0.0"
@@ -28,7 +28,7 @@
     "@lezer/highlight": "1.2.3",
     "@mcaptcha/vanilla-glue": "0.1.0-rc2",
     "@mermaid-js/layout-elk": "0.2.1",
-    "@primer/octicons": "19.27.0",
+    "@primer/octicons": "19.28.0",
     "@replit/codemirror-indentation-markers": "6.5.3",
     "@replit/codemirror-lang-nix": "6.0.1",
     "@replit/codemirror-lang-svelte": "6.0.0",
@@ -50,14 +50,14 @@
     "esbuild": "0.28.0",
     "idiomorph": "0.7.4",
     "jquery": "4.0.0",
-    "js-yaml": "4.1.1",
+    "js-yaml": "4.2.0",
     "katex": "0.17.0",
     "mermaid": "11.15.0",
     "online-3d-viewer": "0.18.0",
     "pdfobject": "2.3.1",
     "perfect-debounce": "2.1.0",
     "postcss": "8.5.15",
-    "rolldown-license-plugin": "3.0.8",
+    "rolldown-license-plugin": "3.0.9",
     "sortablejs": "1.15.7",
     "swagger-ui-dist": "5.32.6",
     "tailwindcss": "3.4.19",
@@ -67,7 +67,7 @@
     "tributejs": "5.1.3",
     "uint8-to-base64": "0.2.1",
     "vanilla-colorful": "0.7.2",
-    "vite": "8.0.14",
+    "vite": "8.0.16",
     "vite-string-plugin": "2.0.4",
     "vue": "3.5.35",
     "vue-bar-graph": "2.2.0",
@@ -89,11 +89,11 @@
     "@types/swagger-ui-dist": "3.30.6",
     "@types/throttle-debounce": "5.0.2",
     "@types/toastify-js": "1.12.4",
-    "@typescript-eslint/parser": "8.60.0",
+    "@typescript-eslint/parser": "8.60.1",
     "@vitejs/plugin-vue": "6.0.7",
-    "@vitest/eslint-plugin": "1.6.18",
-    "eslint": "10.4.0",
-    "eslint-import-resolver-typescript": "4.4.4",
+    "@vitest/eslint-plugin": "1.6.19",
+    "eslint": "10.4.1",
+    "eslint-import-resolver-typescript": "4.4.5",
     "eslint-plugin-array-func": "5.1.1",
     "eslint-plugin-de-morgan": "2.1.2",
     "eslint-plugin-github": "6.0.0",
@@ -103,7 +103,7 @@
     "eslint-plugin-sonarjs": "4.0.3",
     "eslint-plugin-unicorn": "64.0.0",
     "eslint-plugin-vue": "10.9.1",
-    "eslint-plugin-vue-scoped-css": "3.1.0",
+    "eslint-plugin-vue-scoped-css": "3.1.1",
     "eslint-plugin-wc": "3.1.0",
     "globals": "17.6.0",
     "happy-dom": "20.9.0",
@@ -119,9 +119,9 @@
     "stylelint-value-no-unknown-custom-properties": "6.1.1",
     "svgo": "4.0.1",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.60.0",
-    "updates": "17.17.2",
-    "vitest": "4.1.7",
-    "vue-tsc": "3.3.2"
+    "typescript-eslint": "8.60.1",
+    "updates": "17.17.3",
+    "vitest": "4.1.8",
+    "vue-tsc": "3.3.3"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 11c6ebf5ad..ce5d84c982 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -75,8 +75,8 @@ importers:
         specifier: 0.2.1
         version: 0.2.1(mermaid@11.15.0)
       '@primer/octicons':
-        specifier: 19.27.0
-        version: 19.27.0
+        specifier: 19.28.0
+        version: 19.28.0
       '@replit/codemirror-indentation-markers':
         specifier: 6.5.3
         version: 6.5.3(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
@@ -94,7 +94,7 @@ importers:
         version: 2.6.2
       '@vitejs/plugin-vue':
         specifier: 6.0.7
-        version: 6.0.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))(vue@3.5.35(typescript@6.0.3))
+        version: 6.0.7(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))(vue@3.5.35(typescript@6.0.3))
       ansi_up:
         specifier: 6.0.6
         version: 6.0.6
@@ -141,8 +141,8 @@ importers:
         specifier: 4.0.0
         version: 4.0.0
       js-yaml:
-        specifier: 4.1.1
-        version: 4.1.1
+        specifier: 4.2.0
+        version: 4.2.0
       katex:
         specifier: 0.17.0
         version: 0.17.0
@@ -162,8 +162,8 @@ importers:
         specifier: 8.5.15
         version: 8.5.15
       rolldown-license-plugin:
-        specifier: 3.0.8
-        version: 3.0.8(rolldown@1.0.2)
+        specifier: 3.0.9
+        version: 3.0.9(rolldown@1.0.3)
       sortablejs:
         specifier: 1.15.7
         version: 1.15.7
@@ -192,11 +192,11 @@ importers:
         specifier: 0.7.2
         version: 0.7.2
       vite:
-        specifier: 8.0.14
-        version: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+        specifier: 8.0.16
+        version: 8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
       vite-string-plugin:
         specifier: 2.0.4
-        version: 2.0.4(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
+        version: 2.0.4(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
       vue:
         specifier: 3.5.35
         version: 3.5.35(typescript@6.0.3)
@@ -209,7 +209,7 @@ importers:
     devDependencies:
       '@eslint-community/eslint-plugin-eslint-comments':
         specifier: 4.7.2
-        version: 4.7.2(eslint@10.4.0(jiti@2.7.0))
+        version: 4.7.2(eslint@10.4.1(jiti@2.7.0))
       '@eslint/json':
         specifier: 1.2.0
         version: 1.2.0
@@ -218,7 +218,7 @@ importers:
         version: 1.60.0
       '@stylistic/eslint-plugin':
         specifier: 5.10.0
-        version: 5.10.0(eslint@10.4.0(jiti@2.7.0))
+        version: 5.10.0(eslint@10.4.1(jiti@2.7.0))
       '@stylistic/stylelint-plugin':
         specifier: 5.2.0
         version: 5.2.0(stylelint@17.12.0(typescript@6.0.3))
@@ -253,50 +253,50 @@ importers:
         specifier: 1.12.4
         version: 1.12.4
       '@typescript-eslint/parser':
-        specifier: 8.60.0
-        version: 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+        specifier: 8.60.1
+        version: 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
       '@vitest/eslint-plugin':
-        specifier: 1.6.18
-        version: 1.6.18(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))
+        specifier: 1.6.19
+        version: 1.6.19(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))
       eslint:
-        specifier: 10.4.0
-        version: 10.4.0(jiti@2.7.0)
+        specifier: 10.4.1
+        version: 10.4.1(jiti@2.7.0)
       eslint-import-resolver-typescript:
-        specifier: 4.4.4
-        version: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.0(jiti@2.7.0))
+        specifier: 4.4.5
+        version: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-array-func:
         specifier: 5.1.1
-        version: 5.1.1(eslint@10.4.0(jiti@2.7.0))
+        version: 5.1.1(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-de-morgan:
         specifier: 2.1.2
-        version: 2.1.2(eslint@10.4.0(jiti@2.7.0))
+        version: 2.1.2(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-github:
         specifier: 6.0.0
-        version: 6.0.0(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
+        version: 6.0.0(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-import-x:
         specifier: 4.16.2
-        version: 4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0))
+        version: 4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-playwright:
         specifier: 2.10.4
-        version: 2.10.4(eslint@10.4.0(jiti@2.7.0))
+        version: 2.10.4(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-regexp:
         specifier: 3.1.0
-        version: 3.1.0(eslint@10.4.0(jiti@2.7.0))
+        version: 3.1.0(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-sonarjs:
         specifier: 4.0.3
-        version: 4.0.3(eslint@10.4.0(jiti@2.7.0))
+        version: 4.0.3(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-unicorn:
         specifier: 64.0.0
-        version: 64.0.0(eslint@10.4.0(jiti@2.7.0))
+        version: 64.0.0(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-vue:
         specifier: 10.9.1
-        version: 10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.0(jiti@2.7.0)))(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0)))
+        version: 10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0)))(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0)))
       eslint-plugin-vue-scoped-css:
-        specifier: 3.1.0
-        version: 3.1.0(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0)))
+        specifier: 3.1.1
+        version: 3.1.1(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0)))
       eslint-plugin-wc:
         specifier: 3.1.0
-        version: 3.1.0(eslint@10.4.0(jiti@2.7.0))
+        version: 3.1.0(eslint@10.4.1(jiti@2.7.0))
       globals:
         specifier: 17.6.0
         version: 17.6.0
@@ -340,17 +340,17 @@ importers:
         specifier: 6.0.3
         version: 6.0.3
       typescript-eslint:
-        specifier: 8.60.0
-        version: 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+        specifier: 8.60.1
+        version: 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
       updates:
-        specifier: 17.17.2
-        version: 17.17.2
+        specifier: 17.17.3
+        version: 17.17.3
       vitest:
-        specifier: 4.1.7
-        version: 4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
+        specifier: 4.1.8
+        version: 4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
       vue-tsc:
-        specifier: 3.3.2
-        version: 3.3.2(typescript@6.0.3)
+        specifier: 3.3.3
+        version: 3.3.3(typescript@6.0.3)
 
 packages:
 
@@ -985,8 +985,8 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@oxc-project/types@0.132.0':
-    resolution: {integrity: sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ==}
+  '@oxc-project/types@0.133.0':
+    resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==}
 
   '@package-json/types@0.0.12':
     resolution: {integrity: sha512-uu43FGU34B5VM9mCNjXCwLaGHYjXdNincqKLaraaCW+7S2+SmiBg1Nv8bPnmschrIfZmfKNY9f3fC376MRrObw==}
@@ -1003,8 +1003,8 @@ packages:
   '@popperjs/core@2.11.8':
     resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}
 
-  '@primer/octicons@19.27.0':
-    resolution: {integrity: sha512-7xC6D89f9IcoDezeKTGETbgRAoXJnbZlakavqYzD4Wo+uTC6212k0fTE/dLV8WCDOwfp//WyONftdaFRdI1VdQ==}
+  '@primer/octicons@19.28.0':
+    resolution: {integrity: sha512-FCpW9ZXI9U9h7wjYSXFQK4Zyp1Roc/kF8nymak4bYccWaWoUixbnIr4u8UYiRoPRSglm+23TZEyUZHrgNql9Jw==}
 
   '@replit/codemirror-indentation-markers@6.5.3':
     resolution: {integrity: sha512-hL5Sfvw3C1vgg7GolLe/uxX5T3tmgOA3ZzqlMv47zjU1ON51pzNWiVbS22oh6crYhtVhv8b3gdXwoYp++2ilHw==}
@@ -1054,97 +1054,97 @@ packages:
     resolution: {integrity: sha512-FqALmHI8D4o6lk/LRWDnhw95z5eO+eAa6ORjVg09YRR7BkcM6oPHU9uyC0gtQG5vpFLvgpeU4+zEAz2H8APHNw==}
     engines: {node: '>= 10'}
 
-  '@rolldown/binding-android-arm64@1.0.2':
-    resolution: {integrity: sha512-ZS4D1JPGn/MYQN/SYDWftIE/nVsM8j/AFOYEzAoOE2O3NktQOZru+/vYXGbR/qtdLdIfGCP0lcoJiYVzsEz+iQ==}
+  '@rolldown/binding-android-arm64@1.0.3':
+    resolution: {integrity: sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@rolldown/binding-darwin-arm64@1.0.2':
-    resolution: {integrity: sha512-vdFA9+C/rekyGce7WqHs/xoT0ioZEWaOFyZLIV1mEeNFaFDUQrPIo8Vs2GvJ6eetb3rzDUtUBgzto3ExpXJB3w==}
+  '@rolldown/binding-darwin-arm64@1.0.3':
+    resolution: {integrity: sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@rolldown/binding-darwin-x64@1.0.2':
-    resolution: {integrity: sha512-BewSOwTHazv77DTYiAZXSqqKZ4KP/KonFisDMVU7PImxoWfB2aepnPhd2E4SWz3zDzYgDNbs6jBmTdgNnF02GA==}
+  '@rolldown/binding-darwin-x64@1.0.3':
+    resolution: {integrity: sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@rolldown/binding-freebsd-x64@1.0.2':
-    resolution: {integrity: sha512-m41o7M0YWtUdqk61Tb+jnKb2rN++iRdIASlExkUoKfIAH30DOHCB8fVLzSUpbWHHU8esmEioY62PxzexE8MBuA==}
+  '@rolldown/binding-freebsd-x64@1.0.3':
+    resolution: {integrity: sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.2':
-    resolution: {integrity: sha512-jcojB9H7W/jS29pMKWAK1N+fU99vXodHDTatS3b3y/XSOCiHo0kkA74pL3jJmkoQtYpOCxDvaKs1fo2Ij/1X5w==}
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
+    resolution: {integrity: sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.2':
-    resolution: {integrity: sha512-1jn6qDU5iiOgFgygDzKUuKP0maTi0/f1+sBLgvij/76C77Nm3ts6ufz9Bjg5q5dduxiUIxtq86JIoBvo1xQ4Ig==}
+  '@rolldown/binding-linux-arm64-gnu@1.0.3':
+    resolution: {integrity: sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-arm64-musl@1.0.2':
-    resolution: {integrity: sha512-QVLO/czFMdoMFSqlX3bcswcJNm/23r+qoa/jgtmFc/qEp6/jXmIkDjF/XIo8dPfGaiwy1xfQn8o77L79GeXFgw==}
+  '@rolldown/binding-linux-arm64-musl@1.0.3':
+    resolution: {integrity: sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.2':
-    resolution: {integrity: sha512-hgO5Abm0w5UL6FEa2iFnZqo2KlK7TQ5QhV5x09hujBf7t5KzHQ1VmfPuTpqRy/rNlSxua3eWH374xxiVrP+lcA==}
+  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
+    resolution: {integrity: sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.2':
-    resolution: {integrity: sha512-fy8rXxuYEu602abC8MUNaPjYLIFzReOaEIEMKMUa0rFEUxNpVXhs15KSSQ4qlqSaM7B6rcj9rDZgADh/IGDzLQ==}
+  '@rolldown/binding-linux-s390x-gnu@1.0.3':
+    resolution: {integrity: sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-gnu@1.0.2':
-    resolution: {integrity: sha512-0+bOkiQ779+r1WpoHOWHqncvyySci0vKph+myNDYb+im6meJAzHQXay6oEgnkHuUGouM1LKTZwqKpBow6Kj7CQ==}
+  '@rolldown/binding-linux-x64-gnu@1.0.3':
+    resolution: {integrity: sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-musl@1.0.2':
-    resolution: {integrity: sha512-mjSkrzZK5Qsl0a9d1JgILOiuZOSDTVdKENcSXBoqbzSrspLR/4/IRVDo5wd2GgZjNss/viBFJdeq+j7qH2nypw==}
+  '@rolldown/binding-linux-x64-musl@1.0.3':
+    resolution: {integrity: sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-openharmony-arm64@1.0.2':
-    resolution: {integrity: sha512-1v5vHasdfQAZoEHakBV72LIFAC9JjnymsiKxp+GEr/ma3+NJCPSaYK+qavInOovJkgwFrs7GccX2d6IgDA3Z5w==}
+  '@rolldown/binding-openharmony-arm64@1.0.3':
+    resolution: {integrity: sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rolldown/binding-wasm32-wasi@1.0.2':
-    resolution: {integrity: sha512-mb1VobWn6NheziTk5/WEaR6AKVbrwT5sOi6C7zk3gy/pD1qtJfU1j4PgTo2NJnOtbL9Dl3Aeei8w9jJ7qC2jZQ==}
+  '@rolldown/binding-wasm32-wasi@1.0.3':
+    resolution: {integrity: sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.2':
-    resolution: {integrity: sha512-SqKonF56vA/L2yHwHYcEp2P34URpOZ7d1fS635cTkpDnUtEGdUbhI6NzsPdqeSWvAAeGDrxjWjNmibDIdFf9/A==}
+  '@rolldown/binding-win32-arm64-msvc@1.0.3':
+    resolution: {integrity: sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@rolldown/binding-win32-x64-msvc@1.0.2':
-    resolution: {integrity: sha512-v7qRI7gXLRINcOGXt+7YmAZ6iFuyZVMIoXAxhd8oP+DR9dLfL9GfNIx7PLMxmhZdvq8waUJBQiWN9EKNy+TRBQ==}
+  '@rolldown/binding-win32-x64-msvc@1.0.3':
+    resolution: {integrity: sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1408,14 +1408,6 @@ packages:
   '@types/yargs@17.0.35':
     resolution: {integrity: sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==}
 
-  '@typescript-eslint/eslint-plugin@8.60.0':
-    resolution: {integrity: sha512-QYb/sa74/s7OKMbACMjrYnGspj9Hs5YI5aaffSL65UfeBUzVzBJfVo3oWSpbzPurvm7yaCCo2Lk7lVj610HqKw==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      '@typescript-eslint/parser': ^8.60.0
-      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/eslint-plugin@8.60.1':
     resolution: {integrity: sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1424,52 +1416,29 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/parser@8.60.0':
-    resolution: {integrity: sha512-fcqpj/MyK4sxDPcbe7STNPbpQL4RLZOPWuaTmwZYuc+hJKzRf58yRxfhqGpc6PIq9ZyfSBpfHgmUHmHs0KwHwg==}
+  '@typescript-eslint/parser@8.60.1':
+    resolution: {integrity: sha512-A0M6ua6H252bVjPvvtSgl2QA4+ET9S5Mtkb2GDyTxIhH/C4qDItT7RQNO5PhMC6NXGYXOR9dIalcDDgBKT7oFA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/project-service@8.60.0':
-    resolution: {integrity: sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/project-service@8.60.1':
     resolution: {integrity: sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/scope-manager@8.60.0':
-    resolution: {integrity: sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
   '@typescript-eslint/scope-manager@8.60.1':
     resolution: {integrity: sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/tsconfig-utils@8.60.0':
-    resolution: {integrity: sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/tsconfig-utils@8.60.1':
     resolution: {integrity: sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/type-utils@8.60.0':
-    resolution: {integrity: sha512-SX46wEUtitCpq7AN38HkUU/+zvUpdKf7ephtWAFgckH8O7PQIyL5gvrhQgBLuEYgLfuKWOVvWVskMbuFHAz5xg==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/type-utils@8.60.1':
     resolution: {integrity: sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1477,33 +1446,16 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/types@8.60.0':
-    resolution: {integrity: sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
   '@typescript-eslint/types@8.60.1':
     resolution: {integrity: sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/typescript-estree@8.60.0':
-    resolution: {integrity: sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/typescript-estree@8.60.1':
     resolution: {integrity: sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/utils@8.60.0':
-    resolution: {integrity: sha512-HtXuPfrHTyBDkameWpl+vJb1Uevu2tznAyahM1Oc4AENidCLTPiZDWIo4GfcxNdC/RcfGcadzzkqbRG87dUrQA==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/utils@8.60.1':
     resolution: {integrity: sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1511,10 +1463,6 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/visitor-keys@8.60.0':
-    resolution: {integrity: sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
   '@typescript-eslint/visitor-keys@8.60.1':
     resolution: {integrity: sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1649,8 +1597,8 @@ packages:
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
       vue: ^3.2.25
 
-  '@vitest/eslint-plugin@1.6.18':
-    resolution: {integrity: sha512-J6U4X0jH3NwTuYouvrJn6I8ypTOU+GhKEjyVwpoPnDuc23usa/xi/R0caWLBbNp3xLy3/rL1YkuJuneTMVV4Mg==}
+  '@vitest/eslint-plugin@1.6.19':
+    resolution: {integrity: sha512-zodmXRsVKFsuHxHJILuTFaaKsrsxm0YsiOX65clk+LpCW9JrVXaf6ERXr0caDs+NEk0S62Jyk0K7XYQ7gWXheA==}
     engines: {node: '>=18'}
     peerDependencies:
       '@typescript-eslint/eslint-plugin': '*'
@@ -1665,11 +1613,11 @@ packages:
       vitest:
         optional: true
 
-  '@vitest/expect@4.1.7':
-    resolution: {integrity: sha512-1R+tw0ortHEbZDGMymm+pN7/AFQ/RkFFdtd7EN+VBpynKmLbP8A3rpEXdshBJ7+8hQ9zBJh/i1s0yKNtxAnU7w==}
+  '@vitest/expect@4.1.8':
+    resolution: {integrity: sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==}
 
-  '@vitest/mocker@4.1.7':
-    resolution: {integrity: sha512-vY7nuamKgfvpA1Koa3oYIw/k7D6kZnpGyNMZW8loow2bsBYla1TFdqTaXncWdRn4pgwNs+90RhnXhJScDwQeJA==}
+  '@vitest/mocker@4.1.8':
+    resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -1679,20 +1627,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.7':
-    resolution: {integrity: sha512-umgCarTOYQWIaDMvGDRZij+6b9oVeLIyJzfN+AS88e0ZOU3QTgNNSTtjQOpcvWr3np1N0j4WgZj+sb3oYBDscw==}
+  '@vitest/pretty-format@4.1.8':
+    resolution: {integrity: sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==}
 
-  '@vitest/runner@4.1.7':
-    resolution: {integrity: sha512-BapjmAQ2aI78WdMEfeUWivnfVzB+VPGwWRQcJE0OUq7qEeEcBsCSf+0T5iREBNE5nBb4wA5Ya0W6IA+sghdEFw==}
+  '@vitest/runner@4.1.8':
+    resolution: {integrity: sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==}
 
-  '@vitest/snapshot@4.1.7':
-    resolution: {integrity: sha512-ZacLzja+TmJeZ1h14xW2FB/WpeimUD3haBXQPyJqxvo8jQTmfeA8zv58mtjN2C7EHXZDYVcVYdYmAxjkWVvKCw==}
+  '@vitest/snapshot@4.1.8':
+    resolution: {integrity: sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==}
 
-  '@vitest/spy@4.1.7':
-    resolution: {integrity: sha512-kbkI5LMWakyuTIvs6fUJ5qdIVb1XVKsYJAT4OJ938cHMROYMSfmoQdZy0aaAnjbbc8F61vkoTqz/Az+/HiIu5Q==}
+  '@vitest/spy@4.1.8':
+    resolution: {integrity: sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==}
 
-  '@vitest/utils@4.1.7':
-    resolution: {integrity: sha512-T532WBu791cBxJlCl6SO+J14l81DQx6uQHm1bQbmCDY7nqlEIgkza/UFnSBNaUtSf41unldDFjdOBYEQC4b5Hw==}
+  '@vitest/utils@4.1.8':
+    resolution: {integrity: sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==}
 
   '@volar/language-core@2.4.28':
     resolution: {integrity: sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ==}
@@ -1715,8 +1663,8 @@ packages:
   '@vue/compiler-ssr@3.5.35':
     resolution: {integrity: sha512-rGhAeXgdM7/ffTJGXT69rCCdTmjDewnFuUZfBQQHTdcEBeWdT5HCGY60y2ytLJr9/Dsu7IntUi5z/w0h6Rjnzw==}
 
-  '@vue/language-core@3.3.2':
-    resolution: {integrity: sha512-CLwjSfHlPLhjd2qhuS3tTFtnOIWHXAM5u4X1DxmzlQ8j5bmOYlKCsSusOP7jCRJnlVg0mCTQtHU3vwFvopZGoQ==}
+  '@vue/language-core@3.3.3':
+    resolution: {integrity: sha512-X6p+7nfY7vVT6dQwUJ+v0Jfq/lwIfhL2jMi91dQ3ln4hnlGXlxsDu/FNkeyHYgvYtyQy18ZX76IZy7X4diDbiQ==}
 
   '@vue/reactivity@3.5.35':
     resolution: {integrity: sha512-tVc+SsHConvh/Lz64qq1pP3rYArBmK42xonovEcxY74SQtvctZodG/zhq54P5dr38cVuw25d27cPNRdlMidpGQ==}
@@ -2594,8 +2542,8 @@ packages:
   eslint-import-resolver-node@0.3.10:
     resolution: {integrity: sha512-tRrKqFyCaKict5hOd244sL6EQFNycnMQnBe+j8uqGNXYzsImGbGUU4ibtoaBmv5FLwJwcFJNeg1GeVjQfbMrDQ==}
 
-  eslint-import-resolver-typescript@4.4.4:
-    resolution: {integrity: sha512-1iM2zeBvrYmUNTj2vSC/90JTHDth+dfOfiNKkxApWRsTJYNrc8rOdxxIf5vazX+BiAXTeOT0UvWpGI/7qIWQOw==}
+  eslint-import-resolver-typescript@4.4.5:
+    resolution: {integrity: sha512-nbE5XLph6TLtGYcu/U6e6ZVXyKBhbDWK5cLGk76eJ7NdZpwf1P9EFkpt1Z01mNZNrrilsAYWKH6zUkL4reoXbw==}
     engines: {node: ^16.17.0 || >=18.6.0}
     peerDependencies:
       eslint: '*'
@@ -2737,8 +2685,8 @@ packages:
     peerDependencies:
       eslint: '>=9.38.0'
 
-  eslint-plugin-vue-scoped-css@3.1.0:
-    resolution: {integrity: sha512-R9XLrIZaP6QGz9b4kO2K4+lP4NcO2TKcw71zBtIYCoqqTk5ja1ySruYAllBT2LPIJVQ4NZaB2IFSvLjLEpYqQA==}
+  eslint-plugin-vue-scoped-css@3.1.1:
+    resolution: {integrity: sha512-GIskMvLPnDtiu88rWXQHy2b2QZ4j959N5UgghML64jH0sg3Km+HRa9m7nkpcEBGLD4iA4vtMDbBIoLdFcbT8lQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
     peerDependencies:
       eslint: '>=9.38.0'
@@ -2790,8 +2738,8 @@ packages:
     resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  eslint@10.4.0:
-    resolution: {integrity: sha512-loXy6bWOoP3EP6JA7jo6p5jMpBJmHmsNZM5SFRHLdh1MGOPurMnNBj4ZlAbaqUAaQWbCr7jHV4P7gzAyryZWkQ==}
+  eslint@10.4.1:
+    resolution: {integrity: sha512-AyIKhnOBuOAdueD7RB3xB+YeAWScb9jHsJBgH2Hcde8InP5JYhqrRR6iTMHyTEwgENK54Cp44e4v8BwNhsuHuw==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
     hasBin: true
     peerDependencies:
@@ -3411,6 +3359,10 @@ packages:
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
 
+  js-yaml@4.2.0:
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+    hasBin: true
+
   jsbn@0.1.1:
     resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
 
@@ -4238,13 +4190,13 @@ packages:
   robust-predicates@3.0.3:
     resolution: {integrity: sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==}
 
-  rolldown-license-plugin@3.0.8:
-    resolution: {integrity: sha512-q4nvGtimBIxValBXzkri+0jP2Sdf6PLztYykn7vCu0nVkJEzGsVRfcH/1X6qm0S8//4/gFt/XxwJqpaM6uSdJA==}
+  rolldown-license-plugin@3.0.9:
+    resolution: {integrity: sha512-40u0paM+f049toEj+/q8PlIQXbgkwPSqORtRJihoXr/v1V4amhVSi2uWOZSWyVp1+V/vkTyAV+Ib/fA+DeO3Ag==}
     peerDependencies:
       rolldown: '*'
 
-  rolldown@1.0.2:
-    resolution: {integrity: sha512-oZx5zVDtVB44AW3eaifgDml1gWRDZGvjcfdxonE4swNPG98PrrXjaO/KrnUjzlMnztCCRVlUueA1kCXhARGk6g==}
+  rolldown@1.0.3:
+    resolution: {integrity: sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
@@ -4688,8 +4640,8 @@ packages:
     resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
     engines: {node: '>= 0.4'}
 
-  typescript-eslint@8.60.0:
-    resolution: {integrity: sha512-9f65qWLZdAW9m1JaxBDUHcqRUfL8bkxxXL7XxEfI+F09q56PkBvIfCjLF3yInsDM/BBmwkqmCQdCZe/RYlIWEw==}
+  typescript-eslint@8.60.1:
+    resolution: {integrity: sha512-6m5hkkRAp8lKvhVpcprAIn5KkehQEh+47oHH2VGnExEh7dhNxXlg6GPAOIu6TxbVQxhebrJDvjl3020ooiWCMA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
@@ -4742,8 +4694,8 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  updates@17.17.2:
-    resolution: {integrity: sha512-gOwGrBYBvHVS+OiaUFRuilrmf/P8eYVmKUrkq7W3fvYUgpBsNKgfZo/CPhLKBa7xEFiEuMwMxTkiKsd9mn8pEw==}
+  updates@17.17.3:
+    resolution: {integrity: sha512-ZIhWarBUBmKG65d0AeOOMlZFonGWn6Ntol4/epga/xbQymEOh/2s07U+1UGM94y9JEPbk4CjowYgEo3F76ZxYA==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -4781,8 +4733,8 @@ packages:
     peerDependencies:
       vite: '*'
 
-  vite@8.0.14:
-    resolution: {integrity: sha512-s4BJJ+5y1pYL6Otw51FHhVJQhPnuRinKig64g/1+EUNaJsd3gCKdD31IPFvswUgW9/60QT9oFHbZHbQK5imcxw==}
+  vite@8.0.16:
+    resolution: {integrity: sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -4824,20 +4776,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.7:
-    resolution: {integrity: sha512-flYyaFd2CgoCoU+0UKt3pxksgC+S02iTDN0n3LtqaMeXsI9SBcdNujc2k0DeFLzUn/0k538yNjOSdwgCqcrwJA==}
+  vitest@4.1.8:
+    resolution: {integrity: sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.7
-      '@vitest/browser-preview': 4.1.7
-      '@vitest/browser-webdriverio': 4.1.7
-      '@vitest/coverage-istanbul': 4.1.7
-      '@vitest/coverage-v8': 4.1.7
-      '@vitest/ui': 4.1.7
+      '@vitest/browser-playwright': 4.1.8
+      '@vitest/browser-preview': 4.1.8
+      '@vitest/browser-webdriverio': 4.1.8
+      '@vitest/coverage-istanbul': 4.1.8
+      '@vitest/coverage-v8': 4.1.8
+      '@vitest/ui': 4.1.8
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -4883,8 +4835,8 @@ packages:
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
 
-  vue-tsc@3.3.2:
-    resolution: {integrity: sha512-n7nQoA3YWW/eiDR8jMiv/uJvlg0uLGs+YgUrsTrf9EZaYSt3tuvMZb5V8+7Mvh/EH5pnY/hoVdgfjH+XcK+wwA==}
+  vue-tsc@3.3.3:
+    resolution: {integrity: sha512-SWUEG7YRUeDJHT7Xsuhf02elYX2gxPzzAII7OxDAh4KNOr4QHQ0Lls0YfnaO5GNd560CwVa2HTfdqmA5MqvRqQ==}
     hasBin: true
     peerDependencies:
       typescript: '>=5.0.0'
@@ -5094,7 +5046,7 @@ snapshots:
 
   '@citation-js/plugin-yaml@0.6.2':
     dependencies:
-      js-yaml: 4.1.1
+      js-yaml: 4.2.0
 
   '@citation-js/plugin-zenodo@0.6.2':
     dependencies:
@@ -5478,24 +5430,24 @@ snapshots:
   '@esbuild/win32-x64@0.28.0':
     optional: true
 
-  '@eslint-community/eslint-plugin-eslint-comments@4.7.2(eslint@10.4.0(jiti@2.7.0))':
+  '@eslint-community/eslint-plugin-eslint-comments@4.7.2(eslint@10.4.1(jiti@2.7.0))':
     dependencies:
       escape-string-regexp: 4.0.0
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       ignore: 7.0.5
 
-  '@eslint-community/eslint-utils@4.9.1(eslint@10.4.0(jiti@2.7.0))':
+  '@eslint-community/eslint-utils@4.9.1(eslint@10.4.1(jiti@2.7.0))':
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.2': {}
 
-  '@eslint/compat@1.4.1(eslint@10.4.0(jiti@2.7.0))':
+  '@eslint/compat@1.4.1(eslint@10.4.1(jiti@2.7.0))':
     dependencies:
       '@eslint/core': 0.17.0
     optionalDependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
 
   '@eslint/config-array@0.23.5':
     dependencies:
@@ -5525,7 +5477,7 @@ snapshots:
       globals: 14.0.0
       ignore: 5.3.2
       import-fresh: 3.3.1
-      js-yaml: 4.1.1
+      js-yaml: 4.2.0
       minimatch: 3.1.5
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
@@ -5780,7 +5732,7 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@oxc-project/types@0.132.0': {}
+  '@oxc-project/types@0.133.0': {}
 
   '@package-json/types@0.0.12': {}
 
@@ -5792,7 +5744,7 @@ snapshots:
 
   '@popperjs/core@2.11.8': {}
 
-  '@primer/octicons@19.27.0':
+  '@primer/octicons@19.28.0':
     dependencies:
       object-assign: 4.1.1
 
@@ -5838,53 +5790,53 @@ snapshots:
 
   '@resvg/resvg-wasm@2.6.2': {}
 
-  '@rolldown/binding-android-arm64@1.0.2':
+  '@rolldown/binding-android-arm64@1.0.3':
     optional: true
 
-  '@rolldown/binding-darwin-arm64@1.0.2':
+  '@rolldown/binding-darwin-arm64@1.0.3':
     optional: true
 
-  '@rolldown/binding-darwin-x64@1.0.2':
+  '@rolldown/binding-darwin-x64@1.0.3':
     optional: true
 
-  '@rolldown/binding-freebsd-x64@1.0.2':
+  '@rolldown/binding-freebsd-x64@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.2':
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.2':
+  '@rolldown/binding-linux-arm64-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-arm64-musl@1.0.2':
+  '@rolldown/binding-linux-arm64-musl@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.2':
+  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.2':
+  '@rolldown/binding-linux-s390x-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-x64-gnu@1.0.2':
+  '@rolldown/binding-linux-x64-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-x64-musl@1.0.2':
+  '@rolldown/binding-linux-x64-musl@1.0.3':
     optional: true
 
-  '@rolldown/binding-openharmony-arm64@1.0.2':
+  '@rolldown/binding-openharmony-arm64@1.0.3':
     optional: true
 
-  '@rolldown/binding-wasm32-wasi@1.0.2':
+  '@rolldown/binding-wasm32-wasi@1.0.3':
     dependencies:
       '@emnapi/core': 1.10.0
       '@emnapi/runtime': 1.10.0
       '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
     optional: true
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.2':
+  '@rolldown/binding-win32-arm64-msvc@1.0.3':
     optional: true
 
-  '@rolldown/binding-win32-x64-msvc@1.0.2':
+  '@rolldown/binding-win32-x64-msvc@1.0.3':
     optional: true
 
   '@rolldown/pluginutils@1.0.1': {}
@@ -5925,11 +5877,11 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@stylistic/eslint-plugin@5.10.0(eslint@10.4.0(jiti@2.7.0))':
+  '@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0))':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       '@typescript-eslint/types': 8.60.1
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-visitor-keys: 4.2.1
       espree: 10.4.0
       estraverse: 5.3.0
@@ -6166,15 +6118,15 @@ snapshots:
     dependencies:
       '@types/yargs-parser': 21.0.3
 
-  '@typescript-eslint/eslint-plugin@8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.60.0
-      '@typescript-eslint/type-utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.60.0
-      eslint: 10.4.0(jiti@2.7.0)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
+      eslint: 10.4.1(jiti@2.7.0)
       ignore: 7.0.5
       natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@5.9.3)
@@ -6182,15 +6134,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/eslint-plugin@8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.60.0
-      '@typescript-eslint/type-utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/visitor-keys': 8.60.0
-      eslint: 10.4.0(jiti@2.7.0)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
+      eslint: 10.4.1(jiti@2.7.0)
       ignore: 7.0.5
       natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@6.0.3)
@@ -6198,77 +6150,26 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       '@typescript-eslint/scope-manager': 8.60.1
-      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
       '@typescript-eslint/visitor-keys': 8.60.1
-      eslint: 10.4.0(jiti@2.7.0)
-      ignore: 7.0.5
-      natural-compare: 1.4.0
-      ts-api-utils: 2.5.0(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 10.4.1(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       '@typescript-eslint/scope-manager': 8.60.1
-      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.3)
       '@typescript-eslint/visitor-keys': 8.60.1
-      eslint: 10.4.0(jiti@2.7.0)
-      ignore: 7.0.5
-      natural-compare: 1.4.0
-      ts-api-utils: 2.5.0(typescript@6.0.3)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-    optional: true
-
-  '@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
-    dependencies:
-      '@typescript-eslint/scope-manager': 8.60.0
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.60.0
-      debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/scope-manager': 8.60.0
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
-      '@typescript-eslint/visitor-keys': 8.60.0
-      debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/project-service@8.60.0(typescript@5.9.3)':
-    dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@5.9.3)
-      '@typescript-eslint/types': 8.60.0
-      debug: 4.4.3
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/project-service@8.60.0(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@6.0.3)
-      '@typescript-eslint/types': 8.60.0
       debug: 4.4.3
+      eslint: 10.4.1(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
@@ -6291,24 +6192,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/scope-manager@8.60.0':
-    dependencies:
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/visitor-keys': 8.60.0
-
   '@typescript-eslint/scope-manager@8.60.1':
     dependencies:
       '@typescript-eslint/types': 8.60.1
       '@typescript-eslint/visitor-keys': 8.60.1
 
-  '@typescript-eslint/tsconfig-utils@8.60.0(typescript@5.9.3)':
-    dependencies:
-      typescript: 5.9.3
-
-  '@typescript-eslint/tsconfig-utils@8.60.0(typescript@6.0.3)':
-    dependencies:
-      typescript: 6.0.3
-
   '@typescript-eslint/tsconfig-utils@8.60.1(typescript@5.9.3)':
     dependencies:
       typescript: 5.9.3
@@ -6317,89 +6205,32 @@ snapshots:
     dependencies:
       typescript: 6.0.3
 
-  '@typescript-eslint/type-utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
-    dependencies:
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
-      ts-api-utils: 2.5.0(typescript@5.9.3)
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/type-utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
-      ts-api-utils: 2.5.0(typescript@6.0.3)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/type-utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/type-utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
       '@typescript-eslint/types': 8.60.1
       '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
       debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       ts-api-utils: 2.5.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/type-utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/type-utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/types': 8.60.1
       '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
       debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
-    optional: true
-
-  '@typescript-eslint/types@8.60.0': {}
 
   '@typescript-eslint/types@8.60.1': {}
 
-  '@typescript-eslint/typescript-estree@8.60.0(typescript@5.9.3)':
-    dependencies:
-      '@typescript-eslint/project-service': 8.60.0(typescript@5.9.3)
-      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@5.9.3)
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/visitor-keys': 8.60.0
-      debug: 4.4.3
-      minimatch: 10.2.5
-      semver: 7.8.1
-      tinyglobby: 0.2.17
-      ts-api-utils: 2.5.0(typescript@5.9.3)
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/typescript-estree@8.60.0(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/project-service': 8.60.0(typescript@6.0.3)
-      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@6.0.3)
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/visitor-keys': 8.60.0
-      debug: 4.4.3
-      minimatch: 10.2.5
-      semver: 7.8.1
-      tinyglobby: 0.2.17
-      ts-api-utils: 2.5.0(typescript@6.0.3)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
   '@typescript-eslint/typescript-estree@8.60.1(typescript@5.9.3)':
     dependencies:
       '@typescript-eslint/project-service': 8.60.1(typescript@5.9.3)
@@ -6430,55 +6261,28 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
-      '@typescript-eslint/scope-manager': 8.60.0
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
-      eslint: 10.4.0(jiti@2.7.0)
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
-    dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
-      '@typescript-eslint/scope-manager': 8.60.0
-      '@typescript-eslint/types': 8.60.0
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
-      eslint: 10.4.0(jiti@2.7.0)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
-    dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       '@typescript-eslint/scope-manager': 8.60.1
       '@typescript-eslint/types': 8.60.1
       '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       '@typescript-eslint/scope-manager': 8.60.1
       '@typescript-eslint/types': 8.60.1
       '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.3)
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/visitor-keys@8.60.0':
-    dependencies:
-      '@typescript-eslint/types': 8.60.0
-      eslint-visitor-keys: 5.0.1
-
   '@typescript-eslint/visitor-keys@8.60.1':
     dependencies:
       '@typescript-eslint/types': 8.60.1
@@ -6559,62 +6363,62 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vitejs/plugin-vue@6.0.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))(vue@3.5.35(typescript@6.0.3))':
+  '@vitejs/plugin-vue@6.0.7(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))(vue@3.5.35(typescript@6.0.3))':
     dependencies:
       '@rolldown/pluginutils': 1.0.1
-      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+      vite: 8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
       vue: 3.5.35(typescript@6.0.3)
 
-  '@vitest/eslint-plugin@1.6.18(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))':
+  '@vitest/eslint-plugin@1.6.19(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))':
     dependencies:
       '@typescript-eslint/scope-manager': 8.60.1
-      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      eslint: 10.4.0(jiti@2.7.0)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      eslint: 10.4.1(jiti@2.7.0)
     optionalDependencies:
-      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
       typescript: 6.0.3
-      vitest: 4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
+      vitest: 4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@4.1.7':
+  '@vitest/expect@4.1.8':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.7
-      '@vitest/utils': 4.1.7
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))':
+  '@vitest/mocker@4.1.8(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))':
     dependencies:
-      '@vitest/spy': 4.1.7
+      '@vitest/spy': 4.1.8
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+      vite: 8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
 
-  '@vitest/pretty-format@4.1.7':
+  '@vitest/pretty-format@4.1.8':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.1.7':
+  '@vitest/runner@4.1.8':
     dependencies:
-      '@vitest/utils': 4.1.7
+      '@vitest/utils': 4.1.8
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.7':
+  '@vitest/snapshot@4.1.8':
     dependencies:
-      '@vitest/pretty-format': 4.1.7
-      '@vitest/utils': 4.1.7
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/utils': 4.1.8
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.7': {}
+  '@vitest/spy@4.1.8': {}
 
-  '@vitest/utils@4.1.7':
+  '@vitest/utils@4.1.8':
     dependencies:
-      '@vitest/pretty-format': 4.1.7
+      '@vitest/pretty-format': 4.1.8
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
@@ -6660,7 +6464,7 @@ snapshots:
       '@vue/compiler-dom': 3.5.35
       '@vue/shared': 3.5.35
 
-  '@vue/language-core@3.3.2':
+  '@vue/language-core@3.3.3':
     dependencies:
       '@volar/language-core': 2.4.28
       '@vue/compiler-dom': 3.5.35
@@ -7080,7 +6884,7 @@ snapshots:
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
-      js-yaml: 4.1.1
+      js-yaml: 4.2.0
       parse-json: 5.2.0
     optionalDependencies:
       typescript: 6.0.3
@@ -7613,9 +7417,9 @@ snapshots:
     optionalDependencies:
       source-map: 0.6.1
 
-  eslint-config-prettier@10.1.8(eslint@10.4.0(jiti@2.7.0)):
+  eslint-config-prettier@10.1.8(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
 
   eslint-import-context@0.1.9(unrs-resolver@1.12.2):
     dependencies:
@@ -7632,10 +7436,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.0(jiti@2.7.0)):
+  eslint-import-resolver-typescript@4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-import-context: 0.1.9(unrs-resolver@1.12.2)
       get-tsconfig: 4.14.0
       is-bun-module: 2.0.0
@@ -7643,92 +7447,104 @@ snapshots:
       tinyglobby: 0.2.17
       unrs-resolver: 1.12.2
     optionalDependencies:
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-import-x: 4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-import-x: 4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0)):
+  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      eslint: 10.4.0(jiti@2.7.0)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.0(jiti@2.7.0))
+      eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-array-func@5.1.1(eslint@10.4.0(jiti@2.7.0)):
+  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      debug: 3.2.7
+    optionalDependencies:
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      eslint: 10.4.1(jiti@2.7.0)
+      eslint-import-resolver-node: 0.3.10
+      eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0))
+    transitivePeerDependencies:
+      - supports-color
+    optional: true
 
-  eslint-plugin-de-morgan@2.1.2(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-array-func@5.1.1(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
 
-  eslint-plugin-escompat@3.11.4(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-de-morgan@2.1.2(eslint@10.4.1(jiti@2.7.0)):
+    dependencies:
+      eslint: 10.4.1(jiti@2.7.0)
+
+  eslint-plugin-escompat@3.11.4(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       browserslist: 4.28.2
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
 
-  eslint-plugin-eslint-comments@3.2.0(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-eslint-comments@3.2.0(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       escape-string-regexp: 1.0.5
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       ignore: 5.3.2
 
-  eslint-plugin-filenames@1.3.2(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-filenames@1.3.2(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       lodash.camelcase: 4.3.0
       lodash.kebabcase: 4.1.1
       lodash.snakecase: 4.1.1
       lodash.upperfirst: 4.3.1
 
-  eslint-plugin-github@6.0.0(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-github@6.0.0(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      '@eslint/compat': 1.4.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint/compat': 1.4.1(eslint@10.4.1(jiti@2.7.0))
       '@eslint/eslintrc': 3.3.5
       '@eslint/js': 9.39.4
       '@github/browserslist-config': 1.0.0
-      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
       aria-query: 5.3.2
-      eslint: 10.4.0(jiti@2.7.0)
-      eslint-config-prettier: 10.1.8(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-escompat: 3.11.4(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-eslint-comments: 3.2.0(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-filenames: 1.3.2(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-i18n-text: 1.0.1(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
-      eslint-plugin-jsx-a11y: 6.10.2(eslint@10.4.0(jiti@2.7.0))
+      eslint: 10.4.1(jiti@2.7.0)
+      eslint-config-prettier: 10.1.8(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-escompat: 3.11.4(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-eslint-comments: 3.2.0(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-filenames: 1.3.2(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-i18n-text: 1.0.1(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-jsx-a11y: 6.10.2(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-no-only-tests: 3.4.0
-      eslint-plugin-prettier: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.0(jiti@2.7.0)))(eslint@10.4.0(jiti@2.7.0))(prettier@3.8.3)
+      eslint-plugin-prettier: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.1(jiti@2.7.0)))(eslint@10.4.1(jiti@2.7.0))(prettier@3.8.3)
       eslint-rule-documentation: 1.0.23
       globals: 16.5.0
       jsx-ast-utils: 3.3.5
       prettier: 3.8.3
       svg-element-attributes: 1.3.1
       typescript: 5.9.3
-      typescript-eslint: 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      typescript-eslint: 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
     transitivePeerDependencies:
       - '@types/eslint'
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-plugin-i18n-text@1.0.1(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-i18n-text@1.0.1(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
 
-  eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       '@package-json/types': 0.0.12
       '@typescript-eslint/types': 8.60.1
       comment-parser: 1.4.7
       debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-import-context: 0.1.9(unrs-resolver@1.12.2)
       is-glob: 4.0.3
       minimatch: 10.2.5
@@ -7736,12 +7552,12 @@ snapshots:
       stable-hash-x: 0.2.0
       unrs-resolver: 1.12.2
     optionalDependencies:
-      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
       eslint-import-resolver-node: 0.3.10
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.9
@@ -7750,9 +7566,9 @@ snapshots:
       array.prototype.flatmap: 1.3.3
       debug: 3.2.7
       doctrine: 2.1.0
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
+      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
       hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
@@ -7764,13 +7580,43 @@ snapshots:
       string.prototype.trimend: 1.0.9
       tsconfig-paths: 3.15.0
     optionalDependencies:
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
     transitivePeerDependencies:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-plugin-jsx-a11y@6.10.2(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
+    dependencies:
+      '@rtsao/scc': 1.1.0
+      array-includes: 3.1.9
+      array.prototype.findlastindex: 1.2.6
+      array.prototype.flat: 1.3.3
+      array.prototype.flatmap: 1.3.3
+      debug: 3.2.7
+      doctrine: 2.1.0
+      eslint: 10.4.1(jiti@2.7.0)
+      eslint-import-resolver-node: 0.3.10
+      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
+      hasown: 2.0.4
+      is-core-module: 2.16.2
+      is-glob: 4.0.3
+      minimatch: 3.1.5
+      object.fromentries: 2.0.8
+      object.groupby: 1.0.3
+      object.values: 1.2.1
+      semver: 6.3.1
+      string.prototype.trimend: 1.0.9
+      tsconfig-paths: 3.15.0
+    optionalDependencies:
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+    transitivePeerDependencies:
+      - eslint-import-resolver-typescript
+      - eslint-import-resolver-webpack
+      - supports-color
+    optional: true
+
+  eslint-plugin-jsx-a11y@6.10.2(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       aria-query: 5.3.2
       array-includes: 3.1.9
@@ -7780,7 +7626,7 @@ snapshots:
       axobject-query: 4.1.0
       damerau-levenshtein: 1.0.8
       emoji-regex: 9.2.2
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       hasown: 2.0.4
       jsx-ast-utils: 3.3.5
       language-tags: 1.0.9
@@ -7791,37 +7637,37 @@ snapshots:
 
   eslint-plugin-no-only-tests@3.4.0: {}
 
-  eslint-plugin-playwright@2.10.4(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-playwright@2.10.4(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       globals: 17.6.0
 
-  eslint-plugin-prettier@5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.0(jiti@2.7.0)))(eslint@10.4.0(jiti@2.7.0))(prettier@3.8.3):
+  eslint-plugin-prettier@5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.1(jiti@2.7.0)))(eslint@10.4.1(jiti@2.7.0))(prettier@3.8.3):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       prettier: 3.8.3
       prettier-linter-helpers: 1.0.1
       synckit: 0.11.13
     optionalDependencies:
-      eslint-config-prettier: 10.1.8(eslint@10.4.0(jiti@2.7.0))
+      eslint-config-prettier: 10.1.8(eslint@10.4.1(jiti@2.7.0))
 
-  eslint-plugin-regexp@3.1.0(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-regexp@3.1.0(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       '@eslint-community/regexpp': 4.12.2
       comment-parser: 1.4.7
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       jsdoc-type-pratt-parser: 7.2.0
       refa: 0.12.1
       regexp-ast-analysis: 0.7.1
       scslre: 0.3.0
 
-  eslint-plugin-sonarjs@4.0.3(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-sonarjs@4.0.3(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       '@eslint-community/regexpp': 4.12.2
       builtin-modules: 3.3.0
       bytes: 3.1.2
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       functional-red-black-tree: 1.0.1
       globals: 17.6.0
       jsx-ast-utils-x: 0.1.0
@@ -7832,15 +7678,15 @@ snapshots:
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
 
-  eslint-plugin-unicorn@64.0.0(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-unicorn@64.0.0(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       '@babel/helper-validator-identifier': 7.29.7
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       change-case: 5.4.4
       ci-info: 4.4.0
       clean-regexp: 1.0.0
       core-js-compat: 3.49.0
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       find-up-simple: 1.0.1
       globals: 17.6.0
       indent-string: 5.0.0
@@ -7852,33 +7698,33 @@ snapshots:
       semver: 7.8.1
       strip-indent: 4.1.1
 
-  eslint-plugin-vue-scoped-css@3.1.0(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0))):
+  eslint-plugin-vue-scoped-css@3.1.1(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0))):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       es-toolkit: 1.47.0
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       postcss: 8.5.15
       postcss-safe-parser: 7.0.1(postcss@8.5.15)
       postcss-selector-parser: 7.1.1
-      vue-eslint-parser: 10.4.0(eslint@10.4.0(jiti@2.7.0))
+      vue-eslint-parser: 10.4.0(eslint@10.4.1(jiti@2.7.0))
 
-  eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.0(jiti@2.7.0)))(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0))):
+  eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0)))(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0))):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
-      eslint: 10.4.0(jiti@2.7.0)
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
+      eslint: 10.4.1(jiti@2.7.0)
       natural-compare: 1.4.0
       nth-check: 2.1.1
       postcss-selector-parser: 7.1.1
       semver: 7.8.1
-      vue-eslint-parser: 10.4.0(eslint@10.4.0(jiti@2.7.0))
+      vue-eslint-parser: 10.4.0(eslint@10.4.1(jiti@2.7.0))
       xml-name-validator: 4.0.0
     optionalDependencies:
-      '@stylistic/eslint-plugin': 5.10.0(eslint@10.4.0(jiti@2.7.0))
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@stylistic/eslint-plugin': 5.10.0(eslint@10.4.1(jiti@2.7.0))
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
 
-  eslint-plugin-wc@3.1.0(eslint@10.4.0(jiti@2.7.0)):
+  eslint-plugin-wc@3.1.0(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       is-valid-element-name: 1.0.0
       js-levenshtein-esm: 2.0.0
 
@@ -7897,9 +7743,9 @@ snapshots:
 
   eslint-visitor-keys@5.0.1: {}
 
-  eslint@10.4.0(jiti@2.7.0):
+  eslint@10.4.1(jiti@2.7.0):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       '@eslint-community/regexpp': 4.12.2
       '@eslint/config-array': 0.23.5
       '@eslint/config-helpers': 0.6.0
@@ -8571,6 +8417,10 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
+  js-yaml@4.2.0:
+    dependencies:
+      argparse: 2.0.1
+
   jsbn@0.1.1: {}
 
   jsdoc-type-pratt-parser@7.2.0: {}
@@ -9490,30 +9340,30 @@ snapshots:
 
   robust-predicates@3.0.3: {}
 
-  rolldown-license-plugin@3.0.8(rolldown@1.0.2):
+  rolldown-license-plugin@3.0.9(rolldown@1.0.3):
     dependencies:
-      rolldown: 1.0.2
+      rolldown: 1.0.3
 
-  rolldown@1.0.2:
+  rolldown@1.0.3:
     dependencies:
-      '@oxc-project/types': 0.132.0
+      '@oxc-project/types': 0.133.0
       '@rolldown/pluginutils': 1.0.1
     optionalDependencies:
-      '@rolldown/binding-android-arm64': 1.0.2
-      '@rolldown/binding-darwin-arm64': 1.0.2
-      '@rolldown/binding-darwin-x64': 1.0.2
-      '@rolldown/binding-freebsd-x64': 1.0.2
-      '@rolldown/binding-linux-arm-gnueabihf': 1.0.2
-      '@rolldown/binding-linux-arm64-gnu': 1.0.2
-      '@rolldown/binding-linux-arm64-musl': 1.0.2
-      '@rolldown/binding-linux-ppc64-gnu': 1.0.2
-      '@rolldown/binding-linux-s390x-gnu': 1.0.2
-      '@rolldown/binding-linux-x64-gnu': 1.0.2
-      '@rolldown/binding-linux-x64-musl': 1.0.2
-      '@rolldown/binding-openharmony-arm64': 1.0.2
-      '@rolldown/binding-wasm32-wasi': 1.0.2
-      '@rolldown/binding-win32-arm64-msvc': 1.0.2
-      '@rolldown/binding-win32-x64-msvc': 1.0.2
+      '@rolldown/binding-android-arm64': 1.0.3
+      '@rolldown/binding-darwin-arm64': 1.0.3
+      '@rolldown/binding-darwin-x64': 1.0.3
+      '@rolldown/binding-freebsd-x64': 1.0.3
+      '@rolldown/binding-linux-arm-gnueabihf': 1.0.3
+      '@rolldown/binding-linux-arm64-gnu': 1.0.3
+      '@rolldown/binding-linux-arm64-musl': 1.0.3
+      '@rolldown/binding-linux-ppc64-gnu': 1.0.3
+      '@rolldown/binding-linux-s390x-gnu': 1.0.3
+      '@rolldown/binding-linux-x64-gnu': 1.0.3
+      '@rolldown/binding-linux-x64-musl': 1.0.3
+      '@rolldown/binding-openharmony-arm64': 1.0.3
+      '@rolldown/binding-wasm32-wasi': 1.0.3
+      '@rolldown/binding-win32-arm64-msvc': 1.0.3
+      '@rolldown/binding-win32-x64-msvc': 1.0.3
 
   roughjs@4.6.6:
     dependencies:
@@ -10060,24 +9910,24 @@ snapshots:
       possible-typed-array-names: 1.1.0
       reflect.getprototypeof: 1.0.10
 
-  typescript-eslint@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3):
+  typescript-eslint@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
-      eslint: 10.4.0(jiti@2.7.0)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      eslint: 10.4.1(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  typescript-eslint@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3):
+  typescript-eslint@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
-      eslint: 10.4.0(jiti@2.7.0)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      eslint: 10.4.1(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
@@ -10140,7 +9990,7 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  updates@17.17.2: {}
+  updates@17.17.3: {}
 
   uri-js@4.4.1:
     dependencies:
@@ -10169,16 +10019,16 @@ snapshots:
       core-util-is: 1.0.2
       extsprintf: 1.3.0
 
-  vite-string-plugin@2.0.4(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)):
+  vite-string-plugin@2.0.4(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)):
     dependencies:
-      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+      vite: 8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
 
-  vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0):
+  vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
       postcss: 8.5.15
-      rolldown: 1.0.2
+      rolldown: 1.0.3
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 25.9.1
@@ -10186,15 +10036,15 @@ snapshots:
       fsevents: 2.3.3
       jiti: 2.7.0
 
-  vitest@4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)):
+  vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)):
     dependencies:
-      '@vitest/expect': 4.1.7
-      '@vitest/mocker': 4.1.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
-      '@vitest/pretty-format': 4.1.7
-      '@vitest/runner': 4.1.7
-      '@vitest/snapshot': 4.1.7
-      '@vitest/spy': 4.1.7
-      '@vitest/utils': 4.1.7
+      '@vitest/expect': 4.1.8
+      '@vitest/mocker': 4.1.8(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/runner': 4.1.8
+      '@vitest/snapshot': 4.1.8
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
       es-module-lexer: 2.1.0
       expect-type: 1.3.0
       magic-string: 0.30.21
@@ -10206,7 +10056,7 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+      vite: 8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 25.9.1
@@ -10228,10 +10078,10 @@ snapshots:
       chart.js: 4.5.1
       vue: 3.5.35(typescript@6.0.3)
 
-  vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0)):
+  vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       debug: 4.4.3
-      eslint: 10.4.0(jiti@2.7.0)
+      eslint: 10.4.1(jiti@2.7.0)
       eslint-scope: 9.1.2
       eslint-visitor-keys: 5.0.1
       espree: 11.2.0
@@ -10240,10 +10090,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  vue-tsc@3.3.2(typescript@6.0.3):
+  vue-tsc@3.3.3(typescript@6.0.3):
     dependencies:
       '@volar/typescript': 2.4.28
-      '@vue/language-core': 3.3.2
+      '@vue/language-core': 3.3.3
       typescript: 6.0.3
 
   vue@3.5.35(typescript@6.0.3):
diff --git a/public/assets/img/svg/octicon-vscode.svg b/public/assets/img/svg/octicon-vscode.svg
index 04ac8cacd5..81e0f7cbb0 100644
--- a/public/assets/img/svg/octicon-vscode.svg
+++ b/public/assets/img/svg/octicon-vscode.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" viewBox="0 0 16 16" class="svg octicon-vscode" width="16" height="16"><path d="M10.863 13.919a.8.8 0 0 1-.644.025.8.8 0 0 1-.279-.183L4.816 9.063l-2.232 1.703a.54.54 0 0 1-.691-.031l-.716-.655a.546.546 0 0 1 0-.805L3.112 7.5 1.177 5.725a.546.546 0 0 1 0-.805l.716-.655a.54.54 0 0 1 .691-.031l2.232 1.703L9.94 1.239a.805.805 0 0 1 .923-.159l2.677 1.295c.281.136.46.422.46.736V8h-3.248V4.534L6.864 7.5l3.888 2.966V8H14v3.889c0 .314-.179.6-.46.736z"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="svg octicon-vscode" width="16" height="16" aria-hidden="true"><path fill="currentColor" fill-rule="evenodd" d="M11.098 1.013a.87.87 0 0 1 .524.073l2.883 1.394a.88.88 0 0 1 .495.793v9.454a.88.88 0 0 1-.495.792l-2.883 1.393a.86.86 0 0 1-.994-.17l-5.519-5.06-2.403 1.835a.58.58 0 0 1-.744-.034l-.772-.705a.59.59 0 0 1 0-.867L3.274 8 1.19 6.088a.59.59 0 0 1 0-.866l.772-.706a.58.58 0 0 1 .744-.034l2.403 1.834 5.519-5.058a.87.87 0 0 1 .47-.245M7.315 8l4.187 3.193V11H11.5V6h.002V4.806z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 4248faea5d..618181eb1c 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -151,7 +151,7 @@ func repoAssignment() func(ctx *context.APIContext) {
 					if redirectUserID, err := user_model.LookupUserRedirect(ctx, userName); err == nil {
 						context.RedirectToUser(ctx.Base, ctx.Doer, userName, redirectUserID)
 					} else if user_model.IsErrUserRedirectNotExist(err) {
-						ctx.APIErrorNotFound("GetUserByName", err)
+						ctx.APIErrorNotFound()
 					} else {
 						ctx.APIErrorInternal(err)
 					}
@@ -626,7 +626,7 @@ func orgAssignment(args ...bool) func(ctx *context.APIContext) {
 					if err == nil {
 						context.RedirectToUser(ctx.Base, ctx.Doer, ctx.PathParam("org"), redirectUserID)
 					} else if user_model.IsErrUserRedirectNotExist(err) {
-						ctx.APIErrorNotFound("GetOrgByName", err)
+						ctx.APIErrorNotFound()
 					} else {
 						ctx.APIErrorInternal(err)
 					}
@@ -862,12 +862,12 @@ func individualPermsChecker(ctx *context.APIContext) {
 		switch ctx.ContextUser.Visibility {
 		case api.VisibleTypePrivate:
 			if ctx.Doer == nil || (ctx.ContextUser.ID != ctx.Doer.ID && !ctx.Doer.IsAdmin) {
-				ctx.APIErrorNotFound("Visit Project", nil)
+				ctx.APIErrorNotFound()
 				return
 			}
 		case api.VisibleTypeLimited:
 			if ctx.Doer == nil {
-				ctx.APIErrorNotFound("Visit Project", nil)
+				ctx.APIErrorNotFound()
 				return
 			}
 		}
diff --git a/routers/api/v1/org/org.go b/routers/api/v1/org/org.go
index 16d3e230a0..8f4d19719f 100644
--- a/routers/api/v1/org/org.go
+++ b/routers/api/v1/org/org.go
@@ -146,7 +146,7 @@ func GetUserOrgsPermissions(ctx *context.APIContext) {
 	op := api.OrganizationPermissions{}
 
 	if !organization.HasOrgOrUserVisible(ctx, o, ctx.Doer) {
-		ctx.APIErrorNotFound("HasOrgOrUserVisible", nil)
+		ctx.APIErrorNotFound()
 		return
 	}
 
@@ -312,7 +312,7 @@ func Get(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 
 	if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
-		ctx.APIErrorNotFound("HasOrgOrUserVisible", nil)
+		ctx.APIErrorNotFound()
 		return
 	}
 
diff --git a/routers/api/v1/repo/action.go b/routers/api/v1/repo/action.go
index 5fc2e97d7a..6007747412 100644
--- a/routers/api/v1/repo/action.go
+++ b/routers/api/v1/repo/action.go
@@ -1164,11 +1164,8 @@ func ActionsEnableWorkflow(ctx *context.APIContext) {
 func getCurrentRepoActionRunByID(ctx *context.APIContext) *actions_model.ActionRun {
 	runID := ctx.PathParamInt64("run")
 	run, err := actions_model.GetRunByRepoAndID(ctx, ctx.Repo.Repository.ID, runID)
-	if errors.Is(err, util.ErrNotExist) {
-		ctx.APIErrorNotFound(err)
-		return nil
-	} else if err != nil {
-		ctx.APIErrorInternal(err)
+	if err != nil {
+		ctx.APIErrorAuto(err)
 		return nil
 	}
 	run.Repo = ctx.Repo.Repository
@@ -1198,11 +1195,8 @@ func getCurrentRepoActionRunAttemptByNumber(ctx *context.APIContext) (*actions_m
 
 	attemptNum := ctx.PathParamInt64("attempt")
 	attempt, err := actions_model.GetRunAttemptByRunIDAndAttemptNum(ctx, run.ID, attemptNum)
-	if errors.Is(err, util.ErrNotExist) {
-		ctx.APIErrorNotFound(err)
-		return nil, nil
-	} else if err != nil {
-		ctx.APIErrorInternal(err)
+	if err != nil {
+		ctx.APIErrorAuto(err)
 		return nil, nil
 	}
 	return run, attempt
@@ -1454,7 +1448,7 @@ func RerunWorkflowJob(ctx *context.APIContext) {
 	jobID := ctx.PathParamInt64("job_id")
 	jobIdx := slices.IndexFunc(jobs, func(job *actions_model.ActionRunJob) bool { return job.ID == jobID })
 	if jobIdx == -1 {
-		ctx.APIErrorNotFound(util.NewNotExistErrorf("workflow job with id %d", jobID))
+		ctx.APIErrorNotFound("workflow job not found")
 		return
 	}
 
@@ -1566,11 +1560,7 @@ func ListWorkflowRunJobs(ctx *context.APIContext) {
 
 	run, err := actions_model.GetRunByRepoAndID(ctx, repoID, runID)
 	if err != nil {
-		if errors.Is(err, util.ErrNotExist) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 	// runID is used as an additional filter next to repoID to ensure that we only list jobs for the specified repoID and runID.
@@ -1674,7 +1664,7 @@ func GetWorkflowJob(ctx *context.APIContext) {
 	}
 
 	if !has || job.RepoID != ctx.Repo.Repository.ID {
-		ctx.APIErrorNotFound(util.ErrNotExist)
+		ctx.APIErrorNotFound()
 		return
 	}
 
diff --git a/routers/api/v1/repo/actions_run.go b/routers/api/v1/repo/actions_run.go
index d1d98ff21a..1765ed564d 100644
--- a/routers/api/v1/repo/actions_run.go
+++ b/routers/api/v1/repo/actions_run.go
@@ -4,10 +4,7 @@
 package repo
 
 import (
-	"errors"
-
 	actions_model "gitea.dev/models/actions"
-	"gitea.dev/modules/util"
 	"gitea.dev/routers/common"
 	"gitea.dev/services/context"
 )
@@ -45,11 +42,7 @@ func DownloadActionsRunJobLogs(ctx *context.APIContext) {
 	jobID := ctx.PathParamInt64("job_id")
 	curJob, err := actions_model.GetRunJobByRepoAndID(ctx, ctx.Repo.Repository.ID, jobID)
 	if err != nil {
-		if errors.Is(err, util.ErrNotExist) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 	if err = curJob.LoadRepo(ctx); err != nil {
@@ -59,10 +52,6 @@ func DownloadActionsRunJobLogs(ctx *context.APIContext) {
 
 	err = common.DownloadActionsRunJobLogs(ctx.Base, ctx.Repo.Repository, curJob)
 	if err != nil {
-		if errors.Is(err, util.ErrNotExist) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 	}
 }
diff --git a/routers/api/v1/repo/branch.go b/routers/api/v1/repo/branch.go
index 3b6575d676..0806858b4d 100644
--- a/routers/api/v1/repo/branch.go
+++ b/routers/api/v1/repo/branch.go
@@ -64,7 +64,7 @@ func GetBranch(ctx *context.APIContext) {
 		ctx.APIErrorInternal(err)
 		return
 	} else if !exist {
-		ctx.APIErrorNotFound(err)
+		ctx.APIErrorNotFound()
 		return
 	}
 
@@ -153,7 +153,7 @@ func DeleteBranch(ctx *context.APIContext) {
 	if err := repo_service.DeleteBranch(ctx, ctx.Doer, ctx.Repo.Repository, ctx.Repo.GitRepo, branchName); err != nil {
 		switch {
 		case git.IsErrBranchNotExist(err):
-			ctx.APIErrorNotFound(err)
+			ctx.APIErrorNotFound()
 		case errors.Is(err, repo_service.ErrBranchIsDefault):
 			ctx.APIError(http.StatusForbidden, "can not delete default or pull request target branch")
 		case errors.Is(err, git_model.ErrBranchIsProtected):
@@ -446,7 +446,7 @@ func UpdateBranch(ctx *context.APIContext) {
 	if err := repo_service.UpdateBranch(ctx, repo, ctx.Repo.GitRepo, ctx.Doer, branchName, opt.NewCommitID, opt.OldCommitID, opt.Force); err != nil {
 		switch {
 		case git_model.IsErrBranchNotExist(err):
-			ctx.APIErrorNotFound(err)
+			ctx.APIErrorNotFound()
 		case errors.Is(err, util.ErrInvalidArgument):
 			ctx.APIError(http.StatusUnprocessableEntity, err.Error())
 		case git.IsErrPushRejected(err):
diff --git a/routers/api/v1/repo/commits.go b/routers/api/v1/repo/commits.go
index d83686083e..6f8aaefb6d 100644
--- a/routers/api/v1/repo/commits.go
+++ b/routers/api/v1/repo/commits.go
@@ -258,7 +258,7 @@ func GetAllCommits(ctx *context.APIContext) {
 			ctx.APIErrorInternal(err)
 			return
 		} else if commitsCountTotal == 0 {
-			ctx.APIErrorNotFound("FileCommitsCount", nil)
+			ctx.APIErrorNotFound()
 			return
 		}
 
diff --git a/routers/api/v1/repo/file.go b/routers/api/v1/repo/file.go
index 244d9393ce..5f10c4fbd7 100644
--- a/routers/api/v1/repo/file.go
+++ b/routers/api/v1/repo/file.go
@@ -213,7 +213,7 @@ func getBlobForEntry(ctx *context.APIContext) (blob *git.Blob, entry *git.TreeEn
 	}
 
 	if entry.IsDir() || entry.IsSubModule() {
-		ctx.APIErrorNotFound("getBlobForEntry", nil)
+		ctx.APIErrorNotFound()
 		return nil, nil, nil
 	}
 
@@ -301,18 +301,14 @@ func GetEditorconfig(ctx *context.APIContext) {
 
 	ec, _, err := ctx.Repo.GetEditorconfig(ctx.Repo.Commit)
 	if err != nil {
-		if git.IsErrNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
 	fileName := ctx.PathParam("filename")
 	def, err := ec.GetDefinitionForFilename(fileName)
-	if def == nil {
-		ctx.APIErrorNotFound(err)
+	if err != nil {
+		ctx.APIErrorNotFound(err.Error())
 		return
 	}
 	ctx.JSON(http.StatusOK, def)
@@ -699,10 +695,8 @@ func DeleteFile(ctx *context.APIContext) {
 func resolveRefCommit(ctx *context.APIContext, ref string, minCommitIDLen ...int) *utils.RefCommit {
 	ref = util.IfZero(ref, ctx.Repo.Repository.DefaultBranch)
 	refCommit, err := utils.ResolveRefCommit(ctx, ctx.Repo.Repository, ref, minCommitIDLen...)
-	if errors.Is(err, util.ErrNotExist) {
-		ctx.APIErrorNotFound(err)
-	} else if err != nil {
-		ctx.APIErrorInternal(err)
+	if err != nil {
+		ctx.APIErrorAuto(err)
 	}
 	return refCommit
 }
@@ -828,11 +822,8 @@ func getRepoContents(ctx *context.APIContext, opts files_service.GetContentsOrLi
 	}
 	ret, err := files_service.GetContentsOrList(ctx, ctx.Repo.Repository, ctx.Repo.GitRepo, refCommit, opts)
 	if err != nil {
-		if git.IsErrNotExist(err) {
-			ctx.APIErrorNotFound("GetContentsOrList", err)
-			return nil
-		}
-		ctx.APIErrorInternal(err)
+		ctx.APIErrorAuto(err)
+		return nil
 	}
 	return &ret
 }
diff --git a/routers/api/v1/repo/issue.go b/routers/api/v1/repo/issue.go
index a075c68f74..9946afc8b7 100644
--- a/routers/api/v1/repo/issue.go
+++ b/routers/api/v1/repo/issue.go
@@ -540,16 +540,10 @@ func getUserIDForFilter(ctx *context.APIContext, queryName string) int64 {
 	}
 
 	user, err := user_model.GetUserByName(ctx, userName)
-	if user_model.IsErrUserNotExist(err) {
-		ctx.APIErrorNotFound(err)
-		return 0
-	}
-
 	if err != nil {
-		ctx.APIErrorInternal(err)
+		ctx.APIErrorAuto(err)
 		return 0
 	}
-
 	return user.ID
 }
 
@@ -969,11 +963,7 @@ func DeleteIssue(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/issue_comment.go b/routers/api/v1/repo/issue_comment.go
index 02a0f702ce..6cece7e5ce 100644
--- a/routers/api/v1/repo/issue_comment.go
+++ b/routers/api/v1/repo/issue_comment.go
@@ -447,11 +447,7 @@ func GetIssueComment(ctx *context.APIContext) {
 
 	comment, err := issues_model.GetCommentWithRepoID(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrCommentNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -572,11 +568,7 @@ func EditIssueCommentDeprecated(ctx *context.APIContext) {
 func editIssueComment(ctx *context.APIContext, form api.EditIssueCommentOption) {
 	comment, err := issues_model.GetCommentWithRepoID(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrCommentNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -681,11 +673,7 @@ func DeleteIssueCommentDeprecated(ctx *context.APIContext) {
 func deleteIssueComment(ctx *context.APIContext) {
 	comment, err := issues_model.GetCommentWithRepoID(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrCommentNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/issue_dependency.go b/routers/api/v1/repo/issue_dependency.go
index 4912737c91..ff4e7cd5b4 100644
--- a/routers/api/v1/repo/issue_dependency.go
+++ b/routers/api/v1/repo/issue_dependency.go
@@ -63,11 +63,7 @@ func GetIssueDependencies(ctx *context.APIContext) {
 
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound("IsErrIssueNotExist", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -487,11 +483,7 @@ func RemoveIssueBlocking(ctx *context.APIContext) {
 func getParamsIssue(ctx *context.APIContext) *issues_model.Issue {
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound("IsErrIssueNotExist", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil
 	}
 	issue.Repo = ctx.Repo.Repository
@@ -508,11 +500,7 @@ func getFormIssue(ctx *context.APIContext, form *api.IssueMeta) *issues_model.Is
 		var err error
 		repo, err = repo_model.GetRepositoryByOwnerAndName(ctx, form.Owner, form.Name)
 		if err != nil {
-			if repo_model.IsErrRepoNotExist(err) {
-				ctx.APIErrorNotFound("IsErrRepoNotExist", err)
-			} else {
-				ctx.APIErrorInternal(err)
-			}
+			ctx.APIErrorAuto(err)
 			return nil
 		}
 	} else {
@@ -521,11 +509,7 @@ func getFormIssue(ctx *context.APIContext, form *api.IssueMeta) *issues_model.Is
 
 	issue, err := issues_model.GetIssueByIndex(ctx, repo.ID, form.Index)
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound("IsErrIssueNotExist", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil
 	}
 	issue.Repo = repo
diff --git a/routers/api/v1/repo/issue_lock.go b/routers/api/v1/repo/issue_lock.go
index 75247593fd..2a4f75a937 100644
--- a/routers/api/v1/repo/issue_lock.go
+++ b/routers/api/v1/repo/issue_lock.go
@@ -53,11 +53,7 @@ func LockIssue(ctx *context.APIContext) {
 	reason := web.GetForm(ctx).(*api.LockIssueOption).Reason
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -120,11 +116,7 @@ func UnlockIssue(ctx *context.APIContext) {
 
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/issue_reaction.go b/routers/api/v1/repo/issue_reaction.go
index c9fa39e93d..6ad44ead61 100644
--- a/routers/api/v1/repo/issue_reaction.go
+++ b/routers/api/v1/repo/issue_reaction.go
@@ -53,11 +53,7 @@ func GetIssueCommentReactions(ctx *context.APIContext) {
 
 	comment, err := issues_model.GetCommentByID(ctx, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrCommentNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -190,11 +186,7 @@ func DeleteIssueCommentReaction(ctx *context.APIContext) {
 func changeIssueCommentReaction(ctx *context.APIContext, form api.EditReactionOption, isCreateType bool) {
 	comment, err := issues_model.GetCommentByID(ctx, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrCommentNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/issue_tracked_time.go b/routers/api/v1/repo/issue_tracked_time.go
index 1af649bfd7..33af841fbd 100644
--- a/routers/api/v1/repo/issue_tracked_time.go
+++ b/routers/api/v1/repo/issue_tracked_time.go
@@ -71,16 +71,12 @@ func ListTrackedTimes(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 
 	if !ctx.Repo.Repository.IsTimetrackerEnabled(ctx) {
-		ctx.APIErrorNotFound("Timetracker is disabled")
+		ctx.APIErrorNotFound("timetracker is disabled")
 		return
 	}
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -182,11 +178,7 @@ func AddTime(ctx *context.APIContext) {
 	form := web.GetForm(ctx).(*api.AddTimeOption)
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -265,11 +257,7 @@ func ResetIssueTime(ctx *context.APIContext) {
 
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -338,11 +326,7 @@ func DeleteTime(ctx *context.APIContext) {
 
 	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrIssueNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -357,11 +341,7 @@ func DeleteTime(ctx *context.APIContext) {
 
 	time, err := issues_model.GetTrackedTimeByID(ctx, issue.ID, ctx.PathParamInt64("id"))
 	if err != nil {
-		if db.IsErrNotExist(err) {
-			ctx.APIErrorNotFound(err)
-			return
-		}
-		ctx.APIErrorInternal(err)
+		ctx.APIErrorAuto(err)
 		return
 	}
 	if time.Deleted {
@@ -423,11 +403,7 @@ func ListTrackedTimesByUser(ctx *context.APIContext) {
 	}
 	user, err := user_model.GetUserByName(ctx, ctx.PathParam("timetrackingusername"))
 	if err != nil {
-		if user_model.IsErrUserNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 	if user == nil {
diff --git a/routers/api/v1/repo/notes.go b/routers/api/v1/repo/notes.go
index d8fea56c4c..d2bd708aa4 100644
--- a/routers/api/v1/repo/notes.go
+++ b/routers/api/v1/repo/notes.go
@@ -68,11 +68,7 @@ func getNote(ctx *context.APIContext, identifier string) {
 
 	commitID, err := ctx.Repo.GitRepo.ConvertToGitID(identifier)
 	if err != nil {
-		if git.IsErrNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/pull.go b/routers/api/v1/repo/pull.go
index 54e7b78a1b..dcfaa3d3ac 100644
--- a/routers/api/v1/repo/pull.go
+++ b/routers/api/v1/repo/pull.go
@@ -927,11 +927,7 @@ func MergePullRequest(ctx *context.APIContext) {
 
 	pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrPullRequestNotExist(err) {
-			ctx.APIErrorNotFound("GetPullRequestByIndex", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/pull_review.go b/routers/api/v1/repo/pull_review.go
index 54919cef90..9778dc416a 100644
--- a/routers/api/v1/repo/pull_review.go
+++ b/routers/api/v1/repo/pull_review.go
@@ -63,11 +63,7 @@ func ListPullReviews(ctx *context.APIContext) {
 
 	pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrPullRequestNotExist(err) {
-			ctx.APIErrorNotFound("GetPullRequestByIndex", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -389,11 +385,7 @@ func updatePullReviewCommentResolve(ctx *context.APIContext, isResolve bool) {
 func getPullReviewCommentToResolve(ctx *context.APIContext) *issues_model.Comment {
 	comment, err := issues_model.GetCommentWithRepoID(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrCommentNotExist(err) {
-			ctx.APIErrorNotFound("GetCommentByID", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil
 	}
 
@@ -510,11 +502,7 @@ func CreatePullReview(ctx *context.APIContext) {
 	opts := web.GetForm(ctx).(*api.CreatePullReviewOptions)
 	pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrPullRequestNotExist(err) {
-			ctx.APIErrorNotFound("GetPullRequestByIndex", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -737,33 +725,25 @@ func preparePullReviewType(ctx *context.APIContext, pr *issues_model.PullRequest
 func prepareSingleReview(ctx *context.APIContext) (*issues_model.Review, *issues_model.PullRequest, bool) {
 	pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrPullRequestNotExist(err) {
-			ctx.APIErrorNotFound("GetPullRequestByIndex", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil, nil, true
 	}
 
 	review, err := issues_model.GetReviewByID(ctx, ctx.PathParamInt64("id"))
 	if err != nil {
-		if issues_model.IsErrReviewNotExist(err) {
-			ctx.APIErrorNotFound("GetReviewByID", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil, nil, true
 	}
 
 	// validate the review is for the given PR
 	if review.IssueID != pr.IssueID {
-		ctx.APIErrorNotFound("ReviewNotInPR")
+		ctx.APIErrorNotFound()
 		return nil, nil, true
 	}
 
 	// make sure that the user has access to this review if it is pending
 	if review.Type == issues_model.ReviewTypePending && review.ReviewerID != ctx.Doer.ID && !ctx.Doer.IsAdmin {
-		ctx.APIErrorNotFound("GetReviewByID")
+		ctx.APIErrorNotFound()
 		return nil, nil, true
 	}
 
@@ -870,7 +850,7 @@ func parseReviewersByNames(ctx *context.APIContext, reviewerNames, teamReviewerN
 
 		if err != nil {
 			if user_model.IsErrUserNotExist(err) {
-				ctx.APIErrorNotFound("UserNotExist", fmt.Sprintf("User '%s' not exist", r))
+				ctx.APIErrorNotFound("user doesn't exist: " + r)
 				return nil, nil
 			}
 			ctx.APIErrorInternal(err)
@@ -886,7 +866,7 @@ func parseReviewersByNames(ctx *context.APIContext, reviewerNames, teamReviewerN
 			teamReviewer, err = organization.GetTeam(ctx, ctx.Repo.Owner.ID, t)
 			if err != nil {
 				if organization.IsErrTeamNotExist(err) {
-					ctx.APIErrorNotFound("TeamNotExist", fmt.Sprintf("Team '%s' not exist", t))
+					ctx.APIErrorNotFound("team doesn't exist: " + t)
 					return nil, nil
 				}
 				ctx.APIErrorInternal(err)
@@ -902,11 +882,7 @@ func parseReviewersByNames(ctx *context.APIContext, reviewerNames, teamReviewerN
 func apiReviewRequest(ctx *context.APIContext, opts api.PullReviewRequestOptions, isAdd bool) {
 	pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
 	if err != nil {
-		if issues_model.IsErrPullRequestNotExist(err) {
-			ctx.APIErrorNotFound("GetPullRequestByIndex", err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/repo/release_attachment.go b/routers/api/v1/repo/release_attachment.go
index 715552d72c..915ac725b0 100644
--- a/routers/api/v1/repo/release_attachment.go
+++ b/routers/api/v1/repo/release_attachment.go
@@ -205,7 +205,7 @@ func CreateReleaseAttachment(ctx *context.APIContext) {
 
 	// Check if attachments are enabled
 	if !setting.Attachment.Enabled {
-		ctx.APIErrorNotFound("Attachment is not enabled")
+		ctx.APIErrorNotFound("attachment is not enabled")
 		return
 	}
 
diff --git a/routers/api/v1/repo/wiki.go b/routers/api/v1/repo/wiki.go
index dad0bfbbce..67209fa127 100644
--- a/routers/api/v1/repo/wiki.go
+++ b/routers/api/v1/repo/wiki.go
@@ -245,11 +245,7 @@ func DeleteWikiPage(ctx *context.APIContext) {
 	wikiName := wiki_service.WebPathFromRequest(ctx.PathParamRaw("pageName"))
 
 	if err := wiki_service.DeleteWikiPage(ctx, ctx.Doer, ctx.Repo.Repository, wikiName); err != nil {
-		if err.Error() == "file does not exist" {
-			ctx.APIErrorNotFound(err)
-			return
-		}
-		ctx.APIErrorInternal(err)
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -474,21 +470,13 @@ func findEntryForFile(commit *git.Commit, target string) (*git.TreeEntry, error)
 func findWikiRepoCommit(ctx *context.APIContext) (*git.Repository, *git.Commit) {
 	wikiRepo, err := gitrepo.OpenRepository(ctx, ctx.Repo.Repository.WikiStorageRepo())
 	if err != nil {
-		if git.IsErrNotExist(err) || err.Error() == "no such file or directory" {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil, nil
 	}
 
 	commit, err := wikiRepo.GetBranchCommit(ctx.Repo.Repository.DefaultWikiBranch)
 	if err != nil {
-		if git.IsErrNotExist(err) {
-			ctx.APIErrorNotFound(err)
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return wikiRepo, nil
 	}
 	return wikiRepo, commit
diff --git a/routers/api/v1/shared/block.go b/routers/api/v1/shared/block.go
index 8b2a207ccb..c2a5fe8a4e 100644
--- a/routers/api/v1/shared/block.go
+++ b/routers/api/v1/shared/block.go
@@ -45,7 +45,7 @@ func ListBlocks(ctx *context.APIContext, blocker *user_model.User) {
 func CheckUserBlock(ctx *context.APIContext, blocker *user_model.User) {
 	blockee, err := user_model.GetUserByName(ctx, ctx.PathParam("username"))
 	if err != nil {
-		ctx.APIErrorNotFound("GetUserByName", err)
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -62,7 +62,7 @@ func CheckUserBlock(ctx *context.APIContext, blocker *user_model.User) {
 func BlockUser(ctx *context.APIContext, blocker *user_model.User) {
 	blockee, err := user_model.GetUserByName(ctx, ctx.PathParam("username"))
 	if err != nil {
-		ctx.APIErrorNotFound("GetUserByName", err)
+		ctx.APIErrorAuto(err)
 		return
 	}
 
@@ -81,7 +81,7 @@ func BlockUser(ctx *context.APIContext, blocker *user_model.User) {
 func UnblockUser(ctx *context.APIContext, doer, blocker *user_model.User) {
 	blockee, err := user_model.GetUserByName(ctx, ctx.PathParam("username"))
 	if err != nil {
-		ctx.APIErrorNotFound("GetUserByName", err)
+		ctx.APIErrorAuto(err)
 		return
 	}
 
diff --git a/routers/api/v1/shared/runners.go b/routers/api/v1/shared/runners.go
index 329f17736e..fbb0262768 100644
--- a/routers/api/v1/shared/runners.go
+++ b/routers/api/v1/shared/runners.go
@@ -77,11 +77,7 @@ func getRunnerByID(ctx *context.APIContext, ownerID, repoID, runnerID int64) (*a
 
 	runner, err := actions_model.GetRunnerByID(ctx, runnerID)
 	if err != nil {
-		if errors.Is(err, util.ErrNotExist) {
-			ctx.APIErrorNotFound("Runner not found")
-		} else {
-			ctx.APIErrorInternal(err)
-		}
+		ctx.APIErrorAuto(err)
 		return nil, false
 	}
 
diff --git a/routers/api/v1/user/gpg_key.go b/routers/api/v1/user/gpg_key.go
index 562e70b5c0..0148c7f5da 100644
--- a/routers/api/v1/user/gpg_key.go
+++ b/routers/api/v1/user/gpg_key.go
@@ -4,7 +4,6 @@
 package user
 
 import (
-	"errors"
 	"net/http"
 	"strings"
 
@@ -135,7 +134,7 @@ func GetGPGKey(ctx *context.APIContext) {
 // CreateUserGPGKey creates new GPG key to given user by ID.
 func CreateUserGPGKey(ctx *context.APIContext, form api.CreateGPGKeyOption, uid int64) {
 	if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageGPGKeys) {
-		ctx.APIErrorNotFound("Not Found", errors.New("gpg keys setting is not allowed to be visited"))
+		ctx.APIErrorNotFound("gpg keys setting is not allowed to be changed")
 		return
 	}
 
@@ -276,7 +275,7 @@ func DeleteGPGKey(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 
 	if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageGPGKeys) {
-		ctx.APIErrorNotFound("Not Found", errors.New("gpg keys setting is not allowed to be visited"))
+		ctx.APIErrorNotFound("gpg keys setting is not allowed to be changed")
 		return
 	}
 
diff --git a/routers/api/v1/user/helper.go b/routers/api/v1/user/helper.go
index ce051e2d16..ee7b8b1727 100644
--- a/routers/api/v1/user/helper.go
+++ b/routers/api/v1/user/helper.go
@@ -18,7 +18,7 @@ func GetUserByPathParam(ctx *context.APIContext, name string) *user_model.User {
 			if redirectUserID, err2 := user_model.LookupUserRedirect(ctx, username); err2 == nil {
 				context.RedirectToUser(ctx.Base, ctx.Doer, username, redirectUserID)
 			} else {
-				ctx.APIErrorNotFound("GetUserByName", err)
+				ctx.APIErrorNotFound()
 			}
 		} else {
 			ctx.APIErrorInternal(err)
diff --git a/routers/api/v1/user/key.go b/routers/api/v1/user/key.go
index 1a932c94af..c12e98ca4c 100644
--- a/routers/api/v1/user/key.go
+++ b/routers/api/v1/user/key.go
@@ -6,7 +6,6 @@ package user
 
 import (
 	std_ctx "context"
-	"errors"
 	"net/http"
 
 	asymkey_model "gitea.dev/models/asymkey"
@@ -201,7 +200,7 @@ func GetPublicKey(ctx *context.APIContext) {
 // CreateUserPublicKey creates new public key to given user by ID.
 func CreateUserPublicKey(ctx *context.APIContext, form api.CreateKeyOption, uid int64) {
 	if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageSSHKeys) {
-		ctx.APIErrorNotFound("Not Found", errors.New("ssh keys setting is not allowed to be visited"))
+		ctx.APIErrorNotFound("ssh keys setting is not allowed to be changed")
 		return
 	}
 
@@ -271,7 +270,7 @@ func DeletePublicKey(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 
 	if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageSSHKeys) {
-		ctx.APIErrorNotFound("Not Found", errors.New("ssh keys setting is not allowed to be visited"))
+		ctx.APIErrorNotFound("ssh keys setting is not allowed to be changed")
 		return
 	}
 
diff --git a/routers/api/v1/user/user.go b/routers/api/v1/user/user.go
index d45ca11348..8343e38077 100644
--- a/routers/api/v1/user/user.go
+++ b/routers/api/v1/user/user.go
@@ -117,7 +117,7 @@ func GetInfo(ctx *context.APIContext) {
 
 	if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
 		// fake ErrUserNotExist error message to not leak information about existence
-		ctx.APIErrorNotFound("GetUserByName", user_model.ErrUserNotExist{Name: ctx.PathParam("username")})
+		ctx.APIErrorNotFound()
 		return
 	}
 	ctx.JSON(http.StatusOK, convert.ToUser(ctx, ctx.ContextUser, ctx.Doer))
diff --git a/routers/web/devtest/mock_actions.go b/routers/web/devtest/mock_actions.go
index 69062ff6e7..61f20a3ef4 100644
--- a/routers/web/devtest/mock_actions.go
+++ b/routers/web/devtest/mock_actions.go
@@ -214,6 +214,75 @@ func MockActionsRunsJobs(ctx *context.Context) {
 		return fmt.Sprintf("%s/jobs/%d", resp.State.Run.Link, jobID)
 	}
 
+	// Keep devtest mock runs minimal: use run 10 as a "complex graph" repro.
+	// This combines long durations, parallel roots, and a multi-dependency downstream job
+	// to validate the workflow graph rendering.
+	if runID == 10 {
+		resp.State.Run.WorkflowID = "workflow-devtest-complex"
+		resp.State.Run.Duration = "7h 12m 34s"
+
+		type mj struct {
+			jobID    string
+			name     string
+			status   actions_model.Status
+			duration string
+			needs    []string
+		}
+		mockJobs := []mj{
+			{jobID: "job-100", name: "job-100", status: actions_model.StatusSuccess, duration: "3s", needs: nil},
+			{jobID: "job-101", name: "job-101", status: actions_model.StatusSuccess, duration: "3s", needs: []string{"job-100"}},
+			{jobID: "job-102", name: "job-102", status: actions_model.StatusSuccess, duration: "4s", needs: []string{"job-100", "job-101"}},
+			{jobID: "job-103", name: "job-103", status: actions_model.StatusSuccess, duration: "2s", needs: []string{"job-100"}},
+
+			{jobID: "prep-jdk", name: "prep-jdk", status: actions_model.StatusSuccess, duration: "3s", needs: nil},
+			{jobID: "code-analysis", name: "code-analysis", status: actions_model.StatusSuccess, duration: "3s", needs: nil},
+
+			// Matrix expansion (the " (...)" suffix is the heuristic the frontend uses to group rows)
+			{jobID: "matrix-e2e-1-chromium", name: "matrix-e2e (1, chromium)", status: actions_model.StatusSuccess, duration: "2s", needs: []string{"prep-jdk"}},
+			{jobID: "matrix-e2e-1-firefox", name: "matrix-e2e (1, firefox)", status: actions_model.StatusSuccess, duration: "2s", needs: []string{"prep-jdk"}},
+			{jobID: "matrix-e2e-2-chromium", name: "matrix-e2e (2, chromium)", status: actions_model.StatusSuccess, duration: "2s", needs: []string{"prep-jdk"}},
+			{jobID: "matrix-e2e-3-chromium", name: "matrix-e2e (3, chromium)", status: actions_model.StatusSuccess, duration: "4s", needs: []string{"prep-jdk"}},
+			{jobID: "matrix-e2e-3-firefox", name: "matrix-e2e (3, firefox)", status: actions_model.StatusSuccess, duration: "2s", needs: []string{"prep-jdk"}},
+			{jobID: "matrix-e2e-99-webkit", name: "matrix-e2e (99, webkit)", status: actions_model.StatusSuccess, duration: "2s", needs: []string{"prep-jdk"}},
+
+			{jobID: "unit-test", name: "unit-test", status: actions_model.StatusSuccess, duration: "3s", needs: []string{"prep-jdk"}},
+			{jobID: "arch-test", name: "arch-test", status: actions_model.StatusSuccess, duration: "3s", needs: []string{"prep-jdk"}},
+			{jobID: "integration-test", name: "integration-test", status: actions_model.StatusSuccess, duration: "4s", needs: []string{"prep-jdk"}},
+
+			{jobID: "build-image", name: "build-image", status: actions_model.StatusSuccess, duration: "3s", needs: []string{
+				"unit-test",
+				"arch-test",
+				"integration-test",
+				"code-analysis",
+				"matrix-e2e-1-chromium",
+				"matrix-e2e-1-firefox",
+				"matrix-e2e-2-chromium",
+				"matrix-e2e-3-chromium",
+				"matrix-e2e-3-firefox",
+				"matrix-e2e-99-webkit",
+			}},
+		}
+
+		resp.State.Run.Jobs = nil
+		for i, j := range mockJobs {
+			id := runID*1000 + int64(i)
+			resp.State.Run.Jobs = append(resp.State.Run.Jobs, &actions.ViewJob{
+				ID:       id,
+				Link:     jobLink(id),
+				JobID:    j.jobID,
+				Name:     j.name,
+				Status:   j.status.String(),
+				CanRerun: j.jobID == "job-100",
+				Duration: j.duration,
+				Needs:    j.needs,
+			})
+		}
+
+		fillViewRunResponseCurrentJob(ctx, resp)
+		ctx.JSON(http.StatusOK, resp)
+		return
+	}
+
 	resp.State.Run.Jobs = append(resp.State.Run.Jobs, &actions.ViewJob{
 		ID:       runID * 10,
 		Link:     jobLink(runID * 10),
@@ -240,7 +309,7 @@ func MockActionsRunsJobs(ctx *context.Context) {
 		Name:     "ULTRA LOOOOOOOOOOOONG job name 102 that exceeds the limit",
 		Status:   actions_model.StatusFailure.String(),
 		CanRerun: false,
-		Duration: "3h",
+		Duration: "3h35m10s",
 		Needs:    []string{"job-100", "job-101"},
 	})
 	resp.State.Run.Jobs = append(resp.State.Run.Jobs, &actions.ViewJob{
diff --git a/routers/web/repo/actions/actions.go b/routers/web/repo/actions/actions.go
index 5ae0d14a6f..9c5e1664de 100644
--- a/routers/web/repo/actions/actions.go
+++ b/routers/web/repo/actions/actions.go
@@ -27,6 +27,7 @@ import (
 	"gitea.dev/modules/templates"
 	"gitea.dev/modules/util"
 	shared_user "gitea.dev/routers/web/shared/user"
+	actions_service "gitea.dev/services/actions"
 	"gitea.dev/services/context"
 	"gitea.dev/services/convert"
 
@@ -208,12 +209,20 @@ func prepareWorkflowTemplate(ctx *context.Context, commit *git.Commit) (workflow
 			if !hasJobWithoutNeeds && len(j.Needs()) == 0 {
 				hasJobWithoutNeeds = true
 			}
+			if j.Uses != "" {
+				if _, err := actions_service.ResolveUses(ctx, j.Uses); err != nil {
+					workflow.ErrMsg = ctx.Locale.TrString("actions.runs.invalid_reusable_workflow_uses", err.Error())
+					break
+				}
+			}
 		}
-		if !hasJobWithoutNeeds {
-			workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job_without_needs")
-		}
-		if emptyJobsNumber == len(wf.Jobs) {
-			workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job")
+		if workflow.ErrMsg == "" {
+			if !hasJobWithoutNeeds {
+				workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job_without_needs")
+			}
+			if emptyJobsNumber == len(wf.Jobs) {
+				workflow.ErrMsg = ctx.Locale.TrString("actions.runs.no_job")
+			}
 		}
 		workflows = append(workflows, workflow)
 	}
@@ -352,7 +361,7 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo, otherWo
 		return
 	}
 	for _, run := range runs {
-		if !run.Status.In(actions_model.StatusWaiting, actions_model.StatusRunning) {
+		if !run.Status.In(actions_model.StatusWaiting, actions_model.StatusRunning, actions_model.StatusBlocked) {
 			continue
 		}
 		jobs, err := actions_model.GetLatestAttemptJobsByRepoAndRunID(ctx, run.RepoID, run.ID)
@@ -361,23 +370,31 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo, otherWo
 			return
 		}
 		for _, job := range jobs {
-			if !job.Status.IsWaiting() {
+			if !job.Status.In(actions_model.StatusWaiting, actions_model.StatusBlocked) {
 				continue
 			}
 			if err := actions.ValidateWorkflowContent(job.WorkflowPayload); err != nil {
 				runErrors[run.ID] = ctx.Locale.TrString("actions.runs.invalid_workflow_helper", err.Error())
 				break
 			}
-			hasOnlineRunner := false
-			for _, runner := range runners {
-				if !runner.IsDisabled && runner.CanMatchLabels(job.RunsOn) {
-					hasOnlineRunner = true
+			if job.CallUses != "" {
+				if _, err := actions_service.ResolveUses(ctx, job.CallUses); err != nil {
+					runErrors[run.ID] = ctx.Locale.TrString("actions.runs.invalid_reusable_workflow_uses", err.Error())
 					break
 				}
 			}
-			if !hasOnlineRunner {
-				runErrors[run.ID] = ctx.Locale.TrString("actions.runs.no_matching_online_runner_helper", strings.Join(job.RunsOn, ","))
-				break
+			if job.Status.IsWaiting() {
+				hasOnlineRunner := false
+				for _, runner := range runners {
+					if !runner.IsDisabled && runner.CanMatchLabels(job.RunsOn) {
+						hasOnlineRunner = true
+						break
+					}
+				}
+				if !hasOnlineRunner {
+					runErrors[run.ID] = ctx.Locale.TrString("actions.runs.no_matching_online_runner_helper", strings.Join(job.RunsOn, ","))
+					break
+				}
 			}
 		}
 	}
diff --git a/services/actions/reusable_workflow.go b/services/actions/reusable_workflow.go
index 9b5ecdef6f..65a6acfbd0 100644
--- a/services/actions/reusable_workflow.go
+++ b/services/actions/reusable_workflow.go
@@ -6,6 +6,7 @@ package actions
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
@@ -15,7 +16,9 @@ import (
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/httplib"
 	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/util"
 	"gitea.dev/services/convert"
@@ -149,10 +152,10 @@ func expandReusableWorkflowCaller(ctx context.Context, run *actions_model.Action
 		return fmt.Errorf("parse caller job %d: %w", caller.ID, err)
 	}
 
-	// 3. Load called-workflow source.
-	ref, err := jobparser.ParseUses(parsedJob.Uses)
+	// 3. Resolve `uses` and load called-workflow source.
+	ref, err := ResolveUses(ctx, parsedJob.Uses)
 	if err != nil {
-		return fmt.Errorf("parse uses %q: %w", parsedJob.Uses, err)
+		return fmt.Errorf("resolve uses %q: %w", parsedJob.Uses, err)
 	}
 	content, contentSourceRepoID, contentSourceCommitSHA, err := loadReusableWorkflowSource(ctx, run, caller, ref)
 	if err != nil {
@@ -340,3 +343,20 @@ func insertCallerChildren(ctx context.Context, run *actions_model.ActionRun, att
 	}
 	return nil
 }
+
+// ResolveUses normalizes and parses a reusable workflow `uses:` value.
+// It first rewrites an absolute URL pointing to this instance into the cross-repo form (rejecting external URLs),
+// then validates the syntax via jobparser.ParseUses.
+func ResolveUses(ctx context.Context, uses string) (*jobparser.UsesRef, error) {
+	// Rewrite a local-instance URL to the equivalent cross-repo form "owner/repo/.gitea/workflows/file.yml@ref".
+	if strings.HasPrefix(uses, "http://") || strings.HasPrefix(uses, "https://") {
+		// ParseGiteaSiteURL returns nil for URLs that do not belong to this instance.
+		gsu := httplib.ParseGiteaSiteURL(ctx, uses)
+		if gsu == nil {
+			return nil, fmt.Errorf("unsupported reusable workflow URL %q: an absolute URL must point to this Gitea instance (%s)", uses, setting.AppURL)
+		}
+		// RoutePath is the instance-relative path (AppSubURL already stripped), e.g. "/owner/repo/.gitea/workflows/file.yml@ref".
+		uses = strings.TrimPrefix(gsu.RoutePath, "/")
+	}
+	return jobparser.ParseUses(uses)
+}
diff --git a/services/actions/reusable_workflow_test.go b/services/actions/reusable_workflow_test.go
index cadb26a851..a7bb41ba8a 100644
--- a/services/actions/reusable_workflow_test.go
+++ b/services/actions/reusable_workflow_test.go
@@ -10,6 +10,9 @@ import (
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -132,3 +135,44 @@ func buildCallerChain(t *testing.T, callerUses ...string) []*actions_model.Actio
 	}
 	return jobs
 }
+
+func TestResolveUses(t *testing.T) {
+	defer test.MockVariableValue(&setting.AppURL, "https://gitea.example.com/sub/")()
+	defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
+	ctx := t.Context()
+
+	t.Run("LocalForms", func(t *testing.T) {
+		// Same-repo and cross-repo forms are not URLs and are parsed as-is.
+		ref, err := ResolveUses(ctx, "./.gitea/workflows/build.yml")
+		require.NoError(t, err)
+		assert.Equal(t, jobparser.UsesRef{Kind: jobparser.UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yml"}, *ref)
+
+		ref, err = ResolveUses(ctx, "owner/repo/.gitea/workflows/build.yml@v1")
+		require.NoError(t, err)
+		assert.Equal(t, jobparser.UsesRef{Kind: jobparser.UsesKindLocalCrossRepo, Owner: "owner", Repo: "repo", Path: ".gitea/workflows/build.yml", Ref: "v1"}, *ref)
+	})
+
+	t.Run("LocalInstanceURL", func(t *testing.T) {
+		// An absolute URL on this instance (incl. AppSubURL) resolves to the equivalent cross-repo ref.
+		ref, err := ResolveUses(ctx, "https://gitea.example.com/sub/owner/repo/.gitea/workflows/ci.yml@refs/heads/main")
+		require.NoError(t, err)
+		assert.Equal(t, jobparser.UsesRef{Kind: jobparser.UsesKindLocalCrossRepo, Owner: "owner", Repo: "repo", Path: ".gitea/workflows/ci.yml", Ref: "refs/heads/main"}, *ref)
+	})
+
+	t.Run("InvalidSyntax", func(t *testing.T) {
+		for _, in := range []string{
+			"owner/.gitea/workflows/foo.yml",                                             // missing repo segment
+			"owner/repo/.gitea/workflows/foo.yml",                                        // missing @ref
+			"https://gitea.example.com/sub/repo/.gitea/workflows/ci.yml@refs/heads/main", // local absolute URL but missing owner
+			"not a valid uses at all",
+		} {
+			_, err := ResolveUses(ctx, in)
+			require.Error(t, err, "in = %s", in)
+		}
+	})
+
+	t.Run("ForeignURL", func(t *testing.T) {
+		_, err := ResolveUses(ctx, "https://other.gitea-example.com/owner/repo/.gitea/workflows/ci.yaml@v1")
+		assert.ErrorContains(t, err, "must point to this Gitea instance")
+	})
+}
diff --git a/services/context/api.go b/services/context/api.go
index 7731b5692f..02ec2b7138 100644
--- a/services/context/api.go
+++ b/services/context/api.go
@@ -138,26 +138,10 @@ func (ctx *APIContext) apiErrorInternal(skip int, err error) {
 }
 
 // APIErrorNotFound handles 404s for APIContext
-// String will replace message, errors will be added to a slice
-func (ctx *APIContext) APIErrorNotFound(objs ...any) {
-	var message string
-	var errs []string
-	for _, obj := range objs {
-		// Ignore nil
-		if obj == nil {
-			continue
-		}
-
-		if err, ok := obj.(error); ok {
-			errs = append(errs, err.Error())
-		} else {
-			message = obj.(string)
-		}
-	}
-	ctx.JSON(http.StatusNotFound, map[string]any{
-		"message": util.IfZero(message, "not found"), // do not use locale in API
-		"url":     setting.API.SwaggerURL,
-		"errors":  errs,
+func (ctx *APIContext) APIErrorNotFound(msg ...string) {
+	ctx.JSON(http.StatusNotFound, APIError{
+		Message: util.OptionalArg(msg, "not found"),
+		URL:     setting.API.SwaggerURL,
 	})
 }
 
diff --git a/services/issue/pull.go b/services/issue/pull.go
index 055c1023b4..260ac5ceae 100644
--- a/services/issue/pull.go
+++ b/services/issue/pull.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"time"
 
 	issues_model "gitea.dev/models/issues"
 	org_model "gitea.dev/models/organization"
@@ -26,6 +27,10 @@ type ReviewRequestNotifier struct {
 
 var codeOwnerFiles = []string{"CODEOWNERS", "docs/CODEOWNERS", ".gitea/CODEOWNERS"}
 
+// codeOwnerMatchBudget caps the total wall-clock time spent evaluating all
+// CODEOWNERS rules against all changed files for a single PR.
+const codeOwnerMatchBudget = 2 * time.Second
+
 func IsCodeOwnerFile(f string) bool {
 	return slices.Contains(codeOwnerFiles, f)
 }
@@ -93,8 +98,17 @@ func PullRequestCodeOwnersReview(ctx context.Context, pr *issues_model.PullReque
 
 	uniqUsers := make(map[int64]*user_model.User)
 	uniqTeams := make(map[string]*org_model.Team)
+	// Bound the total time spent matching rules×files. The per-rule MatchTimeout
+	// only caps a single match; without an aggregate budget a crafted CODEOWNERS
+	// plus a PR touching many files could still exhaust CPU inside this loop.
+	matchDeadline := time.Now().Add(codeOwnerMatchBudget)
+ruleLoop:
 	for _, rule := range rules {
 		for _, f := range changedFiles {
+			if time.Now().After(matchDeadline) {
+				log.Warn("CODEOWNERS matching for PR %s#%d exceeded its time budget; some rules were not evaluated", pr.BaseRepo.FullName(), pr.ID)
+				break ruleLoop
+			}
 			shouldMatch := !rule.Negative
 			matched, _ := rule.Rule.MatchString(f) // err only happens when timeouts, any error can be considered as not matched
 			if matched == shouldMatch {
diff --git a/services/wiki/wiki.go b/services/wiki/wiki.go
index abe846ae06..d1006abf7e 100644
--- a/services/wiki/wiki.go
+++ b/services/wiki/wiki.go
@@ -7,7 +7,6 @@ package wiki
 import (
 	"context"
 	"fmt"
-	"os"
 
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
@@ -21,6 +20,7 @@ import (
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/log"
 	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/util"
 	asymkey_service "gitea.dev/services/asymkey"
 	repo_service "gitea.dev/services/repository"
 )
@@ -304,7 +304,7 @@ func DeleteWikiPage(ctx context.Context, doer *user_model.User, repo *repo_model
 			return err
 		}
 	} else {
-		return os.ErrNotExist
+		return util.ErrNotExist
 	}
 
 	// FIXME: The wiki doesn't have lfs support at present - if this changes need to check attributes here
diff --git a/templates/devtest/repo-action-view.tmpl b/templates/devtest/repo-action-view.tmpl
index 4e06f72cdd..12da63a7e9 100644
--- a/templates/devtest/repo-action-view.tmpl
+++ b/templates/devtest/repo-action-view.tmpl
@@ -1,11 +1,11 @@
 {{template "base/head" .}}
 <div class="page-content">
 	<div class="flex-text-block tw-justify-center tw-gap-5">
-		<a href="/devtest/repo-action-view/runs/10">Run:CanCancel</a>
-		<a href="/devtest/repo-action-view/runs/20">Run:CanApprove</a>
-		<a href="/devtest/repo-action-view/runs/30">Run:CanRerunLatest</a>
-		<a href="/devtest/repo-action-view/runs/10/attempts/2">Run:PreviousAttempt</a>
-		<a href="/devtest/repo-action-view/runs/40">Run:ReusableCaller</a>
+		<a href="{{AppSubUrl}}/devtest/repo-action-view/runs/10">Run:CanCancel</a>
+		<a href="{{AppSubUrl}}/devtest/repo-action-view/runs/20">Run:CanApprove</a>
+		<a href="{{AppSubUrl}}/devtest/repo-action-view/runs/30">Run:CanRerunLatest</a>
+		<a href="{{AppSubUrl}}/devtest/repo-action-view/runs/10/attempts/2">Run:PreviousAttempt</a>
+		<a href="{{AppSubUrl}}/devtest/repo-action-view/runs/40">Run:ReusableCaller</a>
 	</div>
 	{{template "repo/actions/view_component" (dict
 		"JobID" (or .JobID 0)
diff --git a/tests/integration/api_user_org_perm_test.go b/tests/integration/api_user_org_perm_test.go
index d31abdfeb3..63d69fab71 100644
--- a/tests/integration/api_user_org_perm_test.go
+++ b/tests/integration/api_user_org_perm_test.go
@@ -151,9 +151,7 @@ func testUnknownOrganization(t *testing.T) {
 
 	req := NewRequest(t, "GET", "/api/v1/users/user1/orgs/unknown/permissions").
 		AddTokenAuth(token)
-	resp := MakeRequest(t, req, http.StatusNotFound)
-	apiError := DecodeJSON(t, resp, &api.APIError{})
-	assert.Equal(t, "GetUserByName", apiError.Message)
+	MakeRequest(t, req, http.StatusNotFound)
 }
 
 func testHiddenMemberPermissionsForbidden(t *testing.T) {
diff --git a/web_src/js/components/ActionRunJobView.vue b/web_src/js/components/ActionRunJobView.vue
index 835518ecb8..d150e5899b 100644
--- a/web_src/js/components/ActionRunJobView.vue
+++ b/web_src/js/components/ActionRunJobView.vue
@@ -2,7 +2,6 @@
 import {computed, nextTick, onBeforeUnmount, onMounted, ref, toRefs, watch} from 'vue';
 import {SvgIcon} from '../svg.ts';
 import ActionStatusIcon from './ActionStatusIcon.vue';
-import WorkflowGraph from './WorkflowGraph.vue';
 import {addDelegatedEventListener, createElementFromAttrs, toggleElem} from '../utils/dom.ts';
 import {formatDatetime, formatDatetimeISO} from '../utils/time.ts';
 import {POST} from '../modules/fetch.ts';
@@ -13,7 +12,6 @@ import {localUserSettings} from '../modules/user-settings.ts';
 import type {ActionsArtifact, ActionsJob, ActionsRun, ActionsStatus} from '../modules/gitea-actions.ts';
 import {
   type ActionRunViewStore,
-  collectCallerChildJobs,
   createLogLineMessage,
   type LogLine,
   type LogLineCommand,
@@ -118,14 +116,11 @@ const currentJob = ref<CurrentJob>({
 const stepsContainer = ref<HTMLElement | null>(null);
 const jobStepLogs = ref<Array<StepContainerElement | undefined>>([]);
 
-// Reusable workflow caller view: when the selected job is a caller node, the right pane
-// shows the children list rather than step logs (callers don't run on a runner).
+// Reusable workflow caller view: the right pane shows just the header (name + uses path +
+// status). Callers don't run on a runner, and the dependency graph for their children lives
+// in the run summary's WorkflowGraph, not here — matching GitHub Actions.
 const selectedJob = computed<ActionsJob | undefined>(() => (run.value.jobs || []).find((it) => it.id === props.jobId));
 const isCallerJob = computed(() => Boolean(selectedJob.value?.isReusableCaller));
-const callerChildJobs = computed<ActionsJob[]>(() => {
-  if (!isCallerJob.value) return [];
-  return collectCallerChildJobs(run.value.jobs || [], props.jobId);
-});
 
 watch(optionAlwaysAutoScroll, () => {
   saveLocaleStorageOptions();
@@ -477,20 +472,6 @@ async function hashChangeListener() {
       </div>
     </div>
   </div>
-  <!-- Caller (reusable workflow) view: render the direct children's dependency graph,
-       mirroring the run summary's WorkflowGraph but scoped to this caller's subtree.
-       The caller's name + uses path + status all live in job-info-header above. -->
-  <div class="caller-children-container" v-if="isCallerJob">
-    <WorkflowGraph
-      v-if="callerChildJobs.length > 0"
-      :store="store"
-      :jobs="callerChildJobs"
-      :run-link="run.link"
-      :workflow-id="`${run.workflowID}#caller-${props.jobId}`"
-      :locale="locale"
-    />
-  </div>
-
   <!-- always create the node because we have our own event listeners on it, don't use "v-if" -->
   <div class="job-step-container" ref="stepsContainer" v-show="!isCallerJob && currentJob.steps.length">
     <div class="job-step-section" v-for="(jobStep, stepIdx) in currentJob.steps" :key="stepIdx">
@@ -578,8 +559,7 @@ async function hashChangeListener() {
   border-radius: 3px;
 }
 
-.job-info-header:has(+ .job-step-container),
-.job-info-header:has(+ .caller-children-container) {
+.job-info-header:has(+ .job-step-container) {
   border-radius: var(--border-radius) var(--border-radius) 0 0;
 }
 
@@ -613,14 +593,6 @@ async function hashChangeListener() {
   min-width: 0;
 }
 
-.caller-children-container {
-  flex: 1;
-  display: flex;
-  flex-direction: column;
-  border-top: 1px solid var(--color-console-border);
-  color: var(--color-console-fg);
-}
-
 .job-step-container {
   max-height: 100%;
   border-radius: 0 0 var(--border-radius) var(--border-radius);
diff --git a/web_src/js/components/ActionRunView.ts b/web_src/js/components/ActionRunView.ts
index e9b929444f..0d6ae9a61b 100644
--- a/web_src/js/components/ActionRunView.ts
+++ b/web_src/js/components/ActionRunView.ts
@@ -104,12 +104,6 @@ export function buildJobsByParentJobID(jobs: ActionsJob[]): Map<number, ActionsJ
   return childrenByParent;
 }
 
-// collectCallerChildJobs returns the direct children of a caller job.
-export function collectCallerChildJobs(jobs: ActionsJob[], callerJobID: number): ActionsJob[] {
-  if (!callerJobID) return [];
-  return buildJobsByParentJobID(jobs).get(callerJobID) || [];
-}
-
 export function createEmptyActionsRun(): ActionsRun {
   return {
     repoId: 0,
diff --git a/web_src/js/components/RepoActionView.vue b/web_src/js/components/RepoActionView.vue
index dc24a74f6b..a96e7bc09d 100644
--- a/web_src/js/components/RepoActionView.vue
+++ b/web_src/js/components/RepoActionView.vue
@@ -26,7 +26,6 @@ const {currentRun: run, runArtifacts: artifacts} = toRefs(store.viewData);
 type JobListItem = {
   job: ActionsJob;
   depth: number;
-  hasChildren: boolean;
 };
 
 // Caller jobs default to collapsed. Membership in this set means "user has manually expanded this caller"
@@ -71,9 +70,8 @@ const visibleJobListItems = computed<JobListItem[]>(() => {
   while (stack.length > 0) {
     const {job, depth} = stack.pop()!;
     const children = childrenByParent.get(job.id) || [];
-    const hasChildren = children.length > 0;
-    result.push({job, depth, hasChildren});
-    if (hasChildren && isJobCollapsed(job.id)) continue;
+    result.push({job, depth});
+    if (children.length > 0 && isJobCollapsed(job.id)) continue;
     for (let i = children.length - 1; i >= 0; i--) stack.push({job: children[i], depth: depth + 1});
   }
   return result;
@@ -216,24 +214,28 @@ async function deleteArtifact(name: string) {
             v-for="item in visibleJobListItems"
             :key="item.job.id"
           >
-            <a class="tw-contents silenced" :href="item.job.link">
-              <ActionStatusIcon :locale-status="locale.status[item.job.status]" :status="item.job.status" icon-variant="circle-fill"/>
-              <span class="tw-min-w-0 gt-ellipsis">{{ item.job.name }}</span>
-              <SvgIcon name="octicon-sync" role="button" :data-tooltip-content="locale.rerun" class="job-rerun-button tw-cursor-pointer link-action interact-fg" :data-url="`${run.link}/jobs/${item.job.id}/rerun`" v-if="item.job.canRerun"/>
-              <span class="job-duration">{{ item.job.duration }}</span>
-            </a>
+            <!-- Callers have no log page of their own; the whole row toggles expansion
+                 (matches GitHub Actions, where caller rows are not navigation targets). -->
             <button
-              v-if="item.hasChildren"
+              v-if="item.job.isReusableCaller"
               type="button"
-              class="job-brief-toggle"
-              :class="{'collapsed': isJobCollapsed(item.job.id)}"
+              class="tw-contents caller-row-toggle"
               @click="toggleExpandedJob(item.job.id)"
               :title="isJobCollapsed(item.job.id) ? locale.expandCallerJobs : locale.collapseCallerJobs"
               :aria-label="isJobCollapsed(item.job.id) ? locale.expandCallerJobs : locale.collapseCallerJobs"
               :aria-expanded="!isJobCollapsed(item.job.id)"
             >
-              <SvgIcon name="octicon-chevron-down" :size="14"/>
+              <ActionStatusIcon :locale-status="locale.status[item.job.status]" :status="item.job.status" icon-variant="circle-fill"/>
+              <span class="tw-min-w-0 gt-ellipsis">{{ item.job.name }}</span>
+              <span class="job-duration">{{ item.job.duration }}</span>
+              <SvgIcon name="octicon-chevron-down" :size="14" class="job-brief-toggle-icon" :class="{'collapsed': isJobCollapsed(item.job.id)}"/>
             </button>
+            <a v-else class="tw-contents silenced" :href="item.job.link">
+              <ActionStatusIcon :locale-status="locale.status[item.job.status]" :status="item.job.status" icon-variant="circle-fill"/>
+              <span class="tw-min-w-0 gt-ellipsis">{{ item.job.name }}</span>
+              <SvgIcon name="octicon-sync" role="button" :data-tooltip-content="locale.rerun" class="job-rerun-button tw-cursor-pointer link-action interact-fg" :data-url="`${run.link}/jobs/${item.job.id}/rerun`" v-if="item.job.canRerun"/>
+              <span class="job-duration">{{ item.job.duration }}</span>
+            </a>
           </div>
         </div>
 
@@ -258,7 +260,7 @@ async function deleteArtifact(name: string) {
                   <SvgIcon name="octicon-trash"/>
                 </a>
               </template>
-              <span v-else class="flex-text-block tw-flex-1 tw-text-text-light-2">
+              <span v-else class="flex-text-block tw-flex-1 tw-min-w-0 tw-text-text-light-2">
                 <SvgIcon name="octicon-file-removed"/>
                 <span class="tw-flex-1 gt-ellipsis">{{ artifact.name }}</span>
                 <span class="ui label tw-flex-shrink-0">{{ locale.artifactExpired }}</span>
@@ -406,23 +408,23 @@ async function deleteArtifact(name: string) {
   background-color: var(--color-active);
 }
 
-.job-brief-toggle {
+.caller-row-toggle {
   border: none;
   padding: 0;
   background: transparent;
-  cursor: pointer;
   color: inherit;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
+  cursor: pointer;
+  text-align: inherit;
+}
+
+.job-brief-toggle-icon {
   flex-shrink: 0;
-  /* the icon is always chevron-down; flip to chevron-up when expanded */
   transition: transform 0.15s ease;
-  /* sit right after the job name; rerun/duration float to the right via auto-margin */
+  /* sit between name and duration; duration uses order:2 with margin-left:auto to float right */
   order: 1;
 }
 
-.job-brief-toggle:not(.collapsed) {
+.job-brief-toggle-icon:not(.collapsed) {
   transform: rotate(180deg);
 }
 
diff --git a/web_src/js/components/WorkflowGraph.utils.test.ts b/web_src/js/components/WorkflowGraph.utils.test.ts
new file mode 100644
index 0000000000..9d79766d83
--- /dev/null
+++ b/web_src/js/components/WorkflowGraph.utils.test.ts
@@ -0,0 +1,197 @@
+import {computeGraphHighlightState, computeJobLevels, createWorkflowGraphModel, matrixKeyFromJobName} from './WorkflowGraph.utils.ts';
+import type {ActionsJob} from '../modules/gitea-actions.ts';
+
+const mockJobs: ActionsJob[] = [
+  {id: 1, link: '', jobId: 'job-100', name: 'job-100', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s'},
+  {id: 2, link: '', jobId: 'job-101', name: 'job-101', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['job-100']},
+  {id: 3, link: '', jobId: 'job-102', name: 'job-102', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['job-101']},
+  {id: 4, link: '', jobId: 'job-103', name: 'job-103', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['job-100']},
+  {id: 5, link: '', jobId: 'prep-jdk', name: 'prep-jdk', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s'},
+  {id: 6, link: '', jobId: 'code-analysis', name: 'code-analysis', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s'},
+  {id: 7, link: '', jobId: 'matrix-e2e-1-chromium', name: 'matrix-e2e (1, chromium)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['job-100', 'prep-jdk', 'code-analysis']},
+  {id: 8, link: '', jobId: 'matrix-e2e-1-firefox', name: 'matrix-e2e (1, firefox)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['job-100', 'prep-jdk', 'code-analysis']},
+  {id: 9, link: '', jobId: 'matrix-e2e-2-chromium', name: 'matrix-e2e (2, chromium)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['job-100', 'prep-jdk', 'code-analysis']},
+  {id: 10, link: '', jobId: 'matrix-e2e-3-chromium', name: 'matrix-e2e (3, chromium)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['job-100', 'prep-jdk', 'code-analysis']},
+  {id: 11, link: '', jobId: 'matrix-e2e-3-firefox', name: 'matrix-e2e (3, firefox)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['job-100', 'prep-jdk', 'code-analysis']},
+  {id: 12, link: '', jobId: 'matrix-e2e-99-webkit', name: 'matrix-e2e (99, webkit)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['job-100', 'prep-jdk', 'code-analysis']},
+  {id: 13, link: '', jobId: 'unit-test', name: 'unit-test', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['prep-jdk', 'code-analysis']},
+  {id: 14, link: '', jobId: 'arch-test', name: 'arch-test', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['prep-jdk', 'code-analysis']},
+  {id: 15, link: '', jobId: 'integration-test', name: 'integration-test', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['prep-jdk', 'code-analysis']},
+  {id: 16, link: '', jobId: 'build-image', name: 'build-image', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: [
+    'unit-test',
+    'arch-test',
+    'integration-test',
+    'matrix-e2e-1-chromium',
+    'matrix-e2e-1-firefox',
+    'matrix-e2e-2-chromium',
+    'matrix-e2e-3-chromium',
+    'matrix-e2e-3-firefox',
+    'matrix-e2e-99-webkit',
+  ]},
+];
+
+const verifyDeployJobs: ActionsJob[] = [
+  {id: 101, link: '', jobId: 'seed-dev', name: 'seed-dev', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s'},
+  {id: 102, link: '', jobId: 'seed-qa', name: 'seed-qa', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s'},
+  {id: 103, link: '', jobId: 'verify-dev', name: 'Verify Dev', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['seed-dev']},
+  {id: 104, link: '', jobId: 'verify-qa', name: 'Verify QA', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['seed-qa']},
+  {id: 105, link: '', jobId: 'deploy', name: 'Deploy', status: 'blocked', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '', needs: ['verify-dev', 'verify-qa']},
+];
+
+// Multi-level pipeline with two matrices and a leaf with two parents.
+const wfTest1Jobs: ActionsJob[] = [
+  {id: 1, link: '', jobId: 'init', name: 'Initialize Pipeline', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '1s'},
+  {id: 2, link: '', jobId: 'lint-frontend', name: 'Lint Frontend', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['init']},
+  {id: 3, link: '', jobId: 'lint-backend', name: 'Lint Backend', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['init']},
+  {id: 4, link: '', jobId: 'build-frontend', name: 'Build Frontend', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['lint-frontend']},
+  {id: 5, link: '', jobId: 'build-backend', name: 'Build Backend', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '5s', needs: ['lint-backend']},
+  {id: 6, link: '', jobId: 'tu-api-t', name: 'Unit Tests (api, true)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['build-frontend', 'build-backend']},
+  {id: 7, link: '', jobId: 'tu-api-f', name: 'Unit Tests (api, false)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['build-frontend', 'build-backend']},
+  {id: 8, link: '', jobId: 'tu-svc-t', name: 'Unit Tests (service, true)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['build-frontend', 'build-backend']},
+  {id: 9, link: '', jobId: 'test-integration', name: 'Integration Tests', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '6s', needs: ['build-backend']},
+  {id: 10, link: '', jobId: 'te-c-d', name: 'E2E Tests (chrome, desktop)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['build-frontend', 'tu-api-t', 'tu-api-f', 'tu-svc-t']},
+  {id: 11, link: '', jobId: 'te-c-m', name: 'E2E Tests (chrome, mobile)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['build-frontend', 'tu-api-t', 'tu-api-f', 'tu-svc-t']},
+  {id: 12, link: '', jobId: 'te-f-d', name: 'E2E Tests (firefox, desktop)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '4s', needs: ['build-frontend', 'tu-api-t', 'tu-api-f', 'tu-svc-t']},
+  {id: 13, link: '', jobId: 'bundle-app', name: 'Bundle Application', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['tu-api-t', 'tu-api-f', 'tu-svc-t', 'test-integration', 'te-c-d', 'te-c-m', 'te-f-d']},
+  {id: 14, link: '', jobId: 'deploy-dev', name: 'Deploy to Dev', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['bundle-app']},
+  {id: 15, link: '', jobId: 'deploy-qa', name: 'Deploy to QA', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '3s', needs: ['bundle-app']},
+  {id: 16, link: '', jobId: 'verify-dev', name: 'Verify Dev', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['deploy-dev']},
+  {id: 17, link: '', jobId: 'verify-qa', name: 'Verify QA', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['deploy-qa']},
+  {id: 18, link: '', jobId: 'deploy-prod', name: 'Deploy to Production', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '5s', needs: ['verify-dev', 'verify-qa']},
+  {id: 19, link: '', jobId: 'post-deploy-checks', name: 'Post-Deploy Checks', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '2s', needs: ['deploy-prod']},
+];
+
+test('matrix key heuristic strips trailing parameter list', () => {
+  expect(matrixKeyFromJobName('matrix-e2e (1, chromium)')).toBe('matrix-e2e');
+  expect(matrixKeyFromJobName('plain-job')).toBeNull();
+});
+
+test('computeJobLevels keeps stable topological levels', () => {
+  const levels = computeJobLevels(mockJobs);
+  expect(levels.get('job-100')).toBe(0);
+  expect(levels.get('job-101')).toBe(1);
+  expect(levels.get('job-102')).toBe(2);
+  expect(levels.get('build-image')).toBe(2);
+});
+
+test('graph model collapses matrix and groups jobs that share parents and children', () => {
+  const graph = createWorkflowGraphModel(mockJobs);
+
+  expect(graph.nodes.find((n) => n.type === 'matrix')?.jobs).toHaveLength(6);
+  const groupJobIds = graph.nodes.filter((n) => n.type === 'group').map((g) => g.jobs.map((j) => j.jobId));
+  expect(groupJobIds).toEqual(expect.arrayContaining([
+    ['prep-jdk', 'code-analysis'],
+    ['unit-test', 'arch-test', 'integration-test'],
+  ]));
+});
+
+test('expanded matrix height includes summary and toggle rows', () => {
+  const collapsed = createWorkflowGraphModel(mockJobs);
+  const expanded = createWorkflowGraphModel(mockJobs, new Set(['matrix-e2e']));
+  const collapsedMatrix = collapsed.nodes.find((n) => n.id === 'matrix:matrix-e2e');
+  const expandedMatrix = expanded.nodes.find((n) => n.id === 'matrix:matrix-e2e');
+
+  expect(collapsedMatrix?.displayHeight).toBeLessThan(expandedMatrix?.displayHeight ?? 0);
+  // 6 jobs * 26 row height + 24 header + 6 pad * 2 = 192
+  expect(expandedMatrix?.displayHeight).toBe(192);
+});
+
+test('every dependency is rendered as one routed edge', () => {
+  const graph = createWorkflowGraphModel(mockJobs);
+  const rootGroup = graph.nodes.find((n) => n.type === 'group' && n.jobs.some((j) => j.jobId === 'prep-jdk'))!;
+  const testGroup = graph.nodes.find((n) => n.type === 'group' && n.jobs.some((j) => j.jobId === 'unit-test'))!;
+  const expectedKeys = [
+    `${rootGroup.id}->matrix:matrix-e2e`,
+    `${rootGroup.id}->${testGroup.id}`,
+  ];
+  const keys = new Set(graph.routedEdges.map((e) => e.key));
+  for (const k of expectedKeys) expect(keys.has(k)).toBe(true);
+});
+
+test('same-row edge collapses to a single horizontal line', () => {
+  const graph = createWorkflowGraphModel(verifyDeployJobs);
+  const verifyDevEdge = graph.routedEdges.find((e) => e.fromId === 'job:101' && e.toId === 'job:103');
+  const verifyQaEdge = graph.routedEdges.find((e) => e.fromId === 'job:102' && e.toId === 'job:104');
+  expect(verifyDevEdge?.path).toMatch(/^M [\d.]+ [\d.]+ H [\d.]+$/);
+  expect(verifyQaEdge?.path).toMatch(/^M [\d.]+ [\d.]+ H [\d.]+$/);
+});
+
+test('different-row edge uses cubic bezier curve', () => {
+  const graph = createWorkflowGraphModel(verifyDeployJobs);
+  const deployLowerEdge = graph.routedEdges.find((e) => e.fromId === 'job:104' && e.toId === 'job:105');
+  expect(deployLowerEdge?.path).toContain(' C ');
+});
+
+test('multi-level pipeline with two matrices and a converging leaf renders without errors', () => {
+  const graph = createWorkflowGraphModel(wfTest1Jobs);
+  const matrices = graph.nodes.filter((n) => n.type === 'matrix');
+  expect(matrices.map((n) => n.matrixKey).sort()).toEqual(['E2E Tests', 'Unit Tests']);
+
+  const deployProd = graph.nodes.find((n) => n.id === 'job:18');
+  const verifyDev = graph.nodes.find((n) => n.id === 'job:16');
+  const verifyQa = graph.nodes.find((n) => n.id === 'job:17');
+  expect(verifyDev?.level).toBe(verifyQa?.level);
+  expect(deployProd?.level).toBe((verifyDev?.level ?? 0) + 1);
+
+  for (const node of graph.nodes) {
+    expect(Number.isFinite(node.x)).toBe(true);
+    expect(Number.isFinite(node.y)).toBe(true);
+    expect(node.x).toBeGreaterThanOrEqual(0);
+    expect(node.y).toBeGreaterThanOrEqual(0);
+  }
+  for (const edge of graph.routedEdges) {
+    expect(edge.path).not.toMatch(/NaN|undefined|Infinity/);
+  }
+});
+
+test('reusable callers with identical dependency signature are kept as separate nodes', () => {
+  const jobs: ActionsJob[] = [
+    {id: 1, link: '', jobId: 'prepare', name: 'prepare', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '30s'},
+    {id: 2, link: '', jobId: 'local_caller', name: 'local caller', status: 'running', canRerun: false, isReusableCaller: true, parentJobID: 0, duration: '5m', needs: ['prepare'], callUses: './.gitea/workflows/lib.yml'},
+    {id: 3, link: '', jobId: 'cross_caller', name: 'cross-repo caller', status: 'waiting', canRerun: false, isReusableCaller: true, parentJobID: 0, duration: '0s', needs: ['prepare'], callUses: 'user2/lib/.gitea/workflows/ext.yml@main'},
+    {id: 4, link: '', jobId: 'final', name: 'final', status: 'blocked', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '0s', needs: ['local_caller', 'cross_caller']},
+  ];
+  const graph = createWorkflowGraphModel(jobs);
+  expect(graph.nodes.find((n) => n.type === 'group')).toBeUndefined();
+  expect(graph.nodes.find((n) => n.id === 'job:2')?.name).toBe('local caller');
+  expect(graph.nodes.find((n) => n.id === 'job:3')?.name).toBe('cross-repo caller');
+});
+
+test('reusable caller with matrix-pattern name does not get absorbed into a sibling matrix node', () => {
+  const jobs: ActionsJob[] = [
+    {id: 1, link: '', jobId: 'deploy_dev', name: 'deploy (dev)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '1s'},
+    {id: 2, link: '', jobId: 'deploy_qa', name: 'deploy (qa)', status: 'success', canRerun: false, isReusableCaller: false, parentJobID: 0, duration: '1s'},
+    {id: 3, link: '', jobId: 'deploy_staging', name: 'deploy (staging)', status: 'running', canRerun: false, isReusableCaller: true, parentJobID: 0, duration: '2s', callUses: './.gitea/workflows/deploy.yml'},
+  ];
+  const graph = createWorkflowGraphModel(jobs);
+  expect(graph.nodes.find((n) => n.id === 'job:3')?.name).toBe('deploy (staging)');
+  const matrixNode = graph.nodes.find((n) => n.type === 'matrix');
+  expect(matrixNode?.jobs.map((j) => j.id).sort()).toEqual([1, 2]);
+});
+
+test('directed highlight state covers ancestors and descendants of the hovered node', () => {
+  const graph = createWorkflowGraphModel(mockJobs);
+  const rootGroup = graph.nodes.find((n) => n.type === 'group' && n.jobs.some((j) => j.jobId === 'prep-jdk'))!;
+
+  const highlight = computeGraphHighlightState(rootGroup.id, graph.adjacency);
+  expect(highlight.nodeIds.has('matrix:matrix-e2e')).toBe(true);
+  expect(highlight.nodeIds.has('job:16')).toBe(true);
+  expect(highlight.edgeKeys.has(`${rootGroup.id}->matrix:matrix-e2e`)).toBe(true);
+});
+
+test('directed highlight state for converging graph excludes sibling branch when hovering parent', () => {
+  const graph = createWorkflowGraphModel(verifyDeployJobs);
+
+  const parentHighlight = computeGraphHighlightState('job:103', graph.adjacency);
+  expect(parentHighlight.nodeIds.has('job:101')).toBe(true);
+  expect(parentHighlight.nodeIds.has('job:105')).toBe(true);
+  expect(parentHighlight.nodeIds.has('job:104')).toBe(false);
+  expect(parentHighlight.edgeKeys.has('job:103->job:105')).toBe(true);
+  expect(parentHighlight.edgeKeys.has('job:104->job:105')).toBe(false);
+
+  const sinkHighlight = computeGraphHighlightState('job:105', graph.adjacency);
+  expect(sinkHighlight.nodeIds.has('job:103')).toBe(true);
+  expect(sinkHighlight.nodeIds.has('job:104')).toBe(true);
+  expect(sinkHighlight.edgeKeys.has('job:103->job:105')).toBe(true);
+  expect(sinkHighlight.edgeKeys.has('job:104->job:105')).toBe(true);
+});
diff --git a/web_src/js/components/WorkflowGraph.utils.ts b/web_src/js/components/WorkflowGraph.utils.ts
new file mode 100644
index 0000000000..71ef7e6fc9
--- /dev/null
+++ b/web_src/js/components/WorkflowGraph.utils.ts
@@ -0,0 +1,559 @@
+import type {ActionsJob, ActionsStatus} from '../modules/gitea-actions.ts';
+
+export type GraphNodeType = 'job' | 'matrix' | 'group';
+
+export type GraphNode = {
+  id: string;
+  type: GraphNodeType;
+  name: string;
+  status: ActionsStatus;
+  duration: string;
+  x: number;
+  y: number;
+  level: number;
+  displayHeight: number;
+  jobs: ActionsJob[];
+  matrixKey?: string;
+};
+
+export type Edge = {
+  fromId: string;
+  toId: string;
+  key: string;
+};
+
+export type RoutedEdge = Edge & {
+  path: string;
+  fromNode: GraphNode;
+  toNode: GraphNode;
+};
+
+export type SharedSegment = {
+  key: string;
+  edgeKeys: string[];
+  path: string;
+};
+
+export type GraphHighlightState = {
+  nodeIds: Set<string>;
+  edgeKeys: Set<string>;
+};
+
+export type WorkflowGraphLayoutOptions = {
+  margin: number;
+  nodeWidth: number;
+  nodeHeight: number;
+  columnGap: number;
+  laneGap: number;
+  groupRowHeight: number;
+  groupPadY: number;
+  matrixCollapsedHeight: number;
+  matrixHeaderHeight: number;
+  matrixRowHeight: number;
+  matrixPadY: number;
+};
+
+export type WorkflowGraphModel = {
+  nodes: GraphNode[];
+  edges: Edge[];
+  routedEdges: RoutedEdge[];
+  sharedSegments: SharedSegment[];
+  adjacency: NodeAdjacency;
+};
+
+export type NodeAdjacency = {
+  incomingByNodeId: Map<string, string[]>;
+  outgoingByNodeId: Map<string, string[]>;
+};
+
+const defaultLayoutOptions: WorkflowGraphLayoutOptions = {
+  margin: 24,
+  nodeWidth: 220,
+  nodeHeight: 40,
+  columnGap: 96,
+  laneGap: 32,
+  groupRowHeight: 28,
+  groupPadY: 8,
+  matrixCollapsedHeight: 78,
+  matrixHeaderHeight: 24,
+  matrixRowHeight: 26,
+  matrixPadY: 6,
+};
+
+function canonicalKey(ids: Iterable<string>): string {
+  return Array.from(ids).sort().join('
');
+}
+
+function graphIdForJob(job: ActionsJob): string {
+  return `job:${job.id}`;
+}
+
+export function matrixKeyFromJobName(name: string): string | null {
+  const idx = name.indexOf(' (');
+  if (idx === -1) return null;
+  return name.slice(0, idx).trim() || null;
+}
+
+export function boxBottom(node: GraphNode): number {
+  return node.y + node.displayHeight;
+}
+
+export function boxCenterY(node: GraphNode): number {
+  return node.y + node.displayHeight / 2;
+}
+
+function matrixPanelHeight(rowCount: number, expanded: boolean, options: WorkflowGraphLayoutOptions): number {
+  if (rowCount <= 0) return options.nodeHeight;
+  if (!expanded) return options.matrixCollapsedHeight;
+  return options.matrixHeaderHeight + rowCount * options.matrixRowHeight + options.matrixPadY * 2;
+}
+
+function groupPanelHeight(rowCount: number, options: WorkflowGraphLayoutOptions): number {
+  return rowCount * options.groupRowHeight + options.groupPadY * 2;
+}
+
+function compareStatusWorstFirst(a: ActionsStatus, b: ActionsStatus): number {
+  const rank = (s: ActionsStatus) => {
+    if (s === 'failure') return 0;
+    if (s === 'cancelled') return 1;
+    if (s === 'running') return 2;
+    if (s === 'waiting') return 3;
+    if (s === 'blocked') return 4;
+    if (s === 'success') return 5;
+    if (s === 'skipped') return 6;
+    return 7;
+  };
+  return rank(a) - rank(b);
+}
+
+function aggregateStatus(children: ActionsJob[]): ActionsStatus {
+  return children.map((c) => c.status).slice().sort(compareStatusWorstFirst)[0] ?? 'unknown';
+}
+
+function buildDirectNeedsMap(jobs: ActionsJob[]): Map<string, string[]> {
+  const directNeedsByJobId = new Map<string, string[]>();
+  const dependentsByJobId = new Map<string, Set<string>>();
+
+  for (const job of jobs) {
+    const needs = job.needs || [];
+    directNeedsByJobId.set(job.jobId, needs);
+    for (const need of needs) {
+      if (!dependentsByJobId.has(need)) dependentsByJobId.set(need, new Set());
+      dependentsByJobId.get(need)!.add(job.jobId);
+    }
+  }
+
+  const reachabilityCache = new Map<string, boolean>();
+  function canReach(fromJobId: string, toJobId: string): boolean {
+    const cacheKey = `${fromJobId}->${toJobId}`;
+    if (reachabilityCache.has(cacheKey)) return reachabilityCache.get(cacheKey)!;
+    const visited = new Set<string>();
+    const stack = Array.from(dependentsByJobId.get(fromJobId) || []);
+    while (stack.length > 0) {
+      const current = stack.pop()!;
+      if (current === toJobId) {
+        reachabilityCache.set(cacheKey, true);
+        return true;
+      }
+      if (visited.has(current)) continue;
+      visited.add(current);
+      stack.push(...(dependentsByJobId.get(current) || []));
+    }
+    reachabilityCache.set(cacheKey, false);
+    return false;
+  }
+
+  const reducedNeedsByJobId = new Map<string, string[]>();
+  for (const [jobId, needs] of directNeedsByJobId) {
+    reducedNeedsByJobId.set(jobId, needs.filter((need) => {
+      return !needs.some((other) => other !== need && canReach(need, other));
+    }));
+  }
+  return reducedNeedsByJobId;
+}
+
+export function computeJobLevels(jobs: ActionsJob[]): Map<string, number> {
+  const jobMap = new Map<string, ActionsJob>();
+  for (const job of jobs) {
+    jobMap.set(job.name, job);
+    if (job.jobId) jobMap.set(job.jobId, job);
+  }
+
+  const levels = new Map<string, number>();
+  const visited = new Set<string>();
+  const recursionStack = new Set<string>();
+
+  function dfs(jobNameOrId: string): number {
+    if (recursionStack.has(jobNameOrId)) return 0;
+    if (visited.has(jobNameOrId)) return levels.get(jobNameOrId) ?? 0;
+    recursionStack.add(jobNameOrId);
+    visited.add(jobNameOrId);
+
+    const job = jobMap.get(jobNameOrId);
+    if (!job) {
+      recursionStack.delete(jobNameOrId);
+      return 0;
+    }
+    if (!job.needs?.length) {
+      levels.set(job.jobId, 0);
+      if (job.jobId !== job.name) levels.set(job.name, 0);
+      recursionStack.delete(jobNameOrId);
+      return 0;
+    }
+
+    let maxLevel = -1;
+    for (const need of job.needs) {
+      if (!jobMap.has(need)) continue;
+      maxLevel = Math.max(maxLevel, dfs(need));
+    }
+    const level = maxLevel + 1;
+    levels.set(job.name, level);
+    levels.set(job.jobId, level);
+    recursionStack.delete(jobNameOrId);
+    return level;
+  }
+
+  for (const job of jobs) {
+    if (!visited.has(job.jobId)) dfs(job.jobId);
+  }
+  return levels;
+}
+
+export function computeGraphHighlightState(hoveredId: string | null, adjacency: NodeAdjacency): GraphHighlightState {
+  if (!hoveredId) return {nodeIds: new Set(), edgeKeys: new Set()};
+  const {incomingByNodeId, outgoingByNodeId} = adjacency;
+
+  const edgeKeys = new Set<string>();
+  const collect = (startId: string, adj: Map<string, string[]>, edgeKeyForward: boolean): Set<string> => {
+    const seen = new Set<string>();
+    const queue = [startId];
+    while (queue.length > 0) {
+      const current = queue.shift()!;
+      if (seen.has(current)) continue;
+      seen.add(current);
+      for (const next of adj.get(current) || []) {
+        edgeKeys.add(edgeKeyForward ? `${current}->${next}` : `${next}->${current}`);
+        if (!seen.has(next)) queue.push(next);
+      }
+    }
+    return seen;
+  };
+
+  const ancestors = collect(hoveredId, incomingByNodeId, false);
+  const descendants = collect(hoveredId, outgoingByNodeId, true);
+  return {nodeIds: new Set([...ancestors, ...descendants]), edgeKeys};
+}
+
+type VisualGraphBuild = {
+  nodes: GraphNode[];
+  edges: Edge[];
+};
+
+function buildVisualGraph(
+  jobs: ActionsJob[],
+  expandedMatrixKeys: ReadonlySet<string>,
+  options: WorkflowGraphLayoutOptions,
+): VisualGraphBuild {
+  const jobsByJobId = new Map<string, ActionsJob[]>();
+  const jobIndexById = new Map<number, number>();
+  for (const [index, job] of jobs.entries()) {
+    jobIndexById.set(job.id, index);
+    if (!jobsByJobId.has(job.jobId)) jobsByJobId.set(job.jobId, []);
+    jobsByJobId.get(job.jobId)!.push(job);
+  }
+
+  const matrixJobsByKey = new Map<string, ActionsJob[]>();
+  for (const job of jobs) {
+    // Reusable callers are distinct workflow files — never fold them into a matrix bucket
+    // even if their display name happens to look like "name (variant)".
+    if (job.isReusableCaller) continue;
+    const matrixKey = matrixKeyFromJobName(job.name);
+    if (!matrixKey) continue;
+    if (!matrixJobsByKey.has(matrixKey)) matrixJobsByKey.set(matrixKey, []);
+    matrixJobsByKey.get(matrixKey)!.push(job);
+  }
+  for (const list of matrixJobsByKey.values()) {
+    list.sort((a, b) => (jobIndexById.get(a.id) ?? 0) - (jobIndexById.get(b.id) ?? 0));
+  }
+
+  const directNeedsByJobId = buildDirectNeedsMap(jobs);
+  const rawLevels = computeJobLevels(jobs);
+  const dependentsByJobId = new Map<string, string[]>();
+  const rawEdges: Array<{from: ActionsJob; to: ActionsJob}> = [];
+
+  for (const job of jobs) {
+    for (const need of directNeedsByJobId.get(job.jobId) || []) {
+      for (const upstream of jobsByJobId.get(need) || []) {
+        rawEdges.push({from: upstream, to: job});
+        if (!dependentsByJobId.has(upstream.jobId)) dependentsByJobId.set(upstream.jobId, []);
+        dependentsByJobId.get(upstream.jobId)!.push(job.jobId);
+      }
+    }
+  }
+  for (const list of dependentsByJobId.values()) list.sort();
+
+  // Group sibling jobs that share an identical (parents, children) signature into a single
+  // collapsed "group" node. This is a visual aggregation only - the underlying jobs are
+  // preserved on the node so the panel can list them.
+  const groupedJobIds = new Map<number, string>();
+  const groupsById = new Map<string, ActionsJob[]>();
+  const groupCandidateBuckets = new Map<string, ActionsJob[]>();
+  for (const job of jobs) {
+    if (matrixKeyFromJobName(job.name)) continue;
+    // Reusable callers represent distinct workflow files — keep each as its own node so the
+    // graph mirrors GitHub Actions, where every caller shows up as its own box even when
+    // siblings share an identical (parents, children) dependency signature.
+    if (job.isReusableCaller) continue;
+    const needsKey = canonicalKey(directNeedsByJobId.get(job.jobId) || []);
+    const childrenKey = (dependentsByJobId.get(job.jobId) || []).join('
');
+    if (!needsKey && !childrenKey) continue;
+    const level = rawLevels.get(job.jobId) ?? 0;
+    const key = `group:${level}:${needsKey}:${childrenKey}`;
+    if (!groupCandidateBuckets.has(key)) groupCandidateBuckets.set(key, []);
+    groupCandidateBuckets.get(key)!.push(job);
+  }
+  for (const [groupId, groupJobs] of groupCandidateBuckets) {
+    if (groupJobs.length < 2) continue;
+    groupJobs.sort((a, b) => (jobIndexById.get(a.id) ?? 0) - (jobIndexById.get(b.id) ?? 0));
+    groupsById.set(groupId, groupJobs);
+    for (const job of groupJobs) groupedJobIds.set(job.id, groupId);
+  }
+
+  const visualIdByJobId = new Map<number, string>();
+  for (const job of jobs) {
+    const matrixKey = matrixKeyFromJobName(job.name);
+    // Symmetric with the matrix-bucket loop above: a reusable caller whose display name
+    // happens to look like "name (variant)" must never be folded into the matrix node, or it
+    // would silently vanish (its visualId would point at a matrix node it isn't part of).
+    if (matrixKey && !job.isReusableCaller && (matrixJobsByKey.get(matrixKey)?.length ?? 0) > 1) {
+      visualIdByJobId.set(job.id, `matrix:${matrixKey}`);
+      continue;
+    }
+    visualIdByJobId.set(job.id, groupedJobIds.get(job.id) || graphIdForJob(job));
+  }
+
+  const emittedNodeIds = new Set<string>();
+  const nodes: GraphNode[] = [];
+  for (const job of jobs) {
+    const visualId = visualIdByJobId.get(job.id);
+    if (!visualId || emittedNodeIds.has(visualId)) continue;
+    emittedNodeIds.add(visualId);
+
+    const matrixKey = matrixKeyFromJobName(job.name);
+    if (matrixKey && visualId.startsWith('matrix:')) {
+      const matrixJobs = matrixJobsByKey.get(matrixKey) || [];
+      nodes.push({
+        id: visualId,
+        type: 'matrix',
+        name: matrixKey,
+        status: aggregateStatus(matrixJobs),
+        duration: '',
+        x: 0, y: 0, level: 0,
+        displayHeight: matrixPanelHeight(matrixJobs.length, expandedMatrixKeys.has(matrixKey), options),
+        jobs: matrixJobs,
+        matrixKey,
+      });
+      continue;
+    }
+
+    const groupJobs = groupsById.get(visualId);
+    if (groupJobs) {
+      nodes.push({
+        id: visualId,
+        type: 'group',
+        name: groupJobs.map((g) => g.name).join(', '),
+        status: aggregateStatus(groupJobs),
+        duration: '',
+        x: 0, y: 0, level: 0,
+        displayHeight: groupPanelHeight(groupJobs.length, options),
+        jobs: groupJobs,
+      });
+      continue;
+    }
+
+    nodes.push({
+      id: visualId,
+      type: 'job',
+      name: job.name,
+      status: job.status,
+      duration: job.duration,
+      x: 0, y: 0, level: 0,
+      displayHeight: options.nodeHeight,
+      jobs: [job],
+    });
+  }
+
+  const seenEdges = new Set<string>();
+  const edges: Edge[] = [];
+  for (const {from, to} of rawEdges) {
+    const fromId = visualIdByJobId.get(from.id);
+    const toId = visualIdByJobId.get(to.id);
+    if (!fromId || !toId || fromId === toId) continue;
+    const key = `${fromId}->${toId}`;
+    if (seenEdges.has(key)) continue;
+    seenEdges.add(key);
+    edges.push({fromId, toId, key});
+  }
+
+  return {nodes, edges};
+}
+
+function buildNodeAdjacency(edges: Edge[]): NodeAdjacency {
+  const incomingByNodeId = new Map<string, string[]>();
+  const outgoingByNodeId = new Map<string, string[]>();
+  for (const edge of edges) {
+    if (!incomingByNodeId.has(edge.toId)) incomingByNodeId.set(edge.toId, []);
+    incomingByNodeId.get(edge.toId)!.push(edge.fromId);
+    if (!outgoingByNodeId.has(edge.fromId)) outgoingByNodeId.set(edge.fromId, []);
+    outgoingByNodeId.get(edge.fromId)!.push(edge.toId);
+  }
+  return {incomingByNodeId, outgoingByNodeId};
+}
+
+function assignNodeLevels(nodes: GraphNode[], {incomingByNodeId}: NodeAdjacency): void {
+  const cache = new Map<string, number>();
+  function levelFor(id: string, visiting = new Set<string>()): number {
+    if (cache.has(id)) return cache.get(id)!;
+    if (visiting.has(id)) return 0;
+    visiting.add(id);
+    const incoming = incomingByNodeId.get(id) || [];
+    const level = incoming.length > 0 ?
+      Math.max(...incoming.map((fromId) => levelFor(fromId, visiting))) + 1 :
+      0;
+    visiting.delete(id);
+    cache.set(id, level);
+    return level;
+  }
+  for (const node of nodes) node.level = levelFor(node.id);
+}
+
+// Roots stay in input order; later levels are sorted by the mean parent Y so that simple
+// chains stay on a straight horizontal line.
+function assignNodeCoordinates(nodesById: Map<string, GraphNode>, nodes: GraphNode[], adjacency: NodeAdjacency, options: WorkflowGraphLayoutOptions): void {
+  const {incomingByNodeId} = adjacency;
+  const inputRank = (node: GraphNode): number => Math.min(...node.jobs.map((j) => j.id));
+
+  const nodesByLevel = new Map<number, GraphNode[]>();
+  for (const node of nodes) {
+    if (!nodesByLevel.has(node.level)) nodesByLevel.set(node.level, []);
+    nodesByLevel.get(node.level)!.push(node);
+  }
+  const orderedLevels = Array.from(nodesByLevel.keys()).sort((a, b) => a - b);
+
+  // Initial X assignment and a default Y so barycenters can use a finite value.
+  for (const level of orderedLevels) {
+    const list = nodesByLevel.get(level)!;
+    list.sort((a, b) => inputRank(a) - inputRank(b));
+    let yCursor = options.margin;
+    for (const node of list) {
+      node.x = options.margin + level * (options.nodeWidth + options.columnGap);
+      node.y = yCursor;
+      yCursor += node.displayHeight + options.laneGap;
+    }
+  }
+
+  function packLevel(level: number, anchorOf: (n: GraphNode) => number): void {
+    const list = nodesByLevel.get(level)!;
+    const sorted = Array.from(list).sort((a, b) => anchorOf(a) - anchorOf(b) || inputRank(a) - inputRank(b));
+    // Pack tight to top after sorting. Using barycenter only for order (not Y) keeps terminal
+    // nodes like build-image close to the top of their column instead of being pulled down to
+    // the mean Y of their parents — matching GitHub Actions' compact layout.
+    let prevBottom = options.margin - options.laneGap;
+    for (const node of sorted) {
+      node.y = prevBottom + options.laneGap;
+      prevBottom = boxBottom(node);
+    }
+    nodesByLevel.set(level, sorted);
+  }
+
+  function meanCenterOf(ids: string[]): number | null {
+    if (ids.length === 0) return null;
+    let sum = 0;
+    for (const id of ids) sum += boxCenterY(nodesById.get(id)!);
+    return sum / ids.length;
+  }
+
+  // Down-only barycenter pass: each child is anchored to the mean Y of its parents. Roots
+  // keep their initial yaml-declaration order (via inputRank), matching how GitHub Actions
+  // arranges root jobs. This produces a "main chain on top" layout where job-100 → job-101 →
+  // job-102 stays on a straight horizontal line.
+  for (const level of orderedLevels) {
+    if (level === 0) continue;
+    packLevel(level, (node) => meanCenterOf(incomingByNodeId.get(node.id) || []) ?? boxCenterY(node));
+  }
+}
+
+// Per-edge connector: source stub → cubic-bezier corner down/up to column midpoint →
+// vertical run → cubic-bezier corner back to horizontal → target stub. The corner radius is
+// fixed (not clamped to the row delta) so any two edges sharing the same source produce the
+// same source-side path and overlap into a single visual line until they diverge at the V.
+const cornerRadius = 12;
+
+function connectorPath(sx: number, sy: number, ex: number, ey: number, options: WorkflowGraphLayoutOptions): string {
+  if (Math.abs(sy - ey) < 0.5) return `M ${sx} ${sy} H ${ex}`;
+  // Anchor the V segment in the column gap immediately before the target instead of the
+  // horizontal midpoint. The long H stays at the source's Y, matching GitHub Actions' style
+  // — a multi-column edge runs along the source row across intermediate columns, then turns
+  // up/down only when it reaches the target column.
+  const midX = Math.max(ex - options.columnGap / 2, (sx + ex) / 2);
+  const dy = ey > sy ? 1 : -1;
+  // Keep the same H prefix to `midX - cornerRadius` for every edge so that edges sharing a
+  // source overlap visually until they fork. When there isn't 2*cornerRadius of vertical
+  // room for the V segment, emit a single S-curve between (midX - r, sy) and (midX + r, ey)
+  // instead of a backward V kink.
+  if (Math.abs(ey - sy) < cornerRadius * 2) {
+    return [
+      `M ${sx} ${sy}`,
+      `H ${midX - cornerRadius}`,
+      `C ${midX} ${sy} ${midX} ${ey} ${midX + cornerRadius} ${ey}`,
+      `H ${ex}`,
+    ].join(' ');
+  }
+  const half = cornerRadius / 2;
+  return [
+    `M ${sx} ${sy}`,
+    `H ${midX - cornerRadius}`,
+    `C ${midX - half} ${sy} ${midX} ${sy + half * dy} ${midX} ${sy + cornerRadius * dy}`,
+    `V ${ey - cornerRadius * dy}`,
+    `C ${midX} ${ey - half * dy} ${midX + half} ${ey} ${midX + cornerRadius} ${ey}`,
+    `H ${ex}`,
+  ].join(' ');
+}
+
+function buildRoutedEdges(
+  nodesById: Map<string, GraphNode>,
+  edges: Edge[],
+  options: WorkflowGraphLayoutOptions,
+): Pick<WorkflowGraphModel, 'routedEdges' | 'sharedSegments'> {
+  const routedEdges: RoutedEdge[] = [];
+  for (const edge of edges) {
+    const fromNode = nodesById.get(edge.fromId);
+    const toNode = nodesById.get(edge.toId);
+    if (!fromNode || !toNode) continue;
+    const startX = fromNode.x + options.nodeWidth;
+    const endX = toNode.x;
+    const startY = boxCenterY(fromNode);
+    const endY = boxCenterY(toNode);
+    routedEdges.push({...edge, fromNode, toNode, path: connectorPath(startX, startY, endX, endY, options)});
+  }
+
+  return {routedEdges, sharedSegments: []};
+}
+
+export function createWorkflowGraphModel(
+  jobs: ActionsJob[],
+  expandedMatrixKeys: ReadonlySet<string> = new Set(),
+  partialOptions: Partial<WorkflowGraphLayoutOptions> = {},
+): WorkflowGraphModel {
+  const options = {...defaultLayoutOptions, ...partialOptions};
+  const {nodes, edges} = buildVisualGraph(jobs, expandedMatrixKeys, options);
+  const nodesById = new Map(nodes.map((n) => [n.id, n]));
+  const adjacency = buildNodeAdjacency(edges);
+  assignNodeLevels(nodes, adjacency);
+  assignNodeCoordinates(nodesById, nodes, adjacency, options);
+  return {nodes, edges, ...buildRoutedEdges(nodesById, edges, options), adjacency};
+}
+
+export function getWorkflowGraphLayoutOptions(partialOptions: Partial<WorkflowGraphLayoutOptions> = {}): WorkflowGraphLayoutOptions {
+  return {...defaultLayoutOptions, ...partialOptions};
+}
diff --git a/web_src/js/components/WorkflowGraph.vue b/web_src/js/components/WorkflowGraph.vue
index 27ba960feb..4c8762dc39 100644
--- a/web_src/js/components/WorkflowGraph.vue
+++ b/web_src/js/components/WorkflowGraph.vue
@@ -6,31 +6,17 @@ import {localUserSettings} from '../modules/user-settings.ts';
 import {isPlainClick} from '../utils/dom.ts';
 import {trN} from '../modules/i18n.ts';
 import {debounce} from 'throttle-debounce';
-import type {ActionsJob, ActionsStatus} from '../modules/gitea-actions.ts';
+import type {ActionsJob} from '../modules/gitea-actions.ts';
 import type {ActionRunViewStore} from './ActionRunView.ts';
-
-interface JobNode {
-  id: number;
-  name: string;
-  status: ActionsStatus;
-  duration: string;
-
-  x: number;
-  y: number;
-  level: number;
-}
-
-interface Edge {
-  fromId: number;
-  toId: number;
-  key: string;
-}
-
-interface RoutedEdge extends Edge {
-  path: string;
-  fromNode: JobNode;
-  toNode: JobNode;
-}
+import {
+  boxBottom,
+  boxCenterY,
+  computeGraphHighlightState,
+  createWorkflowGraphModel,
+  getWorkflowGraphLayoutOptions,
+  type GraphNode,
+  type RoutedEdge,
+} from './WorkflowGraph.utils.ts';
 
 interface StoredState {
   scale: number;
@@ -45,10 +31,11 @@ const props = defineProps<{
   runLink: string;
   workflowId: string;
   locale: Record<string, string>;
-}>()
+}>();
 
 const settingKeyStates = 'actions-graph-states';
 const maxStoredStates = 10;
+const layout = getWorkflowGraphLayoutOptions();
 
 const scale = ref(1);
 const translateX = ref(0);
@@ -56,9 +43,21 @@ const translateY = ref(0);
 const isDragging = ref(false);
 const lastMousePos = ref({x: 0, y: 0});
 const graphContainer = ref<HTMLElement | null>(null);
-const hoveredJobId = ref<number | null>(null);
+const hoveredGraphId = ref<string | null>(null);
 
 const stateKey = () => `${props.store.viewData.currentRun.repoId}-${props.workflowId}`;
+const expandedMatrixKeys = ref<Set<string>>(new Set());
+
+function isMatrixExpanded(key: string): boolean {
+  return expandedMatrixKeys.value.has(key);
+}
+
+function toggleMatrixExpanded(key: string) {
+  const next = new Set(expandedMatrixKeys.value);
+  if (next.has(key)) next.delete(key);
+  else next.add(key);
+  expandedMatrixKeys.value = next;
+}
 
 const loadSavedState = () => {
   const allStates = localUserSettings.getJsonObject<Record<string, StoredState>>(settingKeyStates, {});
@@ -85,289 +84,35 @@ const saveState = () => {
   localUserSettings.setJsonObject(settingKeyStates, Object.fromEntries(sortedStates));
 };
 
-const minNodeWidth = 168;
-const maxNodeWidth = 232;
-const nodeWidth = computed(() => {
-  const maxNameLength = Math.max(...props.jobs.map(j => j.name.length), 0);
-  return Math.min(Math.max(minNodeWidth, maxNameLength * 8), maxNodeWidth);
-});
+const graphModel = computed(() => createWorkflowGraphModel(props.jobs, expandedMatrixKeys.value));
+const jobsWithLayout = computed(() => graphModel.value.nodes);
+const edges = computed(() => graphModel.value.edges);
+const routedEdges = computed<RoutedEdge[]>(() => graphModel.value.routedEdges);
 
-const horizontalSpacing = computed(() => nodeWidth.value + 84);
+const nodeWidth = layout.nodeWidth;
 const graphWidth = computed(() => {
   if (jobsWithLayout.value.length === 0) return 800;
-  const maxX = Math.max(...jobsWithLayout.value.map(j => j.x + nodeWidth.value));
-  return maxX + margin * 2;
+  const maxX = Math.max(...jobsWithLayout.value.map((job) => job.x + nodeWidth));
+  return maxX + layout.margin * 2;
 });
 
 const graphHeight = computed(() => {
   if (jobsWithLayout.value.length === 0) return 400;
-  const maxY = Math.max(...jobsWithLayout.value.map(j => j.y + nodeHeight));
-  return maxY + margin * 2;
+  const maxY = Math.max(...jobsWithLayout.value.map((job) => boxBottom(job)));
+  return maxY + layout.margin * 2;
 });
 
-
-const jobsWithLayout = computed<JobNode[]>(() => {
-  try {
-    const levels = computeJobLevels(props.jobs);
-    const currentHorizontalSpacing = horizontalSpacing.value;
-
-    const jobsByLevel: ActionsJob[][] = [];
-    let maxJobsPerLevel = 0;
-
-    props.jobs.forEach(job => {
-      // `?? 0`, not `|| 0`: a root job's level is 0, which `||` would wrongly discard.
-      const level = levels.get(scopedKey(job)) ?? 0;
-
-      if (!jobsByLevel[level]) {
-        jobsByLevel[level] = [];
-      }
-      jobsByLevel[level].push(job);
-
-      if (jobsByLevel[level].length > maxJobsPerLevel) {
-        maxJobsPerLevel = jobsByLevel[level].length;
-      }
-    });
-
-    const result: JobNode[] = [];
-    jobsByLevel.forEach((levelJobs, levelIndex) => {
-      if (!levelJobs || levelJobs.length === 0) {
-        return;
-      }
-
-      const startY = margin;
-
-      levelJobs.forEach((job, jobIndex) => {
-        result.push({
-          id: job.id,
-          name: job.name,
-          status: job.status,
-          duration: job.duration,
-
-          x: margin + levelIndex * currentHorizontalSpacing,
-          y: startY + jobIndex * verticalSpacing,
-          level: levelIndex,
-        });
-      });
-    });
-
-    return result;
-  } catch (error) {
-    return props.jobs.map((job, index) => ({
-      id: job.id,
-      name: job.name,
-      status: job.status,
-      duration: job.duration,
-
-      x: margin + index * horizontalSpacing.value,
-      y: margin,
-      level: 0,
-    }));
-  }
+const successRateLabel = computed(() => {
+  if (props.jobs.length === 0) return '0%';
+  const successCount = props.jobs.filter((job) => job.status === 'success').length;
+  return `${((successCount / props.jobs.length) * 100).toFixed(0)}%`;
 });
 
-// scopedKey identifies a job within its reusable-workflow call scope so that the same
-// JobID in different reusable calls does not collide.
-function scopedKey(job: {parentJobID: number; jobId: string}): string {
-  return `${job.parentJobID || 0}:${job.jobId}`;
-}
-
-function buildDirectNeedsMap(jobs: ActionsJob[]): Map<string, string[]> {
-  // The map keys/values are scoped keys, not bare jobIds, so we keep edge construction
-  // accurate when reusable workflows reuse common job names like "build" / "test".
-  const directNeedsByScopedKey = new Map<string, string[]>();
-  const dependentsByScopedKey = new Map<string, Set<string>>();
-
-  for (const job of jobs) {
-    const fromKey = scopedKey(job);
-    const needKeys = (job.needs || []).map((n) => `${job.parentJobID || 0}:${n}`);
-    directNeedsByScopedKey.set(fromKey, needKeys);
-
-    for (const needKey of needKeys) {
-      if (!dependentsByScopedKey.has(needKey)) {
-        dependentsByScopedKey.set(needKey, new Set());
-      }
-      dependentsByScopedKey.get(needKey)!.add(fromKey);
-    }
-  }
-
-  const reachabilityCache = new Map<string, boolean>();
-
-  function canReach(fromKey: string, toKey: string): boolean {
-    const cacheKey = `${fromKey}->${toKey}`;
-    if (reachabilityCache.has(cacheKey)) {
-      return reachabilityCache.get(cacheKey)!;
-    }
-
-    const visited = new Set<string>();
-    const stack = [...(dependentsByScopedKey.get(fromKey) || [])];
-
-    while (stack.length > 0) {
-      const current = stack.pop()!;
-      if (current === toKey) {
-        reachabilityCache.set(cacheKey, true);
-        return true;
-      }
-      if (visited.has(current)) continue;
-      visited.add(current);
-      stack.push(...(dependentsByScopedKey.get(current) || []));
-    }
-
-    reachabilityCache.set(cacheKey, false);
-    return false;
-  }
-
-  const reducedNeedsByScopedKey = new Map<string, string[]>();
-  for (const [fromKey, needs] of directNeedsByScopedKey.entries()) {
-    reducedNeedsByScopedKey.set(fromKey, needs.filter((need) => {
-      return !needs.some((otherNeed) => otherNeed !== need && canReach(need, otherNeed));
-    }));
-  }
-
-  return reducedNeedsByScopedKey;
-}
-
-const directNeedsByScopedKey = computed(() => buildDirectNeedsMap(props.jobs));
-
-const edges = computed<Edge[]>(() => {
-  const edgesList: Edge[] = [];
-  // Store every job per scoped key, not just one: matrix-expanded jobs share same jobId
-  const jobsByScopedKey = new Map<string, ActionsJob[]>();
-
-  for (const job of props.jobs) {
-    const key = scopedKey(job);
-    const existing = jobsByScopedKey.get(key);
-    if (existing) {
-      existing.push(job);
-    } else {
-      jobsByScopedKey.set(key, [job]);
-    }
-  }
-
-  for (const job of props.jobs) {
-    for (const needKey of directNeedsByScopedKey.value.get(scopedKey(job)) || []) {
-      for (const upstreamJob of jobsByScopedKey.get(needKey) || []) {
-        edgesList.push({
-          fromId: upstreamJob.id,
-          toId: job.id,
-          key: `${upstreamJob.id}-${job.id}`,
-        });
-      }
-    }
-  }
-
-  return edgesList;
-});
-
-function buildRoundedConnectorPath(startX: number, startY: number, endX: number, endY: number, turnX: number): string {
-  const deltaY = endY - startY;
-  if (Math.abs(deltaY) < 1) {
-    return `M ${startX} ${startY} H ${endX}`;
-  }
-
-  const direction = deltaY > 0 ? 1 : -1;
-  const elbowSize = Math.max(8, Math.min(24, Math.abs(deltaY) / 2, Math.abs(endX - startX) / 2));
-  const controlOffset = elbowSize / 2;
-  const clampedTurnX = Math.min(Math.max(turnX, startX + elbowSize), endX - elbowSize);
-
-  return [
-    `M ${startX} ${startY}`,
-    `H ${clampedTurnX - elbowSize}`,
-    `C ${clampedTurnX - controlOffset} ${startY} ${clampedTurnX} ${startY + direction * controlOffset} ${clampedTurnX} ${startY + direction * elbowSize}`,
-    `V ${endY - direction * elbowSize}`,
-    `C ${clampedTurnX} ${endY - direction * controlOffset} ${clampedTurnX + controlOffset} ${endY} ${clampedTurnX + elbowSize} ${endY}`,
-    `H ${endX}`,
-  ].join(' ');
-}
-
-const routedEdges = computed<RoutedEdge[]>(() => {
-  const nodesById = new Map(jobsWithLayout.value.map((job) => [job.id, job]));
-  const outgoingEdges = new Map<number, Edge[]>();
-  const incomingEdges = new Map<number, Edge[]>();
-
-  for (const edge of edges.value) {
-    if (!outgoingEdges.has(edge.fromId)) {
-      outgoingEdges.set(edge.fromId, []);
-    }
-    outgoingEdges.get(edge.fromId)!.push(edge);
-
-    if (!incomingEdges.has(edge.toId)) {
-      incomingEdges.set(edge.toId, []);
-    }
-    incomingEdges.get(edge.toId)!.push(edge);
-  }
-
-  for (const sourceEdges of outgoingEdges.values()) {
-    sourceEdges.sort((a, b) => {
-      const targetA = nodesById.get(a.toId);
-      const targetB = nodesById.get(b.toId);
-      if (!targetA || !targetB) return 0;
-      return targetA.y - targetB.y || a.toId - b.toId;
-    });
-  }
-
-  const edgePaths: RoutedEdge[] = [];
-
-  for (const edge of edges.value) {
-    const fromNode = nodesById.get(edge.fromId);
-    const toNode = nodesById.get(edge.toId);
-    if (!fromNode || !toNode) continue;
-
-    const startX = fromNode.x + nodeWidth.value;
-    const startY = fromNode.y + nodeHeight / 2;
-    const endX = toNode.x;
-    const endY = toNode.y + nodeHeight / 2;
-    const sourceEdges = outgoingEdges.get(edge.fromId) || [];
-    const targetEdges = incomingEdges.get(edge.toId) || [];
-    const horizontalGap = endX - startX;
-    const turnOffset = Math.min(28, Math.max(16, horizontalGap * 0.14));
-    const sourceTurnX = startX + turnOffset;
-    const targetTurnX = endX - turnOffset;
-
-    let turnX = startX + horizontalGap / 2;
-    if (sourceEdges.length > 1) {
-      turnX = sourceTurnX;
-    } else if (targetEdges.length > 1) {
-      turnX = targetTurnX;
-    }
-
-    const path = buildRoundedConnectorPath(startX, startY, endX, endY, turnX);
-
-    edgePaths.push({
-      ...edge,
-      path,
-      fromNode,
-      toNode,
-    });
-  }
-
-  return edgePaths;
-});
-
-const graphMetrics = computed(() => {
-  const successCount = jobsWithLayout.value.filter(job => job.status === 'success').length;
-
-  const levels = new Map<number, number>();
-  jobsWithLayout.value.forEach(job => {
-    const count = levels.get(job.level) || 0;
-    levels.set(job.level, count + 1);
-  })
-  const parallelism = Math.max(...Array.from(levels.values()), 0);
-
-  return {
-    successRate: `${((successCount / jobsWithLayout.value.length) * 100).toFixed(0)}%`,
-    parallelism,
-  };
-})
-
 const graphStats = computed(() => [
   trN(props.jobs.length, props.locale.graphJobsCount1, props.locale.graphJobsCountN),
   trN(edges.value.length, props.locale.graphDependenciesCount1, props.locale.graphDependenciesCountN),
-  props.locale.graphSuccessRate.replace('%s', graphMetrics.value.successRate),
-].join(' • '))
-
-const nodeHeight = 52;
-const verticalSpacing = 90;
-const margin = 40;
+  props.locale.graphSuccessRate.replace('%s', successRateLabel.value),
+].join(' • '));
 
 const minScale = 0.3;
 const maxScale = 1;
@@ -398,42 +143,32 @@ function resetView() {
 
 function handleMouseDown(e: MouseEvent) {
   if (!isPlainClick(e)) return;
-
-  // don't start drag on interactive/text elements inside the SVG
   const target = e.target as Element;
   const interactive = target.closest('div, p, a, span, button, input, text, .job-node-group');
   if (interactive?.closest('svg')) return;
 
   e.preventDefault();
-
   isDragging.value = true;
   lastMousePos.value = {x: e.clientX, y: e.clientY};
-  graphContainer.value!.style.cursor = 'grabbing';
+  if (graphContainer.value) graphContainer.value.style.cursor = 'grabbing';
 }
 
 function handleMouseMoveOnDocument(event: MouseEvent) {
   if (!isDragging.value) return;
 
-  const dx = event.clientX - lastMousePos.value.x;
-  const dy = event.clientY - lastMousePos.value.y;
-
-  translateX.value += dx;
-  translateY.value += dy;
-
+  translateX.value += event.clientX - lastMousePos.value.x;
+  translateY.value += event.clientY - lastMousePos.value.y;
   lastMousePos.value = {x: event.clientX, y: event.clientY};
 }
 
 function handleMouseUpOnDocument() {
   if (!isDragging.value) return;
   isDragging.value = false;
-  graphContainer.value!.style.cursor = 'grab';
+  if (graphContainer.value) graphContainer.value.style.cursor = 'grab';
 }
 
 function handleWheel(event: WheelEvent) {
-  // Without a modifier, let the wheel scroll the page
-  if (!event.ctrlKey && !event.metaKey) {
-    return;
-  }
+  if (!event.ctrlKey && !event.metaKey) return;
   event.preventDefault();
   const zoomFactor = Math.exp(-event.deltaY * 0.0015);
   zoomTo(scale.value * zoomFactor);
@@ -442,8 +177,6 @@ function handleWheel(event: WheelEvent) {
 onMounted(() => {
   loadSavedState();
   watch([translateX, translateY, scale], debounce(500, saveState));
-  watch([scale], debounce(100, saveState));
-
   document.addEventListener('mousemove', handleMouseMoveOnDocument);
   document.addEventListener('mouseup', handleMouseUpOnDocument);
 });
@@ -453,106 +186,40 @@ onUnmounted(() => {
   document.removeEventListener('mouseup', handleMouseUpOnDocument);
 });
 
-function handleNodeMouseEnter(job: JobNode) {
-  hoveredJobId.value = job.id;
+function handleNodeMouseEnter(id: string) {
+  hoveredGraphId.value = id;
 }
 
 function handleNodeMouseLeave() {
-  hoveredJobId.value = null;
+  hoveredGraphId.value = null;
+}
+
+const highlightState = computed(() => computeGraphHighlightState(hoveredGraphId.value, graphModel.value.adjacency));
+
+function isNodeHighlighted(nodeId: string): boolean {
+  return highlightState.value.nodeIds.has(nodeId);
 }
 
 function isEdgeHighlighted(edge: RoutedEdge): boolean {
-  if (!hoveredJobId.value) {
-    return false;
-  }
-  return edge.fromId === hoveredJobId.value || edge.toId === hoveredJobId.value;
+  return highlightState.value.edgeKeys.has(edge.key);
 }
 
-const nodesWithIncomingEdge = computed(() => {
-  const set = new Set<number>();
-  for (const edge of routedEdges.value) set.add(edge.toId);
-  return set;
+const splitRoutedEdges = computed(() => {
+  const highlighted: RoutedEdge[] = [];
+  const dimmed: RoutedEdge[] = [];
+  for (const edge of routedEdges.value) (isEdgeHighlighted(edge) ? highlighted : dimmed).push(edge);
+  return {highlighted, dimmed};
 });
 
-const nodesWithOutgoingEdge = computed(() => {
-  const set = new Set<number>();
-  for (const edge of routedEdges.value) set.add(edge.fromId);
-  return set;
-});
+const nodesWithIncomingEdge = computed(() => new Set(graphModel.value.adjacency.incomingByNodeId.keys()));
+const nodesWithOutgoingEdge = computed(() => new Set(graphModel.value.adjacency.outgoingByNodeId.keys()));
 
-
-function computeJobLevels(jobs: ActionsJob[]): Map<string, number> {
-  // Scope-aware: each job is keyed by `${parentJobID}:${jobId}` so the same JobID
-  // in different reusable workflow calls does not cross-link in the level graph.
-  const jobMap = new Map<string, ActionsJob>();
-  jobs.forEach(job => {
-    jobMap.set(scopedKey(job), job);
-  });
-
-  const levels = new Map<string, number>();
-  const visited = new Set<string>();
-  const recursionStack = new Set<string>();
-  const MAX_DEPTH = 100;
-
-  function dfs(scoped: string, depth: number = 0): number {
-    if (depth > MAX_DEPTH) {
-      console.error(`Max recursion depth (${MAX_DEPTH}) reached for: ${scoped}`);
-      return 0;
-    }
-
-    if (recursionStack.has(scoped)) {
-      console.error(`Cycle detected involving: ${scoped}`);
-      return 0;
-    }
-
-    if (visited.has(scoped)) {
-      return levels.get(scoped) || 0;
-    }
-
-    recursionStack.add(scoped);
-    visited.add(scoped);
-
-    const job = jobMap.get(scoped);
-    if (!job) {
-      recursionStack.delete(scoped);
-      return 0;
-    }
-
-    if (!job.needs?.length) {
-      levels.set(scoped, 0);
-      recursionStack.delete(scoped);
-      return 0;
-    }
-
-    let maxLevel = -1;
-    for (const need of job.needs) {
-      const needScoped = `${job.parentJobID || 0}:${need}`;
-      const needJob = jobMap.get(needScoped);
-      if (!needJob) continue;
-
-      const needLevel = dfs(needScoped, depth + 1);
-      maxLevel = Math.max(maxLevel, needLevel);
-    }
-
-    const level = maxLevel + 1;
-    levels.set(scoped, level);
-
-    recursionStack.delete(scoped);
-    return level;
-  }
-
-  jobs.forEach(job => {
-    const sk = scopedKey(job);
-    if (!visited.has(sk)) {
-      dfs(sk);
-    }
-  });
-
-  return levels;
-}
-
-function onNodeClick(job: JobNode, event: MouseEvent) {
-  const link = `${props.runLink}/jobs/${job.id}`;
+function onNodeClick(job: GraphNode | ActionsJob, event: MouseEvent) {
+  const target = 'jobs' in job ? job.jobs[0]! : job;
+  // Reusable callers have no per-job detail page; clicking them is a no-op so the graph
+  // doesn't lead users to a dead destination.
+  if (target.isReusableCaller) return;
+  const link = `${props.runLink}/jobs/${target.id}`;
   if (event.ctrlKey || event.metaKey) {
     window.open(link, '_blank');
     return;
@@ -562,7 +229,7 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
 </script>
 
 <template>
-  <div class="workflow-graph" v-if="jobs.length > 0">
+  <div v-if="jobs.length > 0" class="workflow-graph">
     <div class="graph-header">
       <h4 class="graph-title">{{ locale.workflowDependencies }}</h4>
       <div class="graph-stats">{{ graphStats }}</div>
@@ -586,96 +253,160 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
     </div>
 
     <div
-      class="graph-container"
       ref="graphContainer"
+      class="graph-container"
+      :class="{dragging: isDragging}"
       @mousedown="handleMouseDown"
       @wheel="handleWheel"
-      :class="{dragging: isDragging}"
     >
       <svg
         :width="graphWidth"
         :height="graphHeight"
         class="graph-svg"
+        :class="{ 'has-hover': hoveredGraphId !== null }"
         :style="{
           transform: `translate(${translateX}px, ${translateY}px) scale(${scale})`,
           transformOrigin: '0 0',
         }"
       >
-        <path
-          v-for="edge in routedEdges"
-          :key="edge.key"
-          :d="edge.path"
-          fill="none"
-          stroke="var(--color-secondary-alpha-50)"
-          stroke-width="1.5"
-          :class="['node-edge', { 'highlighted-edge': isEdgeHighlighted(edge) }]"
-        />
+        <defs>
+          <mask :id="`workflow-graph-edge-mask-${workflowId}`">
+            <rect :width="graphWidth" :height="graphHeight" fill="white"/>
+            <rect
+              v-for="job in jobsWithLayout"
+              :key="`mask-${job.id}`"
+              :x="job.x"
+              :y="job.y"
+              :width="nodeWidth"
+              :height="job.displayHeight"
+              rx="6"
+              fill="black"
+            />
+          </mask>
+        </defs>
 
-        <g
-          v-for="job in jobsWithLayout"
-          :key="job.id"
-          class="job-node-group"
-          @click="onNodeClick(job, $event)"
-          @mouseenter="handleNodeMouseEnter(job)"
-          @mouseleave="handleNodeMouseLeave"
-        >
-          <title>{{ job.name }}</title>
-
-          <rect
-            :x="job.x"
-            :y="job.y"
-            :width="nodeWidth"
-            :height="nodeHeight"
-            rx="8"
-            fill="var(--color-box-body)"
-            stroke="var(--color-secondary)"
-            stroke-width="1"
-            class="job-rect"
+        <g :mask="`url(#workflow-graph-edge-mask-${workflowId})`">
+          <path
+            v-for="edge in splitRoutedEdges.dimmed"
+            :key="edge.key"
+            :d="edge.path"
+            fill="none"
+            class="node-edge"
           />
+        </g>
 
-          <circle
-            v-if="nodesWithIncomingEdge.has(job.id)"
-            :cx="job.x"
-            :cy="job.y + nodeHeight / 2"
-            r="4.5"
-            class="node-port"
-          />
-
-          <circle
-            v-if="nodesWithOutgoingEdge.has(job.id)"
-            :cx="job.x + nodeWidth"
-            :cy="job.y + nodeHeight / 2"
-            r="4.5"
-            class="node-port"
-          />
-
-          <foreignObject
-            :x="job.x + 10"
-            :y="job.y + 16"
-            width="20"
-            height="20"
-            class="job-status-fg-obj"
+        <template v-for="job in jobsWithLayout" :key="job.id">
+          <g
+            v-if="job.type === 'matrix'"
+            class="job-node-group matrix-job-group"
+            :class="{ 'related-node': isNodeHighlighted(job.id) }"
+            @mouseenter="handleNodeMouseEnter(job.id)"
+            @mouseleave="handleNodeMouseLeave"
           >
-            <div class="job-status-icon-wrap">
-              <ActionStatusIcon :status="job.status" icon-variant="circle-fill"/>
-            </div>
-          </foreignObject>
+            <title>Matrix: {{ job.matrixKey }}</title>
+            <rect :x="job.x" :y="job.y" :width="nodeWidth" :height="job.displayHeight" rx="6" class="job-rect"/>
+            <foreignObject :x="job.x" :y="job.y" :width="nodeWidth" :height="job.displayHeight" class="matrix-foreign-object">
+              <div class="matrix-panel" xmlns="http://www.w3.org/1999/xhtml">
+                <div class="matrix-panel-label" @click.stop="toggleMatrixExpanded(job.matrixKey!)">Matrix: {{ job.matrixKey }}</div>
+                <div
+                  v-if="!isMatrixExpanded(job.matrixKey!)"
+                  class="matrix-panel-collapsed"
+                  @click.stop="toggleMatrixExpanded(job.matrixKey!)"
+                >
+                  <div class="matrix-panel-summary-row">
+                    <ActionStatusIcon :status="job.status" icon-variant="circle-fill"/>
+                    <span class="matrix-panel-summary">{{ job.jobs.length }} jobs completed</span>
+                  </div>
+                  <span class="matrix-panel-toggle">Show all jobs</span>
+                </div>
+                <div v-else class="matrix-panel-jobs">
+                  <div
+                    v-for="ch in job.jobs"
+                    :key="ch.id"
+                    class="graph-list-row"
+                    @mouseenter="handleNodeMouseEnter(job.id)"
+                    @click.stop="onNodeClick(ch, $event)"
+                  >
+                    <div class="graph-list-row-main">
+                      <ActionStatusIcon :status="ch.status" icon-variant="circle-fill"/>
+                      <span class="graph-list-row-name">{{ ch.name }}</span>
+                    </div>
+                    <span class="graph-list-row-duration">{{ ch.duration }}</span>
+                  </div>
+                </div>
+              </div>
+            </foreignObject>
+            <circle v-if="nodesWithIncomingEdge.has(job.id)" :cx="job.x" :cy="boxCenterY(job)" r="3.5" class="node-port"/>
+            <circle v-if="nodesWithOutgoingEdge.has(job.id)" :cx="job.x + nodeWidth" :cy="boxCenterY(job)" r="3.5" class="node-port"/>
+          </g>
 
-          <foreignObject
-            :x="job.x + 38"
-            :y="job.y + 2"
-            :width="nodeWidth - 44"
-            :height="nodeHeight - 4"
+          <g
+            v-else-if="job.type === 'group'"
+            class="job-node-group grouped-job-group"
+            :class="{ 'related-node': isNodeHighlighted(job.id) }"
+            @mouseenter="handleNodeMouseEnter(job.id)"
+            @mouseleave="handleNodeMouseLeave"
           >
-            <div class="job-text-wrap">
-              <span class="job-name">{{ job.name }}</span>
-              <span
-                v-if="job.duration || job.status === 'success' || job.status === 'failure'"
-                class="job-duration"
-              >{{ job.duration }}</span>
-            </div>
-          </foreignObject>
+            <title>{{ job.name }}</title>
+            <rect :x="job.x" :y="job.y" :width="nodeWidth" :height="job.displayHeight" rx="6" class="job-rect"/>
+            <foreignObject :x="job.x" :y="job.y" :width="nodeWidth" :height="job.displayHeight" class="matrix-foreign-object">
+              <div class="grouped-panel" xmlns="http://www.w3.org/1999/xhtml" @click.stop>
+                <div
+                  v-for="ch in job.jobs"
+                  :key="ch.id"
+                  class="graph-list-row"
+                  @mouseenter="handleNodeMouseEnter(job.id)"
+                  @click="onNodeClick(ch, $event)"
+                >
+                  <div class="graph-list-row-main">
+                    <ActionStatusIcon :status="ch.status" icon-variant="circle-fill"/>
+                    <span class="graph-list-row-name">{{ ch.name }}</span>
+                  </div>
+                  <span class="graph-list-row-duration">{{ ch.duration }}</span>
+                </div>
+              </div>
+            </foreignObject>
+            <circle v-if="nodesWithIncomingEdge.has(job.id)" :cx="job.x" :cy="boxCenterY(job)" r="3.5" class="node-port"/>
+            <circle v-if="nodesWithOutgoingEdge.has(job.id)" :cx="job.x + nodeWidth" :cy="boxCenterY(job)" r="3.5" class="node-port"/>
+          </g>
 
+          <g
+            v-else
+            class="job-node-group"
+            :class="{ 'related-node': isNodeHighlighted(job.id), 'caller-node': job.jobs[0]!.isReusableCaller }"
+            @click="onNodeClick(job, $event)"
+            @mouseenter="handleNodeMouseEnter(job.id)"
+            @mouseleave="handleNodeMouseLeave"
+          >
+            <title>{{ job.name }}</title>
+            <rect :x="job.x" :y="job.y" :width="nodeWidth" :height="job.displayHeight" rx="6" class="job-rect"/>
+            <foreignObject :x="job.x + 10" :y="job.y + 6" :width="nodeWidth - 20" :height="job.displayHeight - 12">
+              <div class="job-row job-card" xmlns="http://www.w3.org/1999/xhtml">
+                <div class="job-row-main">
+                  <ActionStatusIcon :status="job.status" icon-variant="circle-fill"/>
+                  <span class="job-name">{{ job.name }}</span>
+                </div>
+                <span class="job-duration">{{ job.duration }}</span>
+              </div>
+            </foreignObject>
+            <circle v-if="nodesWithIncomingEdge.has(job.id)" :cx="job.x" :cy="boxCenterY(job)" r="3.5" class="node-port"/>
+            <circle v-if="nodesWithOutgoingEdge.has(job.id)" :cx="job.x + nodeWidth" :cy="boxCenterY(job)" r="3.5" class="node-port"/>
+          </g>
+        </template>
+
+        <!-- Highlighted edges render on top of nodes so they remain visible across dimmed boxes. -->
+        <g class="highlighted-edge-layer">
+          <path
+            v-for="edge in splitRoutedEdges.highlighted"
+            :key="`highlight-${edge.key}`"
+            :d="edge.path"
+            fill="none"
+            class="node-edge highlighted-edge"
+          />
+          <template v-for="edge in splitRoutedEdges.highlighted" :key="`highlight-port-${edge.key}`">
+            <circle :cx="edge.fromNode.x + nodeWidth" :cy="boxCenterY(edge.fromNode)" r="3.5" class="node-port highlighted-port"/>
+            <circle :cx="edge.toNode.x" :cy="boxCenterY(edge.toNode)" r="3.5" class="node-port highlighted-port"/>
+          </template>
         </g>
       </svg>
     </div>
@@ -688,6 +419,7 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
   display: flex;
   flex-direction: column;
 }
+
 .graph-header {
   display: flex;
   justify-content: space-between;
@@ -719,7 +451,7 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
 
 .graph-container {
   flex: 1;
-  overflow: hidden;
+  overflow: auto;
   padding: 10px 14px 18px;
   border-radius: 0 0 var(--border-radius) var(--border-radius);
   cursor: grab;
@@ -737,86 +469,210 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
 }
 
 .graph-svg path {
-  transition: all 0.2s ease;
+  transition: stroke-width 0.2s ease, opacity 0.2s ease;
   stroke-linecap: round;
   stroke-linejoin: round;
 }
 
+.node-edge {
+  stroke: var(--color-secondary-dark-2);
+  stroke-width: 1.5;
+  opacity: 0.9;
+}
+
 .highlighted-edge {
-  stroke-width: 2 !important;
-  stroke: var(--color-workflow-edge-hover) !important;
+  stroke: var(--color-primary);
+  stroke-width: 2;
 }
 
 .job-node-group {
   cursor: pointer;
-  transition: all 0.2s ease;
+  transition: opacity 0.15s ease;
 }
 
-.job-node-group:hover .job-rect {
-  /* due to SVG rendering limitation, only one of fill and drop-shadow can work */
-  fill: var(--color-hover);
-  /* filter: drop-shadow(0 1px 3px var(--color-shadow-opaque)); */
+.job-node-group.caller-node {
+  cursor: default;
 }
 
-.job-text-wrap {
+.job-node-group:hover .job-rect,
+.job-node-group.related-node .job-rect {
+  stroke: var(--color-primary);
+  stroke-width: 1.5;
+  fill: var(--color-primary-alpha-10);
+}
+
+.graph-svg.has-hover .job-node-group:not(.related-node) {
+  opacity: 0.2;
+}
+
+.graph-svg.has-hover .node-edge:not(.highlighted-edge) {
+  opacity: 0.15;
+}
+
+.highlighted-edge-layer {
+  pointer-events: none;
+}
+
+.highlighted-port {
+  fill: var(--color-primary);
+  stroke: var(--color-primary);
+}
+
+.job-rect {
+  fill: var(--color-box-body);
+  stroke: var(--color-secondary);
+  stroke-width: 1;
+}
+
+.matrix-foreign-object {
+  pointer-events: auto;
+  overflow: visible;
+}
+
+.matrix-panel,
+.grouped-panel {
+  width: 100%;
+  height: 100%;
+  box-sizing: border-box;
+  border-radius: 6px;
+  background: transparent;
+  pointer-events: auto;
+  user-select: none;
+}
+
+.matrix-panel {
+  display: flex;
+  flex-direction: column;
+  padding: 6px 10px 8px;
+}
+
+.matrix-panel-label {
+  font-size: 10px;
+  font-weight: var(--font-weight-medium);
+  color: var(--color-text-light-2);
+  line-height: 1.3;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  cursor: pointer;
+}
+
+.matrix-panel-collapsed {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  padding: 2px 0 0 2px;
+  cursor: pointer;
+}
+
+.matrix-panel-summary-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+
+.matrix-panel-summary {
+  font-size: 12px;
+  font-weight: var(--font-weight-semibold);
+  line-height: 1.3;
+  color: var(--color-text);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.matrix-panel-toggle {
+  font-size: 11px;
+  color: var(--color-text-light-2);
+  padding-left: 24px;
+  cursor: pointer;
+}
+
+.matrix-panel-toggle:hover {
+  color: var(--color-primary);
+  text-decoration: underline;
+}
+
+.matrix-panel-jobs {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  padding: 4px 0 0 2px;
+  overflow-y: auto;
+}
+
+.grouped-panel {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  padding: 6px;
+  gap: 2px;
+}
+
+.graph-list-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  min-height: 24px;
+  padding: 1px 6px;
+  border-radius: 5px;
+}
+
+.graph-list-row:hover {
+  background: var(--color-hover);
+}
+
+.graph-list-row-main,
+.job-row-main {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+
+.graph-list-row-name,
+.job-name {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-size: 11px;
+  font-weight: var(--font-weight-semibold);
+  color: var(--color-text);
+}
+
+.graph-list-row-duration,
+.job-duration {
+  flex: 0 0 auto;
+  font-size: 10px;
+  color: var(--color-text-light-2);
+  white-space: nowrap;
+}
+
+.job-row {
   width: 100%;
   height: 100%;
   display: flex;
-  flex-direction: column;
-  align-items: flex-start;
-  justify-content: center;
-  gap: 1px;
-  padding: 4px 8px 4px 0;
-  overflow: hidden;
-}
-
-.job-name {
-  width: 100%;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: 12px;
-  font-weight: var(--font-weight-semibold);
-  color: var(--color-text);
-  user-select: none;
-  pointer-events: none;
-}
-
-.job-duration {
-  font-size: 10px;
-  line-height: 1.2;
-  color: var(--color-text-light-2);
-  white-space: nowrap;
-  max-width: 100%;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  user-select: none;
-  pointer-events: none;
-}
-
-.job-status-fg-obj,
-.job-status-icon-wrap {
-  pointer-events: none;
-}
-
-.job-status-icon-wrap {
-  width: 20px;
-  height: 20px;
-  display: flex;
   align-items: center;
-  justify-content: center;
+  justify-content: space-between;
+  gap: 8px;
+}
+
+.job-card {
+  border-radius: 6px;
+  padding: 0 2px;
 }
 
 .node-port {
-  fill: var(--color-box-body);
-  stroke: var(--color-light-border);
+  fill: var(--color-secondary-dark-2);
+  stroke: var(--color-box-body);
   stroke-width: 1.25;
-  opacity: 0.85;
+  opacity: 0.9;
   pointer-events: none;
 }
 
-.node-edge {
-  transition: stroke-width 0.2s ease, opacity 0.2s ease;
-  opacity: 0.75;
+.job-node-group.related-node .node-port {
+  fill: var(--color-primary);
 }
 </style>
diff --git a/web_src/js/features/user-auth-gpg-signup.ts b/web_src/js/features/user-auth-gpg-signup.ts
new file mode 100644
index 0000000000..4490abae42
--- /dev/null
+++ b/web_src/js/features/user-auth-gpg-signup.ts
@@ -0,0 +1,40 @@
+export function initGpgSignup() {
+    const btnProceed = document.getElementById('btn-proceed');
+    if (!btnProceed) return;
+
+    const nonce = (() => {
+        const arr = new Uint8Array(32);
+        crypto.getRandomValues(arr);
+        return Array.from(arr, (b) => b.toString(16).padStart(2, '0')).join('');
+    })();
+
+    btnProceed.addEventListener('click', () => {
+        const key = (document.getElementById('gpg_key') as HTMLTextAreaElement).value.trim();
+        if (!key || !key.startsWith('-----BEGIN PGP PUBLIC KEY BLOCK-----')) {
+            alert('Paste a valid armored GPG public key.');
+            return;
+        }
+        (document.getElementById('token-field') as HTMLInputElement).value = nonce;
+        (document.getElementById('hidden-nonce') as HTMLInputElement).value = nonce;
+        (document.getElementById('hidden-gpg-key') as HTMLInputElement).value = key;
+        (document.getElementById('sign-command') as HTMLInputElement).value =
+            `echo "${nonce}" | gpg --clearsign --armor`;
+        document.getElementById('step-key').style.display = 'none';
+        document.getElementById('step-sign').style.display = 'block';
+    });
+
+    document.getElementById('signup-form').addEventListener('submit', (e) => {
+        const sig = (document.getElementById('gpg_signature') as HTMLTextAreaElement).value.trim();
+        if (!sig ||
+            (!sig.startsWith('-----BEGIN PGP SIGNED MESSAGE-----') &&
+                !sig.startsWith('-----BEGIN PGP SIGNATURE-----'))) {
+            e.preventDefault();
+            alert('Paste the GPG signed output.');
+        }
+    });
+
+    document.getElementById('btn-copy-cmd').addEventListener('click', () => {
+        const cmd = (document.getElementById('sign-command') as HTMLInputElement).value;
+        navigator.clipboard.writeText(cmd);
+    });
+}
\ No newline at end of file
-- 
2.54.0


From aec5e314657562d6199e6aa74ff48a003aa7023e Mon Sep 17 00:00:00 2001
From: Danila Fominykh <d@m8sh.su>
Date: Tue, 9 Jun 2026 00:43:43 +0300
Subject: [PATCH 2/4] partially implemented frontend for GPG authorization

---
 templates/shared/user/profile_big_avatar.tmpl |  9 ++
 templates/user/auth/signin_inner.tmpl         | 93 ++++++------------
 templates/user/auth/signup_inner.tmpl         | 94 ++++++++-----------
 web_src/js/features/user-auth-gpg-signin.ts   | 31 ++++++
 web_src/js/features/user-auth-gpg-signup.ts   | 10 +-
 web_src/js/index.ts                           |  4 +
 6 files changed, 119 insertions(+), 122 deletions(-)
 create mode 100644 web_src/js/features/user-auth-gpg-signin.ts

diff --git a/templates/shared/user/profile_big_avatar.tmpl b/templates/shared/user/profile_big_avatar.tmpl
index b70013c7f0..a249d3955d 100644
--- a/templates/shared/user/profile_big_avatar.tmpl
+++ b/templates/shared/user/profile_big_avatar.tmpl
@@ -68,6 +68,7 @@
 			{{end}}
 			{{if $.RenderedDescription}}
 				<li>
+					{{svg "octicon-info"}}
 					<div class="render-content markup">{{$.RenderedDescription}}</div>
 				</li>
 			{{end}}
@@ -79,6 +80,14 @@
 					</li>
 				{{end}}
 			{{end}}
+			{{if .ContextUser.GPGKeys}}
+				{{if .GPGKeys}}
+					<li>
+						{{svg "octicon-key"}}
+						<a class="tw-font-mono tw-text-sm" href="{{AppSubUrl}}/{{$.ContextUser.Name}}.gpg" target="_blank">GPG: {{(index .GPGKeys 0).PaddedKeyID}}{{if gt (len .GPGKeys) 1}} +{{sub (len .GPGKeys) 1}}{{end}}</a>
+					</li>
+				{{end}}
+			{{end}}
 			<li>{{svg "octicon-calendar"}} <span>{{ctx.Locale.Tr "user.joined_on" (DateUtils.AbsoluteShort .ContextUser.CreatedUnix)}}</span></li>
 			{{if and .Orgs .HasOrgsVisible}}
 			<li>
diff --git a/templates/user/auth/signin_inner.tmpl b/templates/user/auth/signin_inner.tmpl
index 864e0993d6..c9eb7b993a 100644
--- a/templates/user/auth/signin_inner.tmpl
+++ b/templates/user/auth/signin_inner.tmpl
@@ -1,76 +1,45 @@
 <div class="ui container fluid">
-	{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn)}}
-	{{template "base/alert" .}}
-	{{end}}
 	<h4 class="ui top attached header center">
-		{{if .LinkAccountMode}}
-			{{ctx.Locale.Tr "auth.oauth_signin_title"}}
-		{{else}}
-			{{ctx.Locale.Tr "auth.login_userpass"}}
-		{{end}}
+		Sign In
 	</h4>
 	<div class="ui attached segment">
-		{{if .EnablePasswordSignInForm}}
-		<form class="ui form" action="{{.SignInLink}}" method="post">
-			<div class="required field {{if and (.Err_UserName) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
-				<label for="user_name">{{ctx.Locale.Tr "home.uname_holder"}}</label>
-				<input id="user_name" type="text" name="user_name" value="{{.user_name}}" autofocus required tabindex="1">
-			</div>
-			{{if or (not .DisablePassword) .LinkAccountMode}}
-			<div class="required field {{if and (.Err_Password) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
-				<div class="tw-flex tw-mb-1">
-					<label for="password" class="tw-flex-1">{{ctx.Locale.Tr "password"}}</label>
-					<a href="{{AppSubUrl}}/user/forgot_password" tabindex="4">{{ctx.Locale.Tr "auth.forgot_password"}}</a>
-				</div>
-				<input id="password" name="password" type="password" value="{{.password}}" autocomplete="current-password" required tabindex="2">
-			</div>
-			{{end}}
-			{{if not .LinkAccountMode}}
-			<div class="inline field">
-				<div class="ui checkbox">
-					<label>{{ctx.Locale.Tr "auth.remember_me"}}</label>
-					<input name="remember" type="checkbox" tabindex="5">
-				</div>
-			</div>
-			{{end}}
-
-			{{template "user/auth/captcha" .}}
+		<form class="ui form" action="{{.SignInLink}}" method="post" id="signin-form">
+			{{.CsrfTokenHtml}}
+			{{template "base/alert" .}}
+			<input type="hidden" id="hidden-nonce" name="nonce">
 
 			<div class="field">
-				<button class="ui primary button tw-w-full" tabindex="3">
-					{{if .LinkAccountMode}}
-						{{ctx.Locale.Tr "auth.oauth_signin_submit"}}
-					{{else}}
-						{{ctx.Locale.Tr "sign_in"}}
-					{{end}}
-				</button>
+				<label>Sign this nonce with your private key</label>
+				<input id="token-field" type="text" readonly style="font-family: monospace;">
+			</div>
+			<div class="ui info message">
+				<p>Run this command, then paste the output below:</p>
+				<div style="display: flex; gap: 6px;">
+					<input id="sign-command" type="text" readonly
+						style="font-family: monospace; min-width: 0; flex: 1;">
+					<button class="ui button" type="button" id="btn-copy-cmd">Copy</button>
+				</div>
+			</div>
+			<div class="required field {{if .Err_GPGSign}}error{{end}}">
+				<label for="gpg_signature">Signed output</label>
+				<textarea id="gpg_signature" name="gpg_signature" rows="7"
+					placeholder="-----BEGIN PGP SIGNED MESSAGE-----" style="font-family: monospace;"
+					required>{{.gpg_signature}}</textarea>
+			</div>
+			<div class="inline field">
+				<button class="ui primary button tw-w-full" type="submit">Sign In</button>
 			</div>
 		</form>
-		{{end}}{{/*end if .EnablePasswordSignInForm*/}}
-		{{$showExternalAuthMethods := or .OAuth2Providers .EnableOpenIDSignIn .EnableSSPI}}
-		{{if and $showExternalAuthMethods .EnablePasswordSignInForm}}
-			<div class="divider divider-text">{{ctx.Locale.Tr "sign_in_or"}}</div>
-		{{end}}
-		{{if $showExternalAuthMethods}}
-			{{template "user/auth/external_auth_methods" .}}
-		{{end}}
 	</div>
 </div>
 
-{{if or .EnablePasskeyAuth .ShowRegistrationButton}}
+{{if .ShowRegistrationButton}}
 <div class="ui container fluid">
-	<div class="ui attached segment header top tw-max-w-2xl tw-m-auto tw-flex tw-flex-col tw-items-center">
-		{{if .EnablePasskeyAuth}}
-			{{template "user/auth/webauthn_error" .}}
-			<a class="signin-passkey">{{ctx.Locale.Tr "auth.signin_passkey"}}</a>
-		{{end}}
-
-		{{if .ShowRegistrationButton}}
-			<div class="field">
-				<span>{{ctx.Locale.Tr "auth.need_account"}}</span>
-				<a href="{{AppSubUrl}}/user/sign_up">{{ctx.Locale.Tr "auth.sign_up_now"}}</a>
-			</div>
-		{{end}}
+	<div class="ui attached segment header top tw-flex tw-flex-col tw-items-center">
+		<div class="field">
+			<span>{{ctx.Locale.Tr "auth.need_account"}}</span>
+			<a href="{{AppSubUrl}}/user/sign_up">{{ctx.Locale.Tr "auth.sign_up_now"}}</a>
+		</div>
 	</div>
 </div>
-{{end}}
+{{end}}
\ No newline at end of file
diff --git a/templates/user/auth/signup_inner.tmpl b/templates/user/auth/signup_inner.tmpl
index 0c1f1a3906..f80459a8f6 100644
--- a/templates/user/auth/signup_inner.tmpl
+++ b/templates/user/auth/signup_inner.tmpl
@@ -1,70 +1,54 @@
-<div class="ui container fluid{{if .LinkAccountMode}} icon{{end}}">
+<div class="ui container fluid">
 	<h4 class="ui top attached header center">
-		{{if .LinkAccountMode}}
-			{{ctx.Locale.Tr "auth.oauth_signup_title"}}
-		{{else}}
-			{{ctx.Locale.Tr "sign_up"}}
-		{{end}}
+		Create your account
 	</h4>
 	<div class="ui attached segment">
-		{{if .IsFirstTimeRegistration}}
-			<p>{{ctx.Locale.Tr "auth.sign_up_tip"}}</p>
-		{{end}}
-		<form class="ui form" action="{{.SignUpLink}}" method="post">
-			{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeRegister)}}
-			{{template "base/alert" .}}
-			{{end}}
-			{{if .DisableRegistration}}
-				<p>{{ctx.Locale.Tr "auth.disable_register_prompt"}}</p>
-			{{else}}
-				<div class="required field {{if and (.Err_UserName) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeRegister))}}error{{end}}">
-					<label for="user_name">{{ctx.Locale.Tr "username"}}</label>
-					<input id="user_name" type="text" name="user_name" value="{{.user_name}}" autofocus required>
+		<form class="ui form" action="{{.SignUpLink}}" method="post" id="signup-form">
+			{{.CsrfTokenHtml}}
+			<input type="hidden" id="hidden-gpg-key" name="gpg_key">
+			<input type="hidden" id="hidden-nonce" name="nonce">
+
+			<div id="step-key">
+				{{template "base/alert" .}}
+				<div class="required field {{if .Err_GPGKey}}error{{end}}">
+					<label>Paste your GPG public key</label>
+					<textarea id="gpg_key" rows="7" placeholder="-----BEGIN PGP PUBLIC KEY BLOCK-----" style="font-family: monospace;" required>{{.gpg_key}}</textarea>
 				</div>
-				<div class="required field {{if .Err_Email}}error{{end}}">
-					<label for="email">{{ctx.Locale.Tr "email"}}</label>
-					<input id="email" name="email" type="email" value="{{.email}}" required>
-				</div>
-
-				{{if not .DisablePassword}}
-					<div class="required field {{if and (.Err_Password) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeRegister))}}error{{end}}">
-						<label for="password">{{ctx.Locale.Tr "password"}}</label>
-						<input id="password" name="password" type="password" value="{{.password}}" autocomplete="new-password" required>
-					</div>
-					<div class="required field {{if and (.Err_Password) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeRegister))}}error{{end}}">
-						<label for="retype">{{ctx.Locale.Tr "re_type"}}</label>
-						<input id="retype" name="retype" type="password" value="{{.retype}}" autocomplete="new-password" required>
-					</div>
-				{{end}}
-
-				{{template "user/auth/captcha" .}}
-
 				<div class="inline field">
-					<button class="ui primary button tw-w-full">
-						{{if .LinkAccountMode}}
-							{{ctx.Locale.Tr "auth.oauth_signup_submit"}}
-						{{else}}
-							{{ctx.Locale.Tr "auth.create_new_account"}}
-						{{end}}
-					</button>
+					<button class="ui primary button tw-w-full" type="button" id="btn-proceed">Proceed</button>
 				</div>
-			{{end}}
-			{{$showExternalAuthMethods := or .OAuth2Providers .EnableOpenIDSignIn .EnableSSPI}}
-			{{if $showExternalAuthMethods}}
-				<div class="divider divider-text">{{ctx.Locale.Tr "sign_in_or"}}</div>
-				{{template "user/auth/external_auth_methods" .}}
-			{{end}}
+			</div>
+
+			<div id="step-sign" style="display: none;">
+				{{template "base/alert" .}}
+				<div class="field">
+					<label>Sign this nonce with your private key</label>
+					<input id="token-field" type="text" readonly style="font-family: monospace;">
+				</div>
+				<div class="ui info message">
+					<p>Run this command, then paste the output below:</p>
+					<div style="display: flex; gap: 6px;">
+						<input id="sign-command" type="text" readonly style="font-family: monospace; min-width: 0; flex: 1;">
+						<button class="ui button" type="button" id="btn-copy-cmd">Copy</button>
+					</div>
+				</div>
+				<div class="required field {{if .Err_GPGSign}}error{{end}}">
+					<label for="gpg_signature">Signed output</label>
+					<textarea id="gpg_signature" name="gpg_signature" rows="7" placeholder="-----BEGIN PGP SIGNED MESSAGE-----" style="font-family: monospace;" required>{{.gpg_signature}}</textarea>
+				</div>
+				<div class="inline field">
+					<button class="ui primary button tw-w-full" type="submit">Verify &amp; Create Account</button>
+				</div>
+			</div>
 		</form>
 	</div>
 </div>
 
 <div class="ui container fluid">
-	{{if not .LinkAccountMode}}
 	<div class="ui attached segment header top tw-flex tw-flex-col tw-items-center">
 		<div class="field">
-			<span>{{ctx.Locale.Tr "auth.already_have_account"}}</span>
-			<a href="{{AppSubUrl}}/user/login">{{ctx.Locale.Tr "auth.sign_in_now"}}</a>
+			<span>Already have an account?</span>
+			<a href="{{AppSubUrl}}/user/login">Sign in</a>
 		</div>
 	</div>
-	{{end}}
-</div>
+</div>
\ No newline at end of file
diff --git a/web_src/js/features/user-auth-gpg-signin.ts b/web_src/js/features/user-auth-gpg-signin.ts
new file mode 100644
index 0000000000..803adca766
--- /dev/null
+++ b/web_src/js/features/user-auth-gpg-signin.ts
@@ -0,0 +1,31 @@
+export function initGpgSignin() {
+    const tokenField = document.getElementById('token-field') as HTMLInputElement;
+    if (!tokenField) return;
+
+    const nonce = (() => {
+        const arr = new Uint8Array(32);
+        crypto.getRandomValues(arr);
+        return Array.from(arr, (b) => b.toString(16).padStart(2, '0')).join('');
+    })();
+
+    tokenField.value = nonce;
+    (document.getElementById('hidden-nonce') as HTMLInputElement).value = nonce;
+    (document.getElementById('sign-command') as HTMLInputElement).value =
+        `echo "${nonce}" | gpg -a --detach-sig`;
+
+    document.getElementById('btn-copy-cmd')?.addEventListener('click', () => {
+        navigator.clipboard.writeText(
+            (document.getElementById('sign-command') as HTMLInputElement).value
+        );
+    });
+
+    document.getElementById('signin-form')?.addEventListener('submit', (e) => {
+        const sig = (document.getElementById('gpg_signature') as HTMLTextAreaElement).value.trim();
+        if (!sig ||
+            (!sig.startsWith('-----BEGIN PGP SIGNED MESSAGE-----') &&
+                !sig.startsWith('-----BEGIN PGP SIGNATURE-----'))) {
+            e.preventDefault();
+            alert('Paste the GPG signed output.');
+        }
+    });
+}
\ No newline at end of file
diff --git a/web_src/js/features/user-auth-gpg-signup.ts b/web_src/js/features/user-auth-gpg-signup.ts
index 4490abae42..3990b24bd6 100644
--- a/web_src/js/features/user-auth-gpg-signup.ts
+++ b/web_src/js/features/user-auth-gpg-signup.ts
@@ -18,12 +18,12 @@ export function initGpgSignup() {
         (document.getElementById('hidden-nonce') as HTMLInputElement).value = nonce;
         (document.getElementById('hidden-gpg-key') as HTMLInputElement).value = key;
         (document.getElementById('sign-command') as HTMLInputElement).value =
-            `echo "${nonce}" | gpg --clearsign --armor`;
-        document.getElementById('step-key').style.display = 'none';
-        document.getElementById('step-sign').style.display = 'block';
+            `echo "${nonce}" | gpg -a --detach-sig`;
+        document.getElementById('step-key')!.style.display = 'none';
+        document.getElementById('step-sign')!.style.display = 'block';
     });
 
-    document.getElementById('signup-form').addEventListener('submit', (e) => {
+    document.getElementById('signup-form')?.addEventListener('submit', (e) => {
         const sig = (document.getElementById('gpg_signature') as HTMLTextAreaElement).value.trim();
         if (!sig ||
             (!sig.startsWith('-----BEGIN PGP SIGNED MESSAGE-----') &&
@@ -33,7 +33,7 @@ export function initGpgSignup() {
         }
     });
 
-    document.getElementById('btn-copy-cmd').addEventListener('click', () => {
+    document.getElementById('btn-copy-cmd')?.addEventListener('click', () => {
         const cmd = (document.getElementById('sign-command') as HTMLInputElement).value;
         navigator.clipboard.writeText(cmd);
     });
diff --git a/web_src/js/index.ts b/web_src/js/index.ts
index a2994d6912..5ada9558e1 100644
--- a/web_src/js/index.ts
+++ b/web_src/js/index.ts
@@ -66,6 +66,8 @@ import {initActionsPermissionsForm} from './features/common-actions-permissions.
 import {initRefIssueContextPopup} from './features/ref-issue.ts';
 import {initGlobalShortcut} from './modules/shortcut.ts';
 import {initDevtest} from './modules/devtest.ts';
+import {initGpgSignup} from './features/user-auth-gpg-signup.js';
+import {initGpgSignin} from './features/user-auth-gpg-signin.js';
 
 const initStartTime = performance.now();
 const initPerformanceTracer = callInitFunctions([
@@ -84,6 +86,8 @@ const initPerformanceTracer = callInitFunctions([
   initGlobalDeleteButton,
   initGlobalInput,
   initGlobalShortcut,
+  initGpgSignup,
+  initGpgSignin,
 
   initCommonOrganization,
   initCommonIssueListQuickGoto,
-- 
2.54.0


From 19ee2a8b9720b85b5b91bf1075dda653d76eec26 Mon Sep 17 00:00:00 2001
From: Danila Fominykh <d@m8sh.su>
Date: Tue, 9 Jun 2026 00:47:10 +0300
Subject: [PATCH 3/4] Squashed commit of the following:
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 9e7667f090ea3ccfdba4c958c4782cf85ed8feb7
Merge: 9df885ceaf ee9f31e9c9
Author: Danila Fominykh <d@m8sh.su>
Date:   Mon Jun 8 21:44:41 2026 +0000

    merge upstream

commit ee9f31e9c90534fbc3be479a52236b7302ebb2e9
Author: Giteabot <teabot@gitea.io>
Date:   Mon Jun 8 12:28:45 2026 -0700

    chore(deps): update dependency @eslint/json to v2 (#38030)

    This PR contains the following updates:

    | Package | Change |
    [Age](https://docs.renovatebot.com/merge-confidence/) |
    [Confidence](https://docs.renovatebot.com/merge-confidence/) |
    |---|---|---|---|
    | [@eslint/json](https://redirect.github.com/eslint/json) | [`1.2.0` →
    `2.0.0`](https://renovatebot.com/diffs/npm/@eslint%2fjson/1.2.0/2.0.0) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint%2fjson/2.0.0?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint%2fjson/1.2.0/2.0.0?slim=true)
    |

    ---

    <details>
    <summary>eslint/json (@&#8203;eslint/json)</summary>
    [`v2.0.0`](https://redirect.github.com/eslint/json/blob/HEAD/CHANGELOG.md#200-2026-05-28)

    [Compare
    Source](https://redirect.github.com/eslint/json/compare/72eb947ec708d1326047977c165670582ce58a26...804ffc4911bf489cea025a829f65ee98c975b7ee)

    - add `meta.languages` to JSON rules
    ([#&#8203;238](https://redirect.github.com/eslint/json/issues/238))

    - add `meta.languages` to JSON rules
    ([#&#8203;238](https://redirect.github.com/eslint/json/issues/238))
    ([deff6b4](https://redirect.github.com/eslint/json/commit/deff6b472152ee16d5384fbada25c43ff699b899))

    - update eslint
    ([#&#8203;226](https://redirect.github.com/eslint/json/issues/226))
    ([237148f](https://redirect.github.com/eslint/json/commit/237148ff7692e4b5fa813dd3bb3757eaebf866e9))
    - update eslint
    ([#&#8203;228](https://redirect.github.com/eslint/json/issues/228))
    ([5803df5](https://redirect.github.com/eslint/json/commit/5803df5fd172562e10e76913370a801c55cf61d3))

    </details>

    ---

    📅 **Schedule**: (UTC)

    - Branch creation
      - Only on Monday (`* * * * 1`)
    - Automerge
      - At any time (no schedule defined)

    🚦 **Automerge**: Disabled by config. Please merge this manually once you
    are satisfied.

    ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
    rebase/retry checkbox.

    🔕 **Ignore**: Close this PR and you won't be reminded about this update
    again.

    ---

    - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
    this box

    ---

    This PR has been generated by [Mend
    Renovate](https://redirect.github.com/renovatebot/renovate).

    <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

commit 3b1e75764e7fb48f06e74c7ed5446e37bf9a6e56
Author: bircni <bircni@icloud.com>
Date:   Mon Jun 8 21:11:00 2026 +0200

    feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)

    - Add GitHub-style Actions **job summaries** support
    (`GITHUB_STEP_SUMMARY` / `workflow/SUMMARY.md`) and render them on the
    run Summary view.
    - Store uploaded summaries internally in the DB (not as downloadable
    artifacts).
    - Add runtime-token endpoint for runners to upload summaries:
    - `PUT
    /api/actions_pipeline/_apis/pipelines/workflows/{run_id}/jobs/{job_id}/summary`
    - Advertise support to runners via `RunnerService.Declare` response
    header:
      - `X-Gitea-Actions-Capabilities: job-summary`
    - Devtest: extend `/devtest/repo-action-view/...` to include mock
    `jobSummaries` for previewing UI rendering.
    - New Gitea + old runner: no summary upload → UI shows nothing (no
    behavior change)
    - New runner + old Gitea: capability not advertised → runner skips
    upload (no behavior change)

    <img width="2017" height="729"
    src="https://github.com/user-attachments/assets/31f8b945-50c4-40e1-9f40-382901a53013"
    />

    Fixes #23721
    PR on gitea-runner https://gitea.com/gitea/runner/pulls/917

    ---------

    Co-authored-by: silverwind <me@silverwind.io>
    Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>

commit b1c088e9cf3fe587633c3d3a2554fe41c7bf7f51
Author: bircni <bircni@icloud.com>
Date:   Mon Jun 8 20:49:06 2026 +0200

    enhance(actions): Make Summary UI more beautiful with more infos (#37824)

    - Redesign the Actions run summary header to follow GitHub Actions
    layout: trigger info on the left, Status / Total duration / Artifacts
    columns inline on the right
    - Expose trigger user avatar, pull request link, and PR head branch info
    from the run view API
    - Update the workflow graph header to show the workflow filename (linked
    to the run workflow file) and `on: <event>`, while keeping the
    jobs/dependencies/success stats line
    - Remove the redundant commit/workflow metadata row below the run title;
    that information now lives in the summary bar

    New:
    <img width="1564" height="639"
    src="https://github.com/user-attachments/assets/e6bc1623-c5fc-4e97-abc9-fde7f3c6aef9"
    />

    Old:
    <img width="2038" height="1038"
    src="https://github.com/user-attachments/assets/0857f19a-8d3a-4da2-82fd-e9ebeb200062"
    />

    Replaces https://github.com/go-gitea/gitea/pull/36721

    ---------

    Co-authored-by: Giteabot <teabot@gitea.io>

commit e01af366e2f7df7713f0a1448be7f2a01f90bfe8
Author: Giteabot <teabot@gitea.io>
Date:   Mon Jun 8 11:30:55 2026 -0700

    fix(deps): update npm dependencies (#38035)

    This PR contains the following updates:

    | Package | Change |
    [Age](https://docs.renovatebot.com/merge-confidence/) |
    [Confidence](https://docs.renovatebot.com/merge-confidence/) |
    |---|---|---|---|
    | @&#8203;codemirror/autocomplete | [`6.20.2` →
    `6.20.3`](https://renovatebot.com/diffs/npm/@codemirror%2fautocomplete/6.20.2/6.20.3)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/@codemirror%2fautocomplete/6.20.3?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@codemirror%2fautocomplete/6.20.2/6.20.3?slim=true)
    |
    | [eslint-plugin-vue](https://eslint.vuejs.org)
    ([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) |
    [`10.9.1` →
    `10.9.2`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.9.1/10.9.2)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-plugin-vue/10.9.2?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-plugin-vue/10.9.1/10.9.2?slim=true)
    |

    ---

    <details>
    <summary>vuejs/eslint-plugin-vue (eslint-plugin-vue)</summary>
    [`v10.9.2`](https://redirect.github.com/vuejs/eslint-plugin-vue/blob/HEAD/CHANGELOG.md#1092)

    [Compare
    Source](https://redirect.github.com/vuejs/eslint-plugin-vue/compare/v10.9.1...v10.9.2)

    - Fixed
    [`vue/custom-event-name-casing`](https://eslint.vuejs.org/rules/custom-event-name-casing.html)
    to check segments of colon-separated event names like `update:foo-bar`
    ([#&#8203;3079](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3079))
    - Fixed
    [`vue/one-component-per-file`](https://eslint.vuejs.org/rules/one-component-per-file.html)
    to not report functions not imported from Vue
    ([#&#8203;3063](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3063))
    - Fixed
    [`vue/prefer-import-from-vue`](https://eslint.vuejs.org/rules/prefer-import-from-vue.html)
    to not report imports/exports of names that are not re-exported by `vue`
    ([#&#8203;3081](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3081))
    - Fixed
    [`vue/return-in-computed-property`](https://eslint.vuejs.org/rules/return-in-computed-property.html)
    and
    [`vue/require-render-return`](https://eslint.vuejs.org/rules/require-render-return.html)
    to not report exhaustive switch statements when TypeScript type
    information is available
    ([#&#8203;3067](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3067))

    </details>

    ---

    📅 **Schedule**: (UTC)

    - Branch creation
      - Only on Monday (`* * * * 1`)
    - Automerge
      - At any time (no schedule defined)

    🚦 **Automerge**: Disabled by config. Please merge this manually once you
    are satisfied.

    ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
    rebase/retry checkbox.

    👻 **Immortal**: This PR will be recreated if closed unmerged. Get
    [config
    help](https://redirect.github.com/renovatebot/renovate/discussions) if
    that's undesired.

    ---

    - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
    this box

    ---

    This PR has been generated by [Mend
    Renovate](https://redirect.github.com/renovatebot/renovate).

    <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

commit d76a974b241cea7d9320bf0fdd4eb1c1e1271da7
Author: TheFox0x7 <thefox0x7@gmail.com>
Date:   Mon Jun 8 20:18:58 2026 +0200

    feat(ssh): auto generate additional ssh keys  (#33974)

    adds capabilities for gitea to generate ecdsa and ed25519 keys by
    default
    adds cli for built-in ssh key generation helpers

    closes: https://github.com/go-gitea/gitea/issues/33783

    ---------

    Co-authored-by: Nicolas <bircni@icloud.com>
    Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
    Co-authored-by: Giteabot <teabot@gitea.io>

commit ade76fe83868e9004be632148f7c625a91f3c1cd
Author: Nico Schlömer <nschloe@users.noreply.github.com>
Date:   Mon Jun 8 19:58:41 2026 +0200

    enhance: allow MathML core elements (#38034)

    Fixes #36352.

    ---------

    Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

commit 54916f708e77e9cfe9d2e85164e436383f5faf9a
Author: bircni <bircni@icloud.com>
Date:   Mon Jun 8 19:16:22 2026 +0200

    feat: Add avatar stacks (#37594)

    Parse `Co-authored-by:` trailers from commit messages and surface
    contributors as an avatar stack across the commit page, commits list, PR
    commits tab, latest-commit row, blame, graph, and dashboard feed.

    - Up to 10 visible 20px avatars, GitHub-style overlap (6px first stride,
    4px between subsequent), `+N` chip for the rest.
    - Label: 1 → name; 2 → `<a> and <b>`; 3+ → `<N> people` opens a Tippy
    popup with all participants.
    - Names and avatars link to the repo's commits-by-author search; fall
    back to profile or `mailto:`.
    - Trailer parsing uses `net/mail.ParseAddress`, scans only the trailing
    paragraph, filters out the commit's own author/committer.
    - Drops the non-standard `Co-committed-by:` emission on squash merge and
    web edits.

    Devtest: `/devtest/coauthor-avatars`.

    Fixes #25521

    ----
    <img width="353" height="277" alt="image"
    src="https://github.com/user-attachments/assets/72092ceb-97ca-4b09-9557-0b72d3c5458e"
    />

    <img width="533" height="328"
    src="https://github.com/user-attachments/assets/11d0c8f8-8b3f-4f2e-9993-879f1c06bcc5"
    />

    ---------

    Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
    Co-authored-by: silverwind <me@silverwind.io>
    Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
    Co-authored-by: Giteabot <teabot@gitea.io>

commit 9df885ceafb44593e3302415b96ca612dbcf0592
Merge: 7ddacf0edf 136f7d18aa
Author: Danila Fominykh <d@m8sh.su>
Date:   Mon Jun 8 17:05:31 2026 +0000

    merge upstream

commit 2a84831400aedaaa7075225928a73a822940ec8e
Author: Giteabot <teabot@gitea.io>
Date:   Mon Jun 8 09:53:12 2026 -0700

    chore(deps): update astral-sh/setup-uv action to v8.2.0 (#38036)

    This PR contains the following updates:

    | Package | Type | Update | Change |
    |---|---|---|---|
    | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
    action | minor | `v8.1.0` → `v8.2.0` |

    ---

    <details>
    <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary>
    [`v8.2.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v8.2.0):
    🌈 New inputs `quiet` and `download-from-astral-mirror`

    [Compare
    Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.1.0...v8.2.0)

    This release brings two new inputs and a few bug fixes.

    Lets talk about the new inputs first.

    Pretty simple. It turns of all `info` loggings. Useful if you use this
    in a composite action and are not interested in all the details.
    In the upcoming releases we will add log groups to fully implement
    support for "less noise"

    > \[!NOTE]\
    > Warnings and errors are always logged.

    In some cases you may want to directly use the fallback of checking for
    available versions and downloading releases from GitHub instead of using
    the astral.sh mirror. Setting `download-from-astral-mirror: false`
    allows you to do that.

    When using the astral.sh mirror to query available versions and download
    releases (done by default) we now stop sending the GitHub token in the
    header. The mirror never looked at it but we shouldn't be handing out
    that data even if it is just a short lived token.
    All other bugfixes try to limit the impact of failed GitHub queries due
    to retries and other faults.

    We couldn't pinpoint all rootcauses yet but added more logging for error
    cases to track them down.

    - fix: report unexpected cache save failures
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;896](https://redirect.github.com/astral-sh/setup-uv/issues/896))
    - fix: report unexpected setup failures
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;895](https://redirect.github.com/astral-sh/setup-uv/issues/895))
    - fix: add timeout to fetch to prevent silent hangs
    [@&#8203;eifinger-bot](https://redirect.github.com/eifinger-bot)
    ([#&#8203;883](https://redirect.github.com/astral-sh/setup-uv/issues/883))
    - Limit GitHub tokens to github.com download URLs
    [@&#8203;zsol](https://redirect.github.com/zsol)
    ([#&#8203;878](https://redirect.github.com/astral-sh/setup-uv/issues/878))
    - increase libuv-workaround timeout to 100ms
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;880](https://redirect.github.com/astral-sh/setup-uv/issues/880))

    - Add quiet input to suppress info-level log output
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;898](https://redirect.github.com/astral-sh/setup-uv/issues/898))
    - feat: add `download-from-astral-mirror` input
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;897](https://redirect.github.com/astral-sh/setup-uv/issues/897))

    - docs: update dependabot rollup biome guidance
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;902](https://redirect.github.com/astral-sh/setup-uv/issues/902))
    - chore: update known checksums for 0.11.18
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;899](https://redirect.github.com/astral-sh/setup-uv/issues/899))
    - chore: update known checksums for 0.11.17
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;892](https://redirect.github.com/astral-sh/setup-uv/issues/892))
    - chore: update known checksums for 0.11.16
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;889](https://redirect.github.com/astral-sh/setup-uv/issues/889))
    - chore: update known checksums for 0.11.15
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;885](https://redirect.github.com/astral-sh/setup-uv/issues/885))
    - chore: update known checksums for 0.11.14
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;879](https://redirect.github.com/astral-sh/setup-uv/issues/879))
    - chore: update known checksums for 0.11.13
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;877](https://redirect.github.com/astral-sh/setup-uv/issues/877))
    - chore: update known checksums for 0.11.12
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;876](https://redirect.github.com/astral-sh/setup-uv/issues/876))
    - chore: update known checksums for 0.11.11
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;873](https://redirect.github.com/astral-sh/setup-uv/issues/873))
    - chore: update known checksums for 0.11.9/0.11.10
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;871](https://redirect.github.com/astral-sh/setup-uv/issues/871))
    - chore: update known checksums for 0.11.8
    @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
    ([#&#8203;867](https://redirect.github.com/astral-sh/setup-uv/issues/867))
    - Bump setup-uv references to v8.1.0 SHA in docs
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;862](https://redirect.github.com/astral-sh/setup-uv/issues/862))
    - Add update-docs.yml workflow
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;861](https://redirect.github.com/astral-sh/setup-uv/issues/861))

    - chore(deps): roll up dependabot updates
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;903](https://redirect.github.com/astral-sh/setup-uv/issues/903))
    - chore(deps): roll up dependabot updates
    [@&#8203;eifinger](https://redirect.github.com/eifinger)
    ([#&#8203;901](https://redirect.github.com/astral-sh/setup-uv/issues/901))
    - chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;900](https://redirect.github.com/astral-sh/setup-uv/issues/900))
    - chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;842](https://redirect.github.com/astral-sh/setup-uv/issues/842))
    - chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;893](https://redirect.github.com/astral-sh/setup-uv/issues/893))
    - chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;891](https://redirect.github.com/astral-sh/setup-uv/issues/891))
    - chore(deps): bump release-drafter/release-drafter from 7.2.0 to 7.3.0
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;884](https://redirect.github.com/astral-sh/setup-uv/issues/884))
    - chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;888](https://redirect.github.com/astral-sh/setup-uv/issues/888))
    - chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;881](https://redirect.github.com/astral-sh/setup-uv/issues/881))
    - chore(deps): bump github/codeql-action from 4.32.2 to 4.35.3
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;875](https://redirect.github.com/astral-sh/setup-uv/issues/875))
    - chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;866](https://redirect.github.com/astral-sh/setup-uv/issues/866))
    - chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;864](https://redirect.github.com/astral-sh/setup-uv/issues/864))
    - chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1
    @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)
    ([#&#8203;863](https://redirect.github.com/astral-sh/setup-uv/issues/863))

    </details>

    ---

    📅 **Schedule**: (UTC)

    - Branch creation
      - Only on Monday (`* * * * 1`)
    - Automerge
      - At any time (no schedule defined)

    🚦 **Automerge**: Disabled by config. Please merge this manually once you
    are satisfied.

    ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
    rebase/retry checkbox.

    🔕 **Ignore**: Close this PR and you won't be reminded about this update
    again.

    ---

    - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
    this box

    ---

    This PR has been generated by [Mend
    Renovate](https://redirect.github.com/renovatebot/renovate).

    <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

commit 136f7d18aa0ac9fd16aa05bd6fd95589076f7d58
Author: wxiaoguang <wxiaoguang@gmail.com>
Date:   Mon Jun 8 16:58:42 2026 +0800

    fix: api error message (#38031)

    Fix various abuses and mistakes

commit 60f66a9bfdb60414ca8470b9b9a77fe56e1f2b83
Author: Zettat123 <zettat123@gmail.com>
Date:   Mon Jun 8 00:39:06 2026 -0600

    enhance(actions): improve reusable workflow `uses` handling and cancellation (#37991)

    Follow up #37478

    1. #37478 doesn't support absolute URL in `uses`. This PR provides
    partial support for URL-style reusable workflow references. A reusable
    workflow can now be referenced by an absolute URL, as long as it points
    to the local Gitea instance:

    ```yaml
    jobs:
      call:
        uses: https://your-gitea.example.com/OWNER/REPO/.gitea/workflows/ci.yaml@v1
    ```

    2. Show an error message in the UI for invalid `uses`.

    <img width="1600" alt="image"
    src="https://github.com/user-attachments/assets/21b34e61-bf10-4af1-b9fd-4ee4e9fde049"
    />

    3. Fix reusable caller cancellation issue. A reusable caller's status is
    aggregated from its children, so cancellation should processes a
    caller's descendants deepest-first.

    ---------

    Signed-off-by: Zettat123 <zettat123@gmail.com>
    Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
    Co-authored-by: bircni <bircni@icloud.com>
    Co-authored-by: Giteabot <teabot@gitea.io>

commit 1e9ea9c8f54c25bcaf34f8a14a0e00fac5c99a2d
Author: Giteabot <teabot@gitea.io>
Date:   Sun Jun 7 23:03:55 2026 -0700

    fix(deps): update npm dependencies (#38029)

    This PR contains the following updates:

    | Package | Change |
    [Age](https://docs.renovatebot.com/merge-confidence/) |
    [Confidence](https://docs.renovatebot.com/merge-confidence/) |
    |---|---|---|---|
    | [@primer/octicons](https://primer.style/octicons)
    ([source](https://redirect.github.com/primer/octicons)) | [`19.27.0` →
    `19.28.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.27.0/19.28.0)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/@primer%2focticons/19.28.0?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@primer%2focticons/19.27.0/19.28.0?slim=true)
    |
    |
    [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
    ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
    | [`8.60.0` →
    `8.60.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.60.0/8.60.1)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/@typescript-eslint%2fparser/8.60.1?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@typescript-eslint%2fparser/8.60.0/8.60.1?slim=true)
    |
    |
    [@vitest/eslint-plugin](https://redirect.github.com/vitest-dev/eslint-plugin-vitest)
    | [`1.6.18` →
    `1.6.19`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.18/1.6.19)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2feslint-plugin/1.6.19?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2feslint-plugin/1.6.18/1.6.19?slim=true)
    |
    | [eslint](https://eslint.org)
    ([source](https://redirect.github.com/eslint/eslint)) | [`10.4.0` →
    `10.4.1`](https://renovatebot.com/diffs/npm/eslint/10.4.0/10.4.1) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.4.1?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.4.0/10.4.1?slim=true)
    |
    |
    [eslint-import-resolver-typescript](https://redirect.github.com/import-js/eslint-import-resolver-typescript)
    | [`4.4.4` →
    `4.4.5`](https://renovatebot.com/diffs/npm/eslint-import-resolver-typescript/4.4.4/4.4.5)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-import-resolver-typescript/4.4.5?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-import-resolver-typescript/4.4.4/4.4.5?slim=true)
    |
    |
    [eslint-plugin-vue-scoped-css](https://future-architect.github.io/eslint-plugin-vue-scoped-css/)
    ([source](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css))
    | [`3.1.0` →
    `3.1.1`](https://renovatebot.com/diffs/npm/eslint-plugin-vue-scoped-css/3.1.0/3.1.1)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-plugin-vue-scoped-css/3.1.1?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-plugin-vue-scoped-css/3.1.0/3.1.1?slim=true)
    |
    | [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`4.1.1` →
    `4.2.0`](https://renovatebot.com/diffs/npm/js-yaml/4.1.1/4.2.0) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/js-yaml/4.2.0?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-yaml/4.1.1/4.2.0?slim=true)
    |
    | [pnpm](https://pnpm.io)
    ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
    [`11.4.0` →
    `11.5.1`](https://renovatebot.com/diffs/npm/pnpm/11.4.0/11.5.1) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.5.1?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.4.0/11.5.1?slim=true)
    |
    |
    [rolldown-license-plugin](https://redirect.github.com/silverwind/rolldown-license-plugin)
    | [`3.0.8` →
    `3.0.9`](https://renovatebot.com/diffs/npm/rolldown-license-plugin/3.0.8/3.0.9)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/rolldown-license-plugin/3.0.9?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/rolldown-license-plugin/3.0.8/3.0.9?slim=true)
    |
    |
    [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
    ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
    | [`8.60.0` →
    `8.60.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.60.0/8.60.1)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/typescript-eslint/8.60.1?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript-eslint/8.60.0/8.60.1?slim=true)
    |
    | [updates](https://redirect.github.com/silverwind/updates) | [`17.17.2`
    → `17.17.3`](https://renovatebot.com/diffs/npm/updates/17.17.2/17.17.3)
    |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/updates/17.17.3?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/updates/17.17.2/17.17.3?slim=true)
    |
    | [vite](https://vite.dev)
    ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
    | [`8.0.14` →
    `8.0.16`](https://renovatebot.com/diffs/npm/vite/8.0.14/8.0.16) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.0.16?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.0.14/8.0.16?slim=true)
    |
    | [vitest](https://vitest.dev)
    ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest))
    | [`4.1.7` →
    `4.1.8`](https://renovatebot.com/diffs/npm/vitest/4.1.7/4.1.8) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.8?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.7/4.1.8?slim=true)
    |
    | [vue-tsc](https://redirect.github.com/vuejs/language-tools)
    ([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/tsc))
    | [`3.3.2` →
    `3.3.3`](https://renovatebot.com/diffs/npm/vue-tsc/3.3.2/3.3.3) |
    ![age](https://developer.mend.io/api/mc/badges/age/npm/vue-tsc/3.3.3?slim=true)
    |
    ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue-tsc/3.3.2/3.3.3?slim=true)
    |

    ---

    <details>
    <summary>primer/octicons (@&#8203;primer/octicons)</summary>
    [`v19.28.0`](https://redirect.github.com/primer/octicons/blob/HEAD/CHANGELOG.md#19280)

    [Compare
    Source](https://redirect.github.com/primer/octicons/compare/v19.27.0...v19.28.0)

    - [#&#8203;1208](https://redirect.github.com/primer/octicons/pull/1208)
    [`eddab3ff`](https://redirect.github.com/primer/octicons/commit/eddab3ff19f1450eb1d60c78b1d20c2c4bc3fd15)
    Thanks [@&#8203;dylanatsmith](https://redirect.github.com/dylanatsmith)!
    - Fix vscode icon: update 16px, add 24px, remove 32px and 48px

    </details>

    <details>
    <summary>typescript-eslint/typescript-eslint
    (@&#8203;typescript-eslint/parser)</summary>
    [`v8.60.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8601-2026-06-01)

    [Compare
    Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.60.0...v8.60.1)

    This was a version bump only for parser to align it with other projects,
    there were no code changes.

    See [GitHub
    Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1)
    for more information.

    You can read about our [versioning
    strategy](https://typescript-eslint.io/users/versioning) and
    [releases](https://typescript-eslint.io/users/releases) on our website.

    </details>

    <details>
    <summary>vitest-dev/eslint-plugin-vitest
    (@&#8203;vitest/eslint-plugin)</summary>
    [`v1.6.19`](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/releases/tag/v1.6.19)

    [Compare
    Source](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.18...v1.6.19)

    *No significant changes*
    GitHub](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.18...v1.6.19)

    </details>

    <details>
    <summary>eslint/eslint (eslint)</summary>
    [`v10.4.1`](https://redirect.github.com/eslint/eslint/releases/tag/v10.4.1)

    [Compare
    Source](https://redirect.github.com/eslint/eslint/compare/v10.4.0...v10.4.1)

    -
    [`e557467`](https://redirect.github.com/eslint/eslint/commit/e557467db7496220eebcbe2ac5ea6d38c12bb1ec)
    fix: update `@eslint/plugin-kit` version to 0.7.2
    ([#&#8203;20930](https://redirect.github.com/eslint/eslint/issues/20930))
    (Francesco Trotta)
    -
    [`d4ce898`](https://redirect.github.com/eslint/eslint/commit/d4ce898796ca22c3b96aa70d3014cb85f4bac1cd)
    fix: propagate failures from delegated commands
    ([#&#8203;20917](https://redirect.github.com/eslint/eslint/issues/20917))
    (Minh Vu)
    -
    [`f4f3507`](https://redirect.github.com/eslint/eslint/commit/f4f3507460bc016b5be979c05d2969793f570cbf)
    fix: prefer-arrow-callback invalid autofix with newline after `async`
    ([#&#8203;20916](https://redirect.github.com/eslint/eslint/issues/20916))
    (kuldeep kumar)
    -
    [`c5bc78b`](https://redirect.github.com/eslint/eslint/commit/c5bc78b37e08b9054a11f0cc2d81808bb24acb85)
    fix: false positive for reference in `finally` block
    ([#&#8203;20655](https://redirect.github.com/eslint/eslint/issues/20655))
    (Tanuj Kanti)
    -
    [`27538c0`](https://redirect.github.com/eslint/eslint/commit/27538c01f5df4e9306f6f4ba867b2dd6307fae59)
    fix: add missing CodePath and CodePathSegment types
    ([#&#8203;20853](https://redirect.github.com/eslint/eslint/issues/20853))
    (Pixel998)

    -
    [`61b0add`](https://redirect.github.com/eslint/eslint/commit/61b0add61ffc52665562be7bb96f526690a78b30)
    docs: remove deprecated rule from related rules of `max-params`
    ([#&#8203;20921](https://redirect.github.com/eslint/eslint/issues/20921))
    (Tanuj Kanti)
    -
    [`305d5b9`](https://redirect.github.com/eslint/eslint/commit/305d5b91aeac24d36fde42f75625a8f183d4ce43)
    docs: remove deprecated rules from related rules section
    ([#&#8203;20911](https://redirect.github.com/eslint/eslint/issues/20911))
    (Tanuj Kanti)
    -
    [`49b0202`](https://redirect.github.com/eslint/eslint/commit/49b0202d01918b8061720d586dffd7c68047090c)
    docs: fix `display: none` of ad
    ([#&#8203;20901](https://redirect.github.com/eslint/eslint/issues/20901))
    (Tanuj Kanti)
    -
    [`9067f94`](https://redirect.github.com/eslint/eslint/commit/9067f9492ec998afc5b4f057a477ecf6ebd45e44)
    docs: switch build to Node.js 24
    ([#&#8203;20893](https://redirect.github.com/eslint/eslint/issues/20893))
    (Milos Djermanovic)
    -
    [`c91b041`](https://redirect.github.com/eslint/eslint/commit/c91b0417e3420c76807ce1fa2aea76e2de87ab86)
    docs: Update README (GitHub Actions Bot)
    -
    [`e349265`](https://redirect.github.com/eslint/eslint/commit/e349265cb37f3ebc837e178e48a725bb782bd870)
    docs: clarify semver strings in rule deprecation objects
    ([#&#8203;20885](https://redirect.github.com/eslint/eslint/issues/20885))
    (Milos Djermanovic)

    -
    [`b0e466b`](https://redirect.github.com/eslint/eslint/commit/b0e466b6ab47bfc7de43d8de0c315d8ee83aa584)
    test: add `data` property to invalid tests cases for rules
    ([#&#8203;20924](https://redirect.github.com/eslint/eslint/issues/20924))
    (Tanuj Kanti)
    -
    [`f78838b`](https://redirect.github.com/eslint/eslint/commit/f78838bc4c86d487e1bcc7cede260c4467721c46)
    test: add CodePath type coverage
    ([#&#8203;20904](https://redirect.github.com/eslint/eslint/issues/20904))
    (Pixel998)
    -
    [`1daa4bd`](https://redirect.github.com/eslint/eslint/commit/1daa4bd734b79a62e317d0394394a6b38cff49f9)
    chore: update `eslint-plugin-eslint-comments` test data to latest commit
    ([#&#8203;20922](https://redirect.github.com/eslint/eslint/issues/20922))
    (Francesco Trotta)
    -
    [`002942c`](https://redirect.github.com/eslint/eslint/commit/002942ce988ea28b78e0a2f3b074081e638b552c)
    ci: declare contents:read on update-readme workflow
    ([#&#8203;20919](https://redirect.github.com/eslint/eslint/issues/20919))
    (Arpit Jain)
    -
    [`64bca24`](https://redirect.github.com/eslint/eslint/commit/64bca24e7bed35bc3c864fc625cb2d89eca87d5b)
    chore: update ecosystem plugins
    ([#&#8203;20912](https://redirect.github.com/eslint/eslint/issues/20912))
    (ESLint Bot)
    -
    [`6d7c832`](https://redirect.github.com/eslint/eslint/commit/6d7c832950d5e92499d88e504080661f888f8f56)
    chore: ignore fflate updates in renovate
    ([#&#8203;20908](https://redirect.github.com/eslint/eslint/issues/20908))
    (Pixel998)
    -
    [`b2c8638`](https://redirect.github.com/eslint/eslint/commit/b2c86382164d87c6203b78d52068cd6a2a6ffe30)
    ci: bump pnpm/action-setup from 6.0.7 to 6.0.8
    ([#&#8203;20889](https://redirect.github.com/eslint/eslint/issues/20889))
    (dependabot\[bot])
    -
    [`a9b8d7f`](https://redirect.github.com/eslint/eslint/commit/a9b8d7f74c50211701cfc49710fa541fd91b2aa5)
    chore: increase maxBuffer for ecosystem tests
    ([#&#8203;20881](https://redirect.github.com/eslint/eslint/issues/20881))
    (sethamus)
    -
    [`b702ead`](https://redirect.github.com/eslint/eslint/commit/b702ead5e1ed7cb9f28238a454797662efb37396)
    chore: update ecosystem update PR settings
    ([#&#8203;20884](https://redirect.github.com/eslint/eslint/issues/20884))
    (Pixel998)
    -
    [`507f60e`](https://redirect.github.com/eslint/eslint/commit/507f60e9a78c9a902bc8759f066ae17a1ea6cd81)
    chore: update ecosystem plugins
    ([#&#8203;20882](https://redirect.github.com/eslint/eslint/issues/20882))
    (ESLint Bot)
    -
    [`92f5c5b`](https://redirect.github.com/eslint/eslint/commit/92f5c5bb6bf3a5d167c8ee53a430833410295c6d)
    test: add unit test for message-count
    ([#&#8203;20878](https://redirect.github.com/eslint/eslint/issues/20878))
    (kuldeep kumar)
    -
    [`df32108`](https://redirect.github.com/eslint/eslint/commit/df321080af5758b1fa25e4b9a40e26135642dd6e)
    chore: add
    [@&#8203;eslint/markdown](https://redirect.github.com/eslint/markdown)
    and typescript-eslint ecosystem tests
    ([#&#8203;20837](https://redirect.github.com/eslint/eslint/issues/20837))
    (sethamus)
    -
    [`327f91d`](https://redirect.github.com/eslint/eslint/commit/327f91d36aa49f2a50ded931d841a16374fd875f)
    chore: use includeIgnoreFile internally
    ([#&#8203;20876](https://redirect.github.com/eslint/eslint/issues/20876))
    (Kirk Waiblinger)
    -
    [`f0dc4bd`](https://redirect.github.com/eslint/eslint/commit/f0dc4bd893fb3a9f44e4ddc3ad7063ffb0beacd3)
    chore: pin fflate\@&#8203;0.8.2
    ([#&#8203;20877](https://redirect.github.com/eslint/eslint/issues/20877))
    (Milos Djermanovic)
    -
    [`0f4bd25`](https://redirect.github.com/eslint/eslint/commit/0f4bd257a67a082b756de746d9e0c4842ab764ca)
    ci: run Discord alert for ecosystem test failures
    ([#&#8203;20873](https://redirect.github.com/eslint/eslint/issues/20873))
    (Copilot)

    </details>

    <details>
    <summary>import-js/eslint-import-resolver-typescript
    (eslint-import-resolver-typescript)</summary>
    [`v4.4.5`](https://redirect.github.com/import-js/eslint-import-resolver-typescript/blob/HEAD/CHANGELOG.md#445)

    [Compare
    Source](https://redirect.github.com/import-js/eslint-import-resolver-typescript/compare/v4.4.4...v4.4.5)

    -
    [#&#8203;473](https://redirect.github.com/import-js/eslint-import-resolver-typescript/pull/473)
    [`32c61ab`](https://redirect.github.com/import-js/eslint-import-resolver-typescript/commit/32c61abccf26bd2a2267f2e0e67d82e6f88d149a)
    Thanks [@&#8203;leey0818](https://redirect.github.com/leey0818)! - fix:
    check tsconfig matching before using resolver

    </details>

    <details>
    <summary>future-architect/eslint-plugin-vue-scoped-css
    (eslint-plugin-vue-scoped-css)</summary>
    [`v3.1.1`](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css/blob/HEAD/CHANGELOG.md#311)

    [Compare
    Source](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css/compare/v3.1.0...v3.1.1)

    - Fix false positives in `vue-scoped-css/require-selector-used-inside`
    for selectors that start with ignored pseudo-classes such as
    `:has(...)`.
    ([#&#8203;496](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css/pull/496))

    </details>

    <details>
    <summary>nodeca/js-yaml (js-yaml)</summary>
    [`v4.2.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#420---2026-06-01)

    [Compare
    Source](https://redirect.github.com/nodeca/js-yaml/compare/4.1.1...590dbabadd172b099c07654fab2eabec8c7a07b9)

    - Added `docs/safety.md` with notes about processing untrusted YAML.
    - Added `maxDepth` (100) loader option. Not a problem, but gives a
    better
      exception instead of RangeError on stack overflow.
    - Added `maxMergeSeqLength` (20) loader option. Not a problem after
    `merge` fix,
      but an additional restriction for safety.
    - Added sourcemaps to `dist/` builds.

    - Stop resolving numbers with underscores as numeric scalars,
    [#&#8203;627](https://redirect.github.com/nodeca/js-yaml/issues/627).
    - Switched dev toolchains to Vite / neostandard.
    - Updated demo.
    - Reorganized tests.
    - `dist/` files are no longer kept in the repository.

    - Fix parsing of properties on the first implicit block mapping key,
    [#&#8203;62](https://redirect.github.com/nodeca/js-yaml/issues/62).
    - Fix trailing whitespace handling when folding flow scalar lines,
    [#&#8203;307](https://redirect.github.com/nodeca/js-yaml/issues/307).
    - Reject top-level block scalars without content indentation,
    [#&#8203;280](https://redirect.github.com/nodeca/js-yaml/issues/280).
    - Ensure numbers survive round-trip,
    [#&#8203;737](https://redirect.github.com/nodeca/js-yaml/issues/737).
    - Fix test coverage for issue
    [#&#8203;221](https://redirect.github.com/nodeca/js-yaml/issues/221).
    - Fix flow scalar trailing whitespace folding,
    [#&#8203;307](https://redirect.github.com/nodeca/js-yaml/issues/307).
    - Fix digits in YAML named tag handles.

    - Fix potential DoS via quadratic complexity in merge - deduplicate
    repeated
      elements (makes sense for malformed files > 10K).

    </details>

    <details>
    <summary>pnpm/pnpm (pnpm)</summary>
    [`v11.5.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1151)

    [Compare
    Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.0...v11.5.1)

    - Improve `pnpm audit` performance by pruning non-vulnerable lockfile
    subtrees and stopping path enumeration once vulnerable findings reach
    the path cap.
    - Avoid crashing when the workspace state cache is partially written or
    malformed.
    - Set `npm_config_user_agent` for root lifecycle scripts during headless
    installs.
    - Preserve the `integrity` field of a remote (non-registry) tarball
    dependency when its lockfile entry is rebuilt. Re-resolving such a
    dependency without re-fetching it (for example via `pnpm update`, or
    when another dependency changes) produced a resolution with no integrity
    — URL/tarball resolvers only learn the integrity after the tarball is
    downloaded — so the previously recorded integrity was dropped, making
    later installs fail with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`
    [#&#8203;12067](https://redirect.github.com/pnpm/pnpm/issues/12067).
    - Normalize a string `repository` field into the `{ type, url }` object
    form when creating the publish manifest, matching npm's behavior. Some
    registries (e.g. Gitea/Codeberg) reject a string `repository` with a 500
    Internal Server Error during `pnpm publish`
    [#&#8203;12099](https://redirect.github.com/pnpm/pnpm/issues/12099).
    - Preserve compatible optional peer versions already present in the
    lockfile when resolving dependencies.
    - Fixed inconsistent resolution of a peer dependency that is shared
    through a diamond. When a package peer-depends on both another package
    and one of that package's own peer dependencies (for example
    `@typescript-eslint/eslint-plugin` peer-depends on both
    `@typescript-eslint/parser` and `typescript`, and
    `@typescript-eslint/parser` peer-depends on `typescript`), pnpm no
    longer reuses a hoisted instance of the shared peer that was resolved
    against a different version
    [#&#8203;12079](https://redirect.github.com/pnpm/pnpm/issues/12079).
    [`v11.5.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1150)

    [Compare
    Source](https://redirect.github.com/pnpm/pnpm/compare/v11.4.0...v11.5.0)

    - Added a new `hoistingLimits` setting for `nodeLinker: hoisted`
    installs, mirroring yarn's `nmHoistingLimits`. It accepts `none` (the
    default — hoist as far as possible), `workspaces` (hoist only as far as
    each workspace package), or `dependencies` (hoist only up to each
    workspace package's direct dependencies). Originally proposed in
    [#&#8203;6468](https://redirect.github.com/pnpm/pnpm/pull/6468), closing
    [#&#8203;6457](https://redirect.github.com/pnpm/pnpm/issues/6457).

    - Replaced `enquirer` with `@inquirer/prompts` for all interactive
    prompts. Fixes the `update -i` scrolling overflow bug where long choice
    lists were clipped in the terminal
    [#&#8203;6643](https://redirect.github.com/pnpm/pnpm/issues/6643).

      **User-facing changes:**

    - `pnpm update -i` / `pnpm update -i --latest`: Scrolling now works
    correctly when many packages are available; the new library uses
    visual-line-aware pagination via `usePagination`
    - `pnpm audit --fix -i`: Same scrolling fix for vulnerability selection
      - `pnpm approve-builds`: Interactive build approval prompts updated
      - `pnpm patch`: Version selection and "apply to all" prompts updated
      - `pnpm patch-remove`: Patch removal selection updated
      - `pnpm publish`: Branch confirmation prompt updated
      - `pnpm login`: Credential prompts updated
    - `pnpm run` / `pnpm exec` (with `verifyDepsBeforeRun=prompt`):
    Confirmation prompt updated

    Vim-style `j`/`k` keys still work for up/down navigation in all
    interactive prompts.

    **Internal:** The `OtpEnquirer` and `LoginEnquirer` DI interfaces
    changed from `{ prompt }` to `{ input }` / `{ input, password }`
    respectively. Plugins or custom builds that inject their own enquirer
    mock will need to update.

    - Staged publishes are now recognized in the trust scale. When a package
    version's registry metadata carries an `approver` field, it is treated
    as the strongest trust evidence (ranked above trusted publishers and
    provenance attestations), since staged publishes require 2FA publish
    approvals. This prevents false-positive trust downgrade errors when
    moving from a staged publish to a lower trust level
    [#&#8203;11887](https://redirect.github.com/pnpm/pnpm/issues/11887).

    - Fix pnpm hanging during peer resolution when an aliased install pulls
    in transitive packages with mutual peer cycles at different depths in
    the dependency tree (for example, `pnpm i nuxt@npm:nuxt-nightly@5x`).
    Cycles whose members hit the `findHit` cache instead of running their
    own `calculateDepPath` are now short-circuited by sibling resolutions at
    the level where the cycle is detected, so the cached path promises no
    longer deadlock.
    [#&#8203;11999](https://redirect.github.com/pnpm/pnpm/issues/11999).
    - Fix `pnpm dist-tag add` and `pnpm dist-tag rm` against npmjs.org
    failing without `--otp` with `[ERR_PNPM_UNAUTHORIZED] You must be logged
    in to set dist-tag … "You must provide a one-time pass. Upgrade your
    client to npm@latest in order to use 2FA."`. pnpm now sends
    `npm-auth-type: web` on dist-tag writes and surfaces the resulting OTP
    challenge through the existing browser-based 2FA flow (the same
    `withOtpHandling` helper used by `pnpm publish`), so the browser opens,
    the user authenticates, and the dist-tag is set on retry. `--otp=<code>`
    continues to work via the classic flow.
    - Fix `minimumReleaseAgeExclude` handling in npm resolution fast paths
    so excluded packages do not get pinned to stale versions. Excludes are
    honored consistently during `publishedBy` metadata selection and
    cache-mtime shortcuts.
    - Fix the `integrity` field being dropped from the lockfile entry of a
    remote (non-registry) https-tarball dependency when an unrelated package
    is installed afterwards. URL/tarball resolvers do not return an
    integrity (it is only known after the tarball is downloaded), so when
    such a dependency was reused from the lockfile without being re-fetched,
    its integrity was lost. It is now carried over from the existing
    resolution. With pnpm's lockfile-integrity hardening, the missing
    integrity made subsequent `--frozen-lockfile` installs fail with
    `ERR_PNPM_MISSING_TARBALL_INTEGRITY`.
    [#&#8203;12001](https://redirect.github.com/pnpm/pnpm/issues/12001).
    - Skip dependency re-resolution when `pnpm-lock.yaml` is missing but
    `node_modules/.pnpm/lock.yaml` exists and still satisfies the manifest.
    `pnpm install` now reuses the materialized snapshot to regenerate
    `pnpm-lock.yaml` instead of walking the registry to rebuild it from
    scratch, turning the cache+node\_modules variation into a near-no-op for
    users who deleted the lockfile but kept the install
    [#&#8203;11993](https://redirect.github.com/pnpm/pnpm/issues/11993).

    `--frozen-lockfile` still refuses to proceed when `pnpm-lock.yaml` is
    absent — the regenerated lockfile must be committed, so failing loudly
    is the correct behavior for CI.

    </details>

    <details>
    <summary>silverwind/rolldown-license-plugin
    (rolldown-license-plugin)</summary>
    [`v3.0.9`](https://redirect.github.com/silverwind/rolldown-license-plugin/releases/tag/3.0.9)

    [Compare
    Source](https://redirect.github.com/silverwind/rolldown-license-plugin/compare/3.0.8...3.0.9)

    - update deps (silverwind)
    - make: collapse patch/minor/major into one rule (silverwind)
    - simplify generateBundle: pair dir+raw, rename shadow, inline
    single-use const (silverwind)
    - make update a combination target, split out update-js (silverwind)
    - add update-actions make target (silverwind)
    - remove authorship attribution rule from AGENTS.md (silverwind)
    - docs: use defineConfig in README usage example (silverwind)

    </details>

    <details>
    <summary>typescript-eslint/typescript-eslint
    (typescript-eslint)</summary>
    [`v8.60.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8601-2026-06-01)

    [Compare
    Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.60.0...v8.60.1)

    This was a version bump only for typescript-eslint to align it with
    other projects, there were no code changes.

    See [GitHub
    Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1)
    for more information.

    You can read about our [versioning
    strategy](https://typescript-eslint.io/users/versioning) and
    [releases](https://typescript-eslint.io/users/releases) on our website.

    </details>

    <details>
    <summary>silverwind/updates (updates)</summary>
    [`v17.17.3`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.3)

    [Compare
    Source](https://redirect.github.com/silverwind/updates/compare/17.17.2...17.17.3)

    - fix prerelease drop in updateVersionRange and scope regex (silverwind)
    - fix 1.2.x ranges, docker tag corruption, and per-file cooldown
    (silverwind)
    - fix go +incompatible, cargo inline-table, and prerelease selection
    (silverwind)
    - fix --pin range parsing, url tag deps, and -s flag docs (silverwind)
    - make update a combination target, split out update-js (silverwind)
    - add update-actions make target (silverwind)
    - remove authorship attribution rule from AGENTS.md (silverwind)

    </details>

    <details>
    <summary>vitejs/vite (vite)</summary>
    [`v8.0.16`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8016-2026-06-01-small)

    [Compare
    Source](https://redirect.github.com/vitejs/vite/compare/v8.0.15...v8.0.16)

    - **deps:** reject UNC paths for launch-editor-middleware
    ([#&#8203;22571](https://redirect.github.com/vitejs/vite/issues/22571))
    ([50b9512](https://redirect.github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9))
    - reject windows alternate paths
    ([#&#8203;22572](https://redirect.github.com/vitejs/vite/issues/22572))
    ([dc245c7](https://redirect.github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546))
    [`v8.0.15`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8015-2026-06-01-small)

    [Compare
    Source](https://redirect.github.com/vitejs/vite/compare/v8.0.14...v8.0.15)

    - send 408 on request timeout
    ([#&#8203;22476](https://redirect.github.com/vitejs/vite/issues/22476))
    ([c85c9ee](https://redirect.github.com/vitejs/vite/commit/c85c9eeb9aaf41f477b48b057146887bd5620797))
    - update rolldown to 1.0.3
    ([#&#8203;22538](https://redirect.github.com/vitejs/vite/issues/22538))
    ([646dbed](https://redirect.github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575))

    - capitalize error messages and remove spurious space in parse error
    ([#&#8203;22488](https://redirect.github.com/vitejs/vite/issues/22488))
    ([85a0eff](https://redirect.github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3))
    - **deps:** update all non-major dependencies
    ([#&#8203;22511](https://redirect.github.com/vitejs/vite/issues/22511))
    ([2686d7d](https://redirect.github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa))
    - **dev:** fix html-proxy cache key mismatch for /@&#8203;fs/ HTML paths
    ([#&#8203;21762](https://redirect.github.com/vitejs/vite/issues/21762))
    ([47c4213](https://redirect.github.com/vitejs/vite/commit/47c4213f134f562c41ed7c031e4788510cf7e31e))
    - **glob:** error on relative glob in virtual module when no files match
    ([#&#8203;22497](https://redirect.github.com/vitejs/vite/issues/22497))
    ([5c8e98f](https://redirect.github.com/vitejs/vite/commit/5c8e98f8b584ac5d42f0f9b8580c49792213b13c))
    - **optimizer:** close the rolldown bundle when write() rejects
    ([#&#8203;22528](https://redirect.github.com/vitejs/vite/issues/22528))
    ([e3cfb9d](https://redirect.github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815))
    - **resolve:** provide onWarn for viteResolvePlugin in JS plugin
    containers
    ([#&#8203;22509](https://redirect.github.com/vitejs/vite/issues/22509))
    ([40985f1](https://redirect.github.com/vitejs/vite/commit/40985f1c09b7696e594e6c5695fbc315d2da2c83))

    - **deps:** update rolldown-related dependencies
    ([#&#8203;22566](https://redirect.github.com/vitejs/vite/issues/22566))
    ([3052a67](https://redirect.github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd))

    - correct logic in `collectAllModules` function
    ([#&#8203;22562](https://redirect.github.com/vitejs/vite/issues/22562))
    ([6978a9c](https://redirect.github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c))

    </details>

    <details>
    <summary>vitest-dev/vitest (vitest)</summary>
    [`v4.1.8`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.8)

    [Compare
    Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8)

    - **browser**:
    - Disable client `cdp` API when `allowWrite/allowExec: false` \[backport
    to v4]  -  by [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa)
    and **Codex** in
    [#&#8203;10450](https://redirect.github.com/vitest-dev/vitest/issues/10450)
    [<samp>(e4067)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e4067b3b1)
    - Remove orphaned Playwright route when same module is mocked via
    multiple ids \[backport to v4]  -  by
    [@&#8203;toxik](https://redirect.github.com/toxik) and
    [@&#8203;Zelys-DFKH](https://redirect.github.com/Zelys-DFKH) in
    [#&#8203;10474](https://redirect.github.com/vitest-dev/vitest/issues/10474)
    [<samp>(675b4)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/675b4343f)
    GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8)

    </details>

    <details>
    <summary>vuejs/language-tools (vue-tsc)</summary>
    [`v3.3.3`](https://redirect.github.com/vuejs/language-tools/blob/HEAD/CHANGELOG.md#333-2026-05-30)

    [Compare
    Source](https://redirect.github.com/vuejs/language-tools/compare/v3.3.2...v3.3.3)

    - **fix:** prevent grammar scopes leakage in capitalized tags
    ([#&#8203;6073](https://redirect.github.com/vuejs/language-tools/issues/6073))
    - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)!
    - **fix:** preserve TS auto imports behavior in Vue files
    ([#&#8203;6072](https://redirect.github.com/vuejs/language-tools/issues/6072))
    - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)!

    - **fix:** read PR title from env in `auto-version` workflow to prevent
    injection
    ([#&#8203;6074](https://redirect.github.com/vuejs/language-tools/issues/6074))
    - Thanks to
    [@&#8203;arpitjain099](https://redirect.github.com/arpitjain099)!

    </details>

    ---

    📅 **Schedule**: (UTC)

    - Branch creation
      - Only on Monday (`* * * * 1`)
    - Automerge
      - At any time (no schedule defined)

    🚦 **Automerge**: Disabled by config. Please merge this manually once you
    are satisfied.

    ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
    rebase/retry checkbox.

    👻 **Immortal**: This PR will be recreated if closed unmerged. Get
    [config
    help](https://redirect.github.com/renovatebot/renovate/discussions) if
    that's undesired.

    ---

    - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
    this box

    ---

    This PR has been generated by [Mend
    Renovate](https://redirect.github.com/renovatebot/renovate).

    <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

    Co-authored-by: bircni <bircni@icloud.com>

commit 6dcae57b54c4e8197185c4675a09cfc8acf58bac
Author: Giteabot <teabot@gitea.io>
Date:   Sun Jun 7 22:40:35 2026 -0700

    chore(deps): update action dependencies (#38027)

commit 7ddacf0edf212ac94b17b80eecdc563172c143c0
Merge: e395dcec67 1c289df6eb
Author: Danila Fominykh <d@m8sh.su>
Date:   Sun Jun 7 19:30:42 2026 +0000

    merge upstream

commit e395dcec67188e990f190e0a0d015c8d88402073
Author: Danila Fominykh <d@m8sh.su>
Date:   Sun Jun 7 19:26:38 2026 +0000

    Add roadmap to readme (#2)

    Reviewed-on: https://m8sh.su/x/m8sh/pulls/2

commit 1c289df6eb13a5acbb7345c0e61fbf7b8e749ba3
Author: bircni <bircni@icloud.com>
Date:   Sun Jun 7 18:45:20 2026 +0200

    enhance: Adjust Workflow Graph styling (#37497)

    - Fix workflow dependency graph overflow by making the graph container
    scrollable (no more clipped DAGs; addresses #37493).
    - Improve Actions job list readability by keeping durations
    fixed-width/right-aligned so long times don’t squeeze job names.
    - Make workflow graph layout more intuitive by vertically centering
    shorter columns to reduce misleading “looks like it depends on”
    alignments (addresses #37395).
    <img width="966" height="439"
    src="https://github.com/user-attachments/assets/c180c5a2-4f56-4287-bcaa-f2735ba72949"
    />

    <img width="949" height="559"
    src="https://github.com/user-attachments/assets/a383511d-a962-4920-b792-69f556847eff"
    />

    Fixes #37493
    Fixes #37395

    ---------

    Co-authored-by: silverwind <me@silverwind.io>
    Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
    Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

commit ea35af1b68d57522c7686618bd61d3216d91589f
Author: bircni <bircni@icloud.com>
Date:   Sun Jun 7 17:30:18 2026 +0200

    fix: bound CODEOWNERS regex match time (#38011)

    User-supplied CODEOWNERS patterns were compiled without a match timeout,
    so a crafted pattern (e.g. (a+)+) against a crafted file path could
    backtrack for tens of seconds inside the PR creation transaction and
    exhaust the database connection pool. Set MatchTimeout on each compiled
    rule; the caller already treats match errors as non-matches.

    ---------

    Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
    Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
---
 .github/workflows/pull-compliance.yml         |   2 +-
 cmd/generate.go                               |  76 ++++++
 cmd/helper.go                                 |  17 +-
 cmd/mailer.go                                 |   8 +-
 models/actions/run_job_summary.go             | 207 +++++++++++++++
 models/asymkey/gpg_key_commit_verification.go |   5 +-
 models/gituser/avatar_stack.go                |  44 ++++
 models/gituser/gituser.go                     |  64 +++++
 models/migrations/migrations.go               |   1 +
 models/migrations/v1_27/v336.go               |  30 +++
 models/user/user.go                           |  38 +--
 modules/consts/asymkey.go                     |  12 +
 modules/generate/generate.go                  |  80 ++++++
 modules/git/commit.go                         |  32 ---
 modules/git/commit_message.go                 | 131 ++++++++++
 modules/git/commit_message_test.go            |  80 ++++++
 modules/git/commit_test.go                    |   9 -
 modules/markup/sanitizer_default.go           |  32 +++
 modules/markup/sanitizer_default_test.go      |   5 +-
 modules/repository/commits.go                 |  27 +-
 modules/repository/commits_test.go            |  34 ---
 modules/setting/config/value.go               |   5 +
 modules/setting/ssh.go                        |   5 +-
 modules/ssh/ssh.go                            |  99 ++++----
 modules/ssh/ssh_test.go                       | 123 +++++++++
 modules/templates/util_render.go              | 139 ++++++++++-
 modules/templates/util_render_test.go         |  53 ++++
 options/locale/locale_en-US.json              |  13 +-
 package.json                                  |   6 +-
 pnpm-lock.yaml                                | 143 ++++-------
 routers/api/actions/artifacts.go              |   3 +
 routers/api/actions/job_summary.go            | 104 ++++++++
 routers/api/actions/runner/runner.go          |   8 +-
 routers/web/devtest/devtest.go                |  84 +++++--
 routers/web/devtest/mock_actions.go           |  59 +++--
 routers/web/repo/actions/view.go              | 235 +++++++++++++++---
 routers/web/repo/actions/view_test.go         |  62 +++++
 routers/web/repo/blame.go                     |  35 ++-
 routers/web/repo/commit.go                    |  10 +-
 routers/web/repo/compare.go                   |   4 +-
 routers/web/repo/compare_test.go              |   6 +-
 routers/web/repo/view.go                      |   6 +-
 routers/web/repo/wiki.go                      |   2 +-
 services/actions/cleanup.go                   |   4 +
 services/git/commit.go                        |  19 +-
 services/issue/comments.go                    |   2 +-
 services/pull/merge_squash.go                 |   4 +-
 services/pull/pull.go                         |   2 +-
 services/repository/delete.go                 |   1 +
 services/repository/files/temp_repo.go        |   7 +-
 services/repository/gitgraph/graph_models.go  |  55 ++--
 templates/devtest/avatar-stack.tmpl           |  18 ++
 templates/devtest/badge-commit-sign.tmpl      |   2 +-
 templates/repo/actions/view_component.tmpl    |   5 +
 templates/repo/blame.tmpl                     |   2 +-
 templates/repo/commit_page.tmpl               |  23 ++
 templates/repo/commit_sign_badge.tmpl         |   4 +-
 templates/repo/commits_list.tmpl              |  50 ++--
 templates/repo/commits_list_small.tmpl        |  25 +-
 templates/repo/graph/commits.tmpl             |   9 +-
 templates/repo/latest_commit.tmpl             |  10 +-
 templates/user/dashboard/feeds.tmpl           |   6 +-
 tests/integration/actions_route_test.go       |  37 ++-
 .../integration/api_actions_artifact_test.go  | 145 +++++++++++
 .../git_helper_for_declarative_test.go        |   3 +-
 tests/integration/repo_commits_test.go        |  16 +-
 web_src/css/avatar.css                        | 125 ++++++++++
 web_src/css/base.css                          |   8 -
 web_src/css/index.css                         |   1 +
 web_src/css/repo.css                          |  12 +-
 .../js/components/ActionRunSummaryView.vue    | 206 +++++++++++++--
 web_src/js/components/ActionRunView.ts        |   3 +
 web_src/js/components/RepoActionView.vue      | 168 +++++++++----
 web_src/js/components/WorkflowGraph.vue       |  39 ++-
 web_src/js/features/repo-actions.ts           |   5 +
 web_src/js/features/repo-commit.ts            |  16 ++
 web_src/js/index.ts                           |   3 +-
 web_src/js/modules/gitea-actions.ts           |  13 +
 web_src/js/svg.ts                             |   2 +
 79 files changed, 2562 insertions(+), 626 deletions(-)
 create mode 100644 models/actions/run_job_summary.go
 create mode 100644 models/gituser/avatar_stack.go
 create mode 100644 models/gituser/gituser.go
 create mode 100644 models/migrations/v1_27/v336.go
 create mode 100644 modules/consts/asymkey.go
 create mode 100644 modules/git/commit_message.go
 create mode 100644 modules/git/commit_message_test.go
 create mode 100644 modules/ssh/ssh_test.go
 create mode 100644 routers/api/actions/job_summary.go
 create mode 100644 templates/devtest/avatar-stack.tmpl
 create mode 100644 web_src/css/avatar.css

diff --git a/.github/workflows/pull-compliance.yml b/.github/workflows/pull-compliance.yml
index 6c41b6b4c1..d8129fd5b7 100644
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -42,7 +42,7 @@ jobs:
       - run: make lint-spell
 
       - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           python-version: 3.14
       - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
diff --git a/cmd/generate.go b/cmd/generate.go
index 01be73c2d1..239b75ba9c 100644
--- a/cmd/generate.go
+++ b/cmd/generate.go
@@ -6,10 +6,12 @@ package cmd
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 
 	"gitea.dev/modules/generate"
+	"gitea.dev/modules/ssh"
 
 	"github.com/mattn/go-isatty"
 	"github.com/urfave/cli/v3"
@@ -21,6 +23,7 @@ func newGenerateCommand() *cli.Command {
 		Usage: "Generate Gitea's secrets/keys/tokens",
 		Commands: []*cli.Command{
 			newGenerateSecretCommand(),
+			newGenerateSSHCommand(),
 		},
 	}
 }
@@ -37,6 +40,17 @@ func newGenerateSecretCommand() *cli.Command {
 	}
 }
 
+func newGenerateSSHCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "ssh",
+		Usage: "Generate ssh keys",
+		Commands: []*cli.Command{
+			newGenerateSSHKeyCommand(),
+			newGenerateSSHHostKeysCommand(),
+		},
+	}
+}
+
 func newGenerateInternalTokenCommand() *cli.Command {
 	return &cli.Command{
 		Name:   "INTERNAL_TOKEN",
@@ -62,6 +76,30 @@ func newGenerateSecretKeyCommand() *cli.Command {
 	}
 }
 
+func newGenerateSSHKeyCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "key",
+		Usage: "Generate a new ssh key",
+		Flags: []cli.Flag{
+			&cli.IntFlag{Name: "bits", Aliases: []string{"b"}, Usage: "Number of bits in the key, ignored when key is ed25519"},
+			&cli.StringFlag{Name: "type", Aliases: []string{"t"}, Value: "ed25519", Usage: "Specifies the type of key to create."},
+			&cli.StringFlag{Name: "file", Aliases: []string{"f"}, Usage: "Specifies the path or base directory for the key file", Required: true},
+		},
+		Action: runGenerateKeyPair,
+	}
+}
+
+func newGenerateSSHHostKeysCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "host-keys",
+		Usage: "Generate host keys of all default key types (rsa, ecdsa, and ed25519) if they do not already exist.",
+		Flags: []cli.Flag{
+			&cli.StringFlag{Name: "dir", Aliases: []string{"d"}, Usage: "Specifies the base directory for the key files", Required: true},
+		},
+		Action: runGenerateHostKey,
+	}
+}
+
 func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 	internalToken, err := generate.NewInternalToken()
 	if err != nil {
@@ -103,3 +141,41 @@ func runGenerateSecretKey(_ context.Context, c *cli.Command) error {
 
 	return nil
 }
+
+func runGenerateHostKey(_ context.Context, c *cli.Command) error {
+	file := c.String("dir")
+	info, err := os.Stat(file)
+	if errors.Is(err, os.ErrNotExist) {
+		if err = os.MkdirAll(file, 0o644); err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	} else if !info.IsDir() {
+		return errors.New("file already exists and is not a directory")
+	}
+	fmt.Fprintf(c.Writer, "Generating host keys in %s\n", file)
+	_, err = ssh.InitDefaultHostKeys(file)
+	return err
+}
+
+func runGenerateKeyPair(_ context.Context, c *cli.Command) error {
+	file := c.String("file")
+	keyType := c.String("type")
+
+	fmt.Fprintf(c.Writer, "Generating public/private %s key pair.\n", keyType)
+
+	// Check if file exists to prevent overwriting
+	if _, err := os.Stat(file); err == nil {
+		if !confirm(c.Reader, c.Writer, "%s already exists.\nOverwrite (y/n)? ", file) {
+			fmt.Println("Aborting")
+			return nil
+		}
+	}
+	bits := c.Int("bits")
+	err := ssh.GenKeyPair(file, generate.SSHKeyType(keyType), bits)
+	if err == nil {
+		fmt.Printf("Your SSH key has been saved in %s\n", file)
+	}
+	return err
+}
diff --git a/cmd/helper.go b/cmd/helper.go
index 9150e1c233..37b2010437 100644
--- a/cmd/helper.go
+++ b/cmd/helper.go
@@ -38,22 +38,15 @@ func argsSet(c *cli.Command, args ...string) error {
 }
 
 // confirm waits for user input which confirms an action
-func confirm() (bool, error) {
+func confirm(stdin io.Reader, stdout io.Writer, msg string, args ...any) bool {
 	var response string
-
-	_, err := fmt.Scanln(&response)
-	if err != nil {
-		return false, err
-	}
-
+	_, _ = fmt.Fprintf(stdout, msg, args...)
+	_, _ = fmt.Fscanln(stdin, &response)
 	switch strings.ToLower(response) {
 	case "y", "yes":
-		return true, nil
-	case "n", "no":
-		return false, nil
-	default:
-		return false, errors.New(response + " isn't a correct confirmation string")
+		return true
 	}
+	return false
 }
 
 func initDB(ctx context.Context) error {
diff --git a/cmd/mailer.go b/cmd/mailer.go
index 61bd66c963..d7b2f6b7bb 100644
--- a/cmd/mailer.go
+++ b/cmd/mailer.go
@@ -22,14 +22,10 @@ func runSendMail(ctx context.Context, c *cli.Command) error {
 
 	if !confirmSkipped {
 		if len(body) == 0 {
-			fmt.Print("warning: Content is empty")
+			fmt.Println("warning: Content is empty")
 		}
 
-		fmt.Print("Proceed with sending email? [Y/n] ")
-		isConfirmed, err := confirm()
-		if err != nil {
-			return err
-		} else if !isConfirmed {
+		if !confirm(c.Reader, c.Writer, "Proceed with sending email? [Y/n] ") {
 			fmt.Println("The mail was not sent")
 			return nil
 		}
diff --git a/models/actions/run_job_summary.go b/models/actions/run_job_summary.go
new file mode 100644
index 0000000000..63e913c7bb
--- /dev/null
+++ b/models/actions/run_job_summary.go
@@ -0,0 +1,207 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+)
+
+const (
+	// JobSummaryCapability is the runner-declare capability string for job summaries.
+	JobSummaryCapability = "job-summary"
+
+	// JobSummaryContentTypeMarkdown is the only accepted content type for job summaries.
+	JobSummaryContentTypeMarkdown = "text/markdown"
+
+	// MaxJobSummarySize is the maximum accepted per-step summary payload size in bytes.
+	MaxJobSummarySize = 1024 * 1024 // 1 MiB
+
+	// MaxJobSummaryAggregateSize is the maximum aggregate size of all step summaries within
+	// a single job attempt. Matches GitHub's documented per-job summary cap of 1 MiB.
+	MaxJobSummaryAggregateSize = 1024 * 1024 // 1 MiB
+)
+
+// RunnerCapabilities returns the value advertised in the X-Gitea-Actions-Capabilities header.
+// When more capabilities are added, return them comma-separated so runners can split on ", ".
+func RunnerCapabilities() string {
+	return JobSummaryCapability
+}
+
+type ActionRunJobSummary struct {
+	ID int64 `xorm:"pk autoincr"`
+
+	RepoID       int64 `xorm:"UNIQUE(summary_key)"`
+	RunID        int64 `xorm:"UNIQUE(summary_key)"`
+	RunAttemptID int64 `xorm:"UNIQUE(summary_key) NOT NULL DEFAULT 0"`
+	JobID        int64 `xorm:"UNIQUE(summary_key)"`
+	StepIndex    int64 `xorm:"UNIQUE(summary_key)"`
+
+	Content     string `xorm:"LONGTEXT"`
+	ContentType string `xorm:"VARCHAR(255) NOT NULL DEFAULT 'text/markdown'"`
+	// ContentSize is the byte length of Content. Stored explicitly because LENGTH()
+	// counts characters (not bytes) on PostgreSQL, SQLite and MSSQL, which would let
+	// multibyte UTF-8 content bypass the aggregate cap.
+	ContentSize int64 `xorm:"NOT NULL DEFAULT 0"`
+
+	Created timeutil.TimeStamp `xorm:"created"`
+	Updated timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(ActionRunJobSummary))
+}
+
+func GetActionRunJobSummary(ctx context.Context, repoID, runID, runAttemptID, jobID, stepIndex int64) (*ActionRunJobSummary, error) {
+	var s ActionRunJobSummary
+	has, err := db.GetEngine(ctx).
+		Where("repo_id=? AND run_id=? AND run_attempt_id=? AND job_id=? AND step_index=?", repoID, runID, runAttemptID, jobID, stepIndex).
+		Get(&s)
+	if err != nil {
+		return nil, err
+	}
+	if !has {
+		return nil, util.ErrNotExist
+	}
+	return &s, nil
+}
+
+// ErrJobSummaryAggregateExceeded is returned when a step summary upload would push the
+// aggregate size of summaries for a single job attempt over MaxJobSummaryAggregateSize.
+var ErrJobSummaryAggregateExceeded = util.NewInvalidArgumentErrorf("job summary aggregate size exceeded")
+
+func UpsertActionRunJobSummary(ctx context.Context, repoID, runID, runAttemptID, jobID, stepIndex int64, contentType string, content []byte) error {
+	if runID <= 0 || jobID <= 0 || repoID <= 0 || stepIndex < 0 {
+		return util.ErrInvalidArgument
+	}
+	if len(content) == 0 {
+		// Treat empty summaries as no-op; runner may create SUMMARY.md but never write to it.
+		return nil
+	}
+	if len(content) > MaxJobSummarySize {
+		return util.ErrInvalidArgument
+	}
+	if contentType != JobSummaryContentTypeMarkdown {
+		return util.ErrInvalidArgument
+	}
+
+	// The aggregate check is best-effort: a tx wouldn't actually serialize concurrent
+	// step uploads (no row-level lock on the parent job), so wrapping these two
+	// statements only adds round-trip cost without changing the race semantics.
+	// The current step is excluded because the upsert below replaces its size with len(content).
+	otherSize, err := sumOtherJobSummarySizes(ctx, repoID, runID, runAttemptID, jobID, stepIndex)
+	if err != nil {
+		return err
+	}
+	if otherSize+int64(len(content)) > MaxJobSummaryAggregateSize {
+		return ErrJobSummaryAggregateExceeded
+	}
+
+	now := timeutil.TimeStampNow()
+	return upsertActionRunJobSummary(ctx, &ActionRunJobSummary{
+		RepoID:       repoID,
+		RunID:        runID,
+		RunAttemptID: runAttemptID,
+		JobID:        jobID,
+		StepIndex:    stepIndex,
+		Content:      string(content),
+		ContentSize:  int64(len(content)),
+		ContentType:  contentType,
+		Created:      now,
+		Updated:      now,
+	})
+}
+
+// sumOtherJobSummarySizes returns the total stored size of all step summaries for a job
+// except excludeStepIndex, computed in the database to avoid loading every row.
+func sumOtherJobSummarySizes(ctx context.Context, repoID, runID, runAttemptID, jobID, excludeStepIndex int64) (int64, error) {
+	return db.GetEngine(ctx).
+		Where("repo_id=? AND run_id=? AND run_attempt_id=? AND job_id=? AND step_index<>?", repoID, runID, runAttemptID, jobID, excludeStepIndex).
+		SumInt(new(ActionRunJobSummary), "content_size")
+}
+
+// DeleteActionRunJobSummary removes the stored summary for a specific step. Used when
+// a runner PUTs an empty body to clear a previously-uploaded step summary.
+func DeleteActionRunJobSummary(ctx context.Context, repoID, runID, runAttemptID, jobID, stepIndex int64) error {
+	_, err := db.GetEngine(ctx).
+		Where("repo_id=? AND run_id=? AND run_attempt_id=? AND job_id=? AND step_index=?", repoID, runID, runAttemptID, jobID, stepIndex).
+		Delete(new(ActionRunJobSummary))
+	return err
+}
+
+func upsertActionRunJobSummary(ctx context.Context, summary *ActionRunJobSummary) error {
+	engine := db.GetEngine(ctx)
+	columns := "`repo_id`, `run_id`, `run_attempt_id`, `job_id`, `step_index`, `content`, `content_type`, `content_size`, `created`, `updated`"
+	values := []any{
+		summary.RepoID,
+		summary.RunID,
+		summary.RunAttemptID,
+		summary.JobID,
+		summary.StepIndex,
+		summary.Content,
+		summary.ContentType,
+		summary.ContentSize,
+		summary.Created,
+		summary.Updated,
+	}
+
+	if setting.Database.Type.IsPostgreSQL() || setting.Database.Type.IsSQLite3() {
+		args := append([]any{"INSERT INTO `action_run_job_summary` (" + columns + ") VALUES (?,?,?,?,?,?,?,?,?,?) " +
+			"ON CONFLICT (`repo_id`, `run_id`, `run_attempt_id`, `job_id`, `step_index`) DO UPDATE SET " +
+			"`content` = excluded.`content`, `content_type` = excluded.`content_type`, `content_size` = excluded.`content_size`, `updated` = excluded.`updated`"}, values...)
+		_, err := engine.Exec(args...)
+		return err
+	}
+
+	if setting.Database.Type.IsMySQL() {
+		args := append([]any{
+			"INSERT INTO `action_run_job_summary` (" + columns + ") VALUES (?,?,?,?,?,?,?,?,?,?) " +
+				"ON DUPLICATE KEY UPDATE `content` = VALUES(`content`), `content_type` = VALUES(`content_type`), `content_size` = VALUES(`content_size`), `updated` = VALUES(`updated`)",
+		}, values...)
+		_, err := engine.Exec(args...)
+		return err
+	}
+
+	if setting.Database.Type.IsMSSQL() {
+		_, err := engine.Exec(`
+MERGE INTO action_run_job_summary WITH (HOLDLOCK) AS target
+USING (SELECT ? AS repo_id, ? AS run_id, ? AS run_attempt_id, ? AS job_id, ? AS step_index) AS source
+ON target.repo_id = source.repo_id
+	AND target.run_id = source.run_id
+	AND target.run_attempt_id = source.run_attempt_id
+	AND target.job_id = source.job_id
+	AND target.step_index = source.step_index
+WHEN MATCHED THEN
+	UPDATE SET content = ?, content_type = ?, content_size = ?, updated = ?
+WHEN NOT MATCHED THEN
+	INSERT (repo_id, run_id, run_attempt_id, job_id, step_index, content, content_type, content_size, created, updated)
+	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
+`,
+			summary.RepoID, summary.RunID, summary.RunAttemptID, summary.JobID, summary.StepIndex,
+			summary.Content, summary.ContentType, summary.ContentSize, summary.Updated,
+			summary.RepoID, summary.RunID, summary.RunAttemptID, summary.JobID, summary.StepIndex, summary.Content, summary.ContentType, summary.ContentSize, summary.Created, summary.Updated)
+		return err
+	}
+
+	return util.ErrInvalidArgument
+}
+
+// ListActionRunJobSummaries lists the stored summaries for a run attempt, ordered by job
+// then step. A positive jobID scopes the lookup to that single job, used by the job view to
+// avoid rendering every job's summary on each poll; jobID<=0 returns all jobs in the attempt.
+func ListActionRunJobSummaries(ctx context.Context, repoID, runID, runAttemptID, jobID int64) ([]*ActionRunJobSummary, error) {
+	sess := db.GetEngine(ctx).Where("repo_id=? AND run_id=? AND run_attempt_id=?", repoID, runID, runAttemptID)
+	if jobID > 0 {
+		sess = sess.And("job_id=?", jobID)
+	}
+	var summaries []*ActionRunJobSummary
+	if err := sess.OrderBy("job_id ASC, step_index ASC").Find(&summaries); err != nil {
+		return nil, err
+	}
+	return summaries, nil
+}
diff --git a/models/asymkey/gpg_key_commit_verification.go b/models/asymkey/gpg_key_commit_verification.go
index 17244076dd..251d8eff11 100644
--- a/models/asymkey/gpg_key_commit_verification.go
+++ b/models/asymkey/gpg_key_commit_verification.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"hash"
 
+	"gitea.dev/models/gituser"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/log"
@@ -32,8 +33,8 @@ type CommitVerification struct {
 
 // SignCommit represents a commit with validation of signature.
 type SignCommit struct {
-	Verification *CommitVerification
-	*user_model.UserCommit
+	Verification        *CommitVerification
+	*gituser.UserCommit // TODO: need to use a explicit field name, avoid anonymous field
 }
 
 const (
diff --git a/models/gituser/avatar_stack.go b/models/gituser/avatar_stack.go
new file mode 100644
index 0000000000..d38c94bc7b
--- /dev/null
+++ b/models/gituser/avatar_stack.go
@@ -0,0 +1,44 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package gituser
+
+import (
+	"context"
+
+	"gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+)
+
+// AvatarStackData is the view-model for the AvatarStack render helpers. Participants[0] is
+// the primary participant (commit author), painted on top; the rest follow.
+type AvatarStackData struct {
+	Participants      []*CommitParticipant
+	SearchByEmailLink string
+}
+
+func BuildAvatarStackData(ctx context.Context, allParticipants []*git.CommitIdentity, emailUserMap *user.EmailUserMap) *AvatarStackData {
+	if emailUserMap == nil {
+		emails := make([]string, len(allParticipants))
+		for i, sig := range allParticipants {
+			emails[i] = sig.Email
+		}
+		var err error
+		emailUserMap, err = user.GetUsersByEmails(ctx, emails)
+		if err != nil {
+			log.Error("GetUsersByEmails failed: %v", err)
+		}
+	}
+	ret := &AvatarStackData{
+		Participants: make([]*CommitParticipant, 0, len(allParticipants)),
+	}
+	for _, p := range allParticipants {
+		var giteaUser *user.User
+		if emailUserMap != nil {
+			giteaUser = emailUserMap.GetByEmail(p.Email)
+		}
+		ret.Participants = append(ret.Participants, &CommitParticipant{GiteaUser: giteaUser, GitIdentity: p})
+	}
+	return ret
+}
diff --git a/models/gituser/gituser.go b/models/gituser/gituser.go
new file mode 100644
index 0000000000..81a94a3a85
--- /dev/null
+++ b/models/gituser/gituser.go
@@ -0,0 +1,64 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package gituser
+
+import (
+	"context"
+	"net/url"
+
+	"gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+)
+
+// CommitParticipant is one participant of a commit (its author or a co-author):
+// a git identity, optionally matched to a Gitea user.
+type CommitParticipant struct {
+	GitIdentity *git.CommitIdentity // git identity (name/email), never nil
+	GiteaUser   *user.User          // matched Gitea user, nil if unmatched
+}
+
+// UserCommit represents a commit with matched of database "author" user.
+type UserCommit struct {
+	GitCommit       *git.Commit
+	AuthorUser      *user.User
+	AvatarStackData *AvatarStackData
+}
+
+func RepoCommitSearchByEmailLink(repoLink string, ref git.RefName) string {
+	if curRefWebLinkPath := ref.RefWebLinkPath(); curRefWebLinkPath != "" {
+		return repoLink + "/commits/" + curRefWebLinkPath + "/search?q=" + url.QueryEscape("author:") + "{email}"
+	}
+	return ""
+}
+
+// GetUserCommitsByGitCommits checks if authors' e-mails of commits are corresponding to users.
+func GetUserCommitsByGitCommits(ctx context.Context, gitCommits []*git.Commit, repoLink string, currentRef git.RefName) ([]*UserCommit, error) {
+	userCommits := make([]*UserCommit, 0, len(gitCommits))
+	emailSet := make(container.Set[string])
+	for _, c := range gitCommits {
+		emailSet.Add(c.Author.Email)
+		emailSet.Add(c.Committer.Email)
+		for _, p := range c.AllParticipantIdentities() {
+			emailSet.Add(p.Email)
+		}
+	}
+
+	emailUserMap, err := user.GetUsersByEmails(ctx, emailSet.Values())
+	if err != nil {
+		return nil, err
+	}
+
+	searchByEmailLink := RepoCommitSearchByEmailLink(repoLink, currentRef)
+	for _, c := range gitCommits {
+		uc := &UserCommit{
+			AuthorUser:      emailUserMap.GetByEmail(c.Author.Email), // FIXME: why GetUserCommitsByGitCommits uses "Author", but ParseCommitsWithSignature uses "Committer"?
+			GitCommit:       c,
+			AvatarStackData: BuildAvatarStackData(ctx, c.AllParticipantIdentities(), emailUserMap),
+		}
+		uc.AvatarStackData.SearchByEmailLink = searchByEmailLink
+		userCommits = append(userCommits, uc)
+	}
+	return userCommits, nil
+}
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
index 904a3ffa20..aedd679c57 100644
--- a/models/migrations/migrations.go
+++ b/models/migrations/migrations.go
@@ -413,6 +413,7 @@ func prepareMigrationTasks() []*migration {
 		newMigration(333, "Add bypass allowlist to branch protection", v1_27.AddBranchProtectionBypassAllowlist),
 		newMigration(334, "Add cancelling support to action runners", v1_27.AddCancellingSupportToActionRunner),
 		newMigration(335, "Add reusable workflow fields and action_run_attempt_job_id_index table for ActionRunJob", v1_27.AddReusableWorkflowFieldsToActionRunJob),
+		newMigration(336, "Add ActionRunJobSummary table", v1_27.AddActionRunJobSummaryTable),
 	}
 	return preparedMigrations
 }
diff --git a/models/migrations/v1_27/v336.go b/models/migrations/v1_27/v336.go
new file mode 100644
index 0000000000..9c5e0c9494
--- /dev/null
+++ b/models/migrations/v1_27/v336.go
@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+)
+
+func AddActionRunJobSummaryTable(x db.EngineMigration) error {
+	type ActionRunJobSummary struct {
+		ID int64 `xorm:"pk autoincr"`
+
+		RepoID       int64 `xorm:"UNIQUE(summary_key)"`
+		RunID        int64 `xorm:"UNIQUE(summary_key)"`
+		RunAttemptID int64 `xorm:"UNIQUE(summary_key) NOT NULL DEFAULT 0"`
+		JobID        int64 `xorm:"UNIQUE(summary_key)"`
+		StepIndex    int64 `xorm:"UNIQUE(summary_key)"`
+
+		Content     string `xorm:"LONGTEXT"`
+		ContentType string `xorm:"VARCHAR(255) NOT NULL DEFAULT 'text/markdown'"`
+		ContentSize int64  `xorm:"NOT NULL DEFAULT 0"`
+
+		Created timeutil.TimeStamp `xorm:"created"`
+		Updated timeutil.TimeStamp `xorm:"updated"`
+	}
+
+	return x.Sync(new(ActionRunJobSummary))
+}
diff --git a/models/user/user.go b/models/user/user.go
index 66e8d49b42..4e6227de9e 100644
--- a/models/user/user.go
+++ b/models/user/user.go
@@ -1148,14 +1148,7 @@ func GetUsersBySource(ctx context.Context, s *auth.Source) ([]*User, error) {
 	return users, err
 }
 
-// UserCommit represents a commit with validation of user.
-type UserCommit struct { //revive:disable-line:exported
-	User *User
-	*git.Commit
-}
-
-// ValidateCommitWithEmail check if author's e-mail of commit is corresponding to a user.
-func ValidateCommitWithEmail(ctx context.Context, c *git.Commit) *User {
+func GetUserByGitAuthor(ctx context.Context, c *git.Commit) *User {
 	if c.Author == nil {
 		return nil
 	}
@@ -1166,33 +1159,6 @@ func ValidateCommitWithEmail(ctx context.Context, c *git.Commit) *User {
 	return u
 }
 
-// ValidateCommitsWithEmails checks if authors' e-mails of commits are corresponding to users.
-func ValidateCommitsWithEmails(ctx context.Context, oldCommits []*git.Commit) ([]*UserCommit, error) {
-	var (
-		newCommits = make([]*UserCommit, 0, len(oldCommits))
-		emailSet   = make(container.Set[string])
-	)
-	for _, c := range oldCommits {
-		if c.Author != nil {
-			emailSet.Add(c.Author.Email)
-		}
-	}
-
-	emailUserMap, err := GetUsersByEmails(ctx, emailSet.Values())
-	if err != nil {
-		return nil, err
-	}
-
-	for _, c := range oldCommits {
-		user := emailUserMap.GetByEmail(c.Author.Email) // FIXME: why ValidateCommitsWithEmails uses "Author", but ParseCommitsWithSignature uses "Committer"?
-		newCommits = append(newCommits, &UserCommit{
-			User:   user,
-			Commit: c,
-		})
-	}
-	return newCommits, nil
-}
-
 type EmailUserMap struct {
 	m map[string]*User
 }
@@ -1203,7 +1169,7 @@ func (eum *EmailUserMap) GetByEmail(email string) *User {
 
 func GetUsersByEmails(ctx context.Context, emails []string) (*EmailUserMap, error) {
 	if len(emails) == 0 {
-		return nil, nil //nolint:nilnil // return nil when there are no emails to look up
+		return &EmailUserMap{}, nil
 	}
 
 	needCheckEmails := make(container.Set[string])
diff --git a/modules/consts/asymkey.go b/modules/consts/asymkey.go
new file mode 100644
index 0000000000..d6f19b2c53
--- /dev/null
+++ b/modules/consts/asymkey.go
@@ -0,0 +1,12 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package consts
+
+const (
+	AsymKeyMinBitsRsa = 3071 // 3072-1 to tolerate the leading zero
+	AsymKeyMinBitsEC  = 256
+
+	AsymKeyDefaultBitsRsa   = 4096 // ssh-keygen command defaults to 3072
+	AsymKeyDefaultBitsEcdsa = 256
+)
diff --git a/modules/generate/generate.go b/modules/generate/generate.go
index f2a5b366d8..ca132e0756 100644
--- a/modules/generate/generate.go
+++ b/modules/generate/generate.go
@@ -5,15 +5,23 @@
 package generate
 
 import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
 	"encoding/base64"
+	"encoding/pem"
 	"fmt"
 	"io"
 	"time"
 
+	"gitea.dev/modules/consts"
 	"gitea.dev/modules/util"
 
 	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/ssh"
 )
 
 // NewInternalToken generate a new value intended to be used by INTERNAL_TOKEN.
@@ -67,3 +75,75 @@ func NewJwtSecretWithBase64() ([]byte, string) {
 func NewSecretKey() (string, error) {
 	return util.CryptoRandomString(64), nil
 }
+
+type SSHKeyType string
+
+const (
+	SSHKeyRSA     SSHKeyType = "rsa"
+	SSHKeyECDSA   SSHKeyType = "ecdsa"
+	SSHKeyED25519 SSHKeyType = "ed25519"
+)
+
+func NewSSHKey(keyType SSHKeyType, bits int) (ssh.PublicKey, *pem.Block, error) {
+	pub, priv, err := commonKeyGen(keyType, bits)
+	if err != nil {
+		return nil, nil, err
+	}
+	pemPriv, err := ssh.MarshalPrivateKey(priv, "")
+	if err != nil {
+		return nil, nil, err
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return sshPub, pemPriv, nil
+}
+
+// commonKeyGen is an abstraction over rsa, ecdsa, and ed25519 generating functions
+func commonKeyGen(keyType SSHKeyType, bits int) (crypto.PublicKey, crypto.PrivateKey, error) {
+	switch keyType {
+	case SSHKeyRSA:
+		bits = util.IfZero(bits, consts.AsymKeyDefaultBitsRsa)
+		if bits < consts.AsymKeyMinBitsRsa {
+			return nil, nil, util.NewInvalidArgumentErrorf("invalid rsa bits: %d", bits)
+		}
+		privateKey, err := rsa.GenerateKey(rand.Reader, bits)
+		if err != nil {
+			return nil, nil, err
+		}
+		return &privateKey.PublicKey, privateKey, nil
+	case SSHKeyED25519:
+		return ed25519.GenerateKey(rand.Reader)
+	case SSHKeyECDSA:
+		bits = util.IfZero(bits, consts.AsymKeyDefaultBitsEcdsa)
+		if bits < consts.AsymKeyMinBitsEC {
+			return nil, nil, util.NewInvalidArgumentErrorf("invalid elliptic-curve bits: %d", bits)
+		}
+		curve, err := getEllipticCurve(bits)
+		if err != nil {
+			return nil, nil, err
+		}
+		privateKey, err := ecdsa.GenerateKey(curve, rand.Reader)
+		if err != nil {
+			return nil, nil, err
+		}
+		return &privateKey.PublicKey, privateKey, nil
+	default:
+		return nil, nil, util.NewInvalidArgumentErrorf("unknown key type: %s", keyType)
+	}
+}
+
+func getEllipticCurve(bits int) (elliptic.Curve, error) {
+	switch bits {
+	case 256:
+		return elliptic.P256(), nil
+	case 384:
+		return elliptic.P384(), nil
+	case 521:
+		return elliptic.P521(), nil
+	default:
+		return nil, util.NewInvalidArgumentErrorf("unsupported elliptic-curve bits: %d", bits)
+	}
+}
diff --git a/modules/git/commit.go b/modules/git/commit.go
index 0231770a29..21288ad845 100644
--- a/modules/git/commit.go
+++ b/modules/git/commit.go
@@ -11,18 +11,10 @@ import (
 	"os/exec"
 	"strings"
 
-	"gitea.dev/modules/charset"
 	"gitea.dev/modules/git/gitcmd"
 	"gitea.dev/modules/util"
 )
 
-type CommitMessage struct {
-	MessageRaw   string
-	messageUTF8  *string
-	messageTitle *string
-	messageBody  *string
-}
-
 // Commit represents a git commit.
 type Commit struct {
 	Tree // FIXME: bad design, this field can be nil if the commit is from "last commit cache"
@@ -44,30 +36,6 @@ type CommitSignature struct {
 	Payload   string
 }
 
-func (c *CommitMessage) MessageUTF8() string {
-	if c.messageUTF8 == nil {
-		bs := charset.ToUTF8(util.UnsafeStringToBytes(c.MessageRaw), charset.ConvertOpts{ErrorReplacement: []byte{'?'}})
-		c.messageUTF8 = new(util.UnsafeBytesToString(bs))
-	}
-	return *c.messageUTF8
-}
-
-func (c *CommitMessage) MessageTitle() string {
-	if c.messageTitle == nil {
-		s, _, _ := strings.Cut(strings.TrimSpace(c.MessageUTF8()), "\n")
-		c.messageTitle = new(strings.TrimSpace(s))
-	}
-	return *c.messageTitle
-}
-
-func (c *CommitMessage) MessageBody() string {
-	if c.messageBody == nil {
-		_, s, _ := strings.Cut(strings.TrimSpace(c.MessageUTF8()), "\n")
-		c.messageBody = new(strings.TrimSpace(s))
-	}
-	return *c.messageBody
-}
-
 // ParentID returns oid of n-th parent (0-based index).
 // It returns nil if no such parent exists.
 func (c *Commit) ParentID(n int) (ObjectID, error) {
diff --git a/modules/git/commit_message.go b/modules/git/commit_message.go
new file mode 100644
index 0000000000..8fd3601f0d
--- /dev/null
+++ b/modules/git/commit_message.go
@@ -0,0 +1,131 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"net/mail"
+	"regexp"
+	"strings"
+	"sync"
+
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/util"
+)
+
+// CoAuthoredByTrailer is the canonical token for the `Co-authored-by:` git trailer.
+const CoAuthoredByTrailer = "Co-authored-by"
+
+type CommitIdentity struct {
+	Name  string
+	Email string
+}
+
+// CommitMessageTrailerValues keys are all in lower-case
+type CommitMessageTrailerValues map[string][]string
+
+type CommitMessage struct {
+	MessageRaw   string
+	messageUTF8  *string
+	messageTitle *string
+	messageBody  *string
+
+	trailerValues CommitMessageTrailerValues
+
+	allParticipants []*CommitIdentity
+}
+
+func (c *CommitMessage) MessageUTF8() string {
+	if c.messageUTF8 == nil {
+		bs := charset.ToUTF8(util.UnsafeStringToBytes(c.MessageRaw), charset.ConvertOpts{ErrorReplacement: []byte{'?'}})
+		c.messageUTF8 = new(util.UnsafeBytesToString(bs))
+	}
+	return *c.messageUTF8
+}
+
+func (c *CommitMessage) MessageTitle() string {
+	if c.messageTitle == nil {
+		s, _, _ := strings.Cut(strings.TrimSpace(c.MessageUTF8()), "\n")
+		c.messageTitle = new(strings.TrimSpace(s))
+	}
+	return *c.messageTitle
+}
+
+func (c *CommitMessage) MessageBody() string {
+	if c.messageBody == nil {
+		_, s, _ := strings.Cut(strings.TrimSpace(c.MessageUTF8()), "\n")
+		c.messageBody = new(strings.TrimSpace(s))
+	}
+	return *c.messageBody
+}
+
+func (c *CommitMessage) MessageTrailer() CommitMessageTrailerValues {
+	if c.trailerValues == nil {
+		_, _, trailer := CommitMessageSplitTrailer(c.MessageUTF8())
+		c.trailerValues = CommitMessageParseTrailer(trailer)
+	}
+	return c.trailerValues
+}
+
+var commitMessageTrailerSplit = sync.OnceValue(func() *regexp.Regexp {
+	// the sep is either something like "\n---\n" or "\n\n" in the body, or at the start of the body like "---\n"
+	return regexp.MustCompile(`(?s)^(?P<content>.*?)(?P<sep>^|^\n|^-{3,}\n|\n-{3,}\n|\n\n)(?P<trailer>(?:[A-Za-z0-9][-A-Za-z0-9]*:[^\n]*\n?)*)$`)
+})
+
+func CommitMessageSplitTrailer(s string) (content, sep, trailer string) {
+	s = util.NormalizeStringEOL(s)
+	re := commitMessageTrailerSplit()
+	v := re.FindStringSubmatch(s)
+	if v == nil {
+		return s, "", ""
+	}
+	return v[re.SubexpIndex("content")], v[re.SubexpIndex("sep")], v[re.SubexpIndex("trailer")]
+}
+
+func CommitMessageParseTrailer(s string) CommitMessageTrailerValues {
+	ret := CommitMessageTrailerValues{}
+	for line := range strings.SplitSeq(util.NormalizeStringEOL(s), "\n") {
+		k, v, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		k, v = strings.TrimSpace(k), strings.TrimSpace(v)
+		kLower := strings.ToLower(k)
+		ret[kLower] = append(ret[kLower], v)
+	}
+	return ret
+}
+
+// AllParticipantIdentities returns all the participants in the commit, the first one is the commit's author
+func (c *Commit) AllParticipantIdentities() []*CommitIdentity {
+	if c.allParticipants != nil {
+		return c.allParticipants
+	}
+
+	exclude := container.Set[string]{}
+	c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: c.Author.Name, Email: c.Author.Email})
+	exclude.Add(strings.ToLower(c.Author.Email))
+
+	addParticipant := func(name, email string) {
+		if name == "" && email == "" {
+			return
+		}
+		emailLower := strings.ToLower(email)
+		if emailLower != "" && exclude.Contains(emailLower) {
+			return
+		}
+		c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: name, Email: email})
+		exclude.Add(emailLower)
+	}
+	addParticipant(c.Committer.Name, c.Committer.Email)
+	for _, coAuthorValue := range c.MessageTrailer()["co-authored-by"] {
+		addr, err := mail.ParseAddress(coAuthorValue)
+		if err == nil {
+			addParticipant(addr.Name, addr.Address)
+		} else {
+			addParticipant(coAuthorValue, "")
+		}
+	}
+	return c.allParticipants
+}
diff --git a/modules/git/commit_message_test.go b/modules/git/commit_message_test.go
new file mode 100644
index 0000000000..049f1c03f7
--- /dev/null
+++ b/modules/git/commit_message_test.go
@@ -0,0 +1,80 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCommitMessageSanitizesInvalidUTF8(t *testing.T) {
+	commit := &Commit{
+		CommitMessage: CommitMessage{MessageRaw: "title \xff\n\n\n\nbody \xff\n\n\n"},
+	}
+	assert.Equal(t, "title ÿ", commit.MessageTitle())
+	assert.Equal(t, "body ÿ", commit.MessageBody())
+	assert.Equal(t, "title ÿ\n\n\n\nbody ÿ\n\n\n", commit.MessageUTF8())
+}
+
+func TestCommitMessageTrailer(t *testing.T) {
+	cases := []struct {
+		msg, body, sep, trailer string
+	}{
+		{"", "", "", ""},
+		{"a", "a", "", ""},
+		{"a\n\nk", "a\n\nk", "", ""},
+		{"a\n\nk:v", "a", "\n\n", "k:v"},
+		{"a\n--\nk:v", "a\n--\nk:v", "", ""},
+		{"a\n---\nk:v", "a", "\n---\n", "k:v"},
+
+		{"k: v", "", "", "k: v"},
+		{"\nk:v", "", "\n", "k:v"},
+		{"\n\nk:v", "", "\n\n", "k:v"},
+
+		{"---\nk:v", "", "---\n", "k:v"},
+		{"\n---\nk:v", "", "\n---\n", "k:v"},
+		{"a:b\n---\nk:v", "a:b", "\n---\n", "k:v"},
+	}
+	for _, c := range cases {
+		body, sep, trailer := CommitMessageSplitTrailer(c.msg)
+		assert.Equal(t, c.body, body, "input=%q", c.msg)
+		assert.Equal(t, c.sep, sep, "input=%q", c.msg)
+		assert.Equal(t, c.trailer, trailer, "input=%q", c.msg)
+	}
+}
+
+func TestCommitMessageAllParticipantIdentities(t *testing.T) {
+	sig := func(n, e string) *Signature { return &Signature{Name: n, Email: e} }
+	idt := func(n, e string) *CommitIdentity { return &CommitIdentity{Name: n, Email: e} }
+	cases := []struct {
+		commit      *Commit
+		participant []*CommitIdentity
+	}{
+		{
+			&Commit{
+				Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
+				CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: x@m.com"},
+			},
+			[]*CommitIdentity{idt("a", "a@m.com"), idt("c", "c@m.com"), idt("", "x@m.com")},
+		},
+		{
+			&Commit{
+				Author: sig("a", "a@m.com"), Committer: sig("a", "A@M.com"),
+				CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: a@m.com"},
+			},
+			[]*CommitIdentity{idt("a", "a@m.com")},
+		},
+		{
+			&Commit{
+				Author: sig("a", "a@m.com"), Committer: sig("", ""),
+				CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: Full Name <X@M.com>"},
+			},
+			[]*CommitIdentity{idt("a", "a@m.com"), idt("Full Name", "X@M.com")},
+		},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.participant, c.commit.AllParticipantIdentities())
+	}
+}
diff --git a/modules/git/commit_test.go b/modules/git/commit_test.go
index a7668e4deb..5e3d2fba71 100644
--- a/modules/git/commit_test.go
+++ b/modules/git/commit_test.go
@@ -159,15 +159,6 @@ ISO-8859-1`, commitFromReader.Signature.Payload)
 	assert.Equal(t, commitFromReader, commitFromReader2)
 }
 
-func TestCommitMessageSanitizesInvalidUTF8(t *testing.T) {
-	commit := &Commit{
-		CommitMessage: CommitMessage{MessageRaw: "title \xff\n\n\n\nbody \xff\n\n\n"},
-	}
-	assert.Equal(t, "title ÿ", commit.MessageTitle())
-	assert.Equal(t, "body ÿ", commit.MessageBody())
-	assert.Equal(t, "title ÿ\n\n\n\nbody ÿ\n\n\n", commit.MessageUTF8())
-}
-
 func TestHasPreviousCommit(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 
diff --git a/modules/markup/sanitizer_default.go b/modules/markup/sanitizer_default.go
index e38852a3d5..9c7259dc8c 100644
--- a/modules/markup/sanitizer_default.go
+++ b/modules/markup/sanitizer_default.go
@@ -63,6 +63,38 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 
 	policy.AllowAttrs("loading").OnElements("img")
 
+	// MathML Core (https://www.w3.org/TR/mathml-core/)
+	mathMLElements := []string{
+		"math",
+		// token elements
+		"mi", "mn", "mo", "mtext", "mspace", "ms",
+		// layout elements
+		"mrow", "mfrac", "msqrt", "mroot", "mstyle", "merror", "mpadded", "mphantom",
+		// scripting elements
+		"msub", "msup", "msubsup", "munder", "mover", "munderover", "mmultiscripts", "mprescripts", "none",
+		// tabular elements
+		"mtable", "mtr", "mtd",
+		// semantic annotations
+		"semantics", "annotation", "annotation-xml",
+	}
+	policy.AllowAttrs("display", "alttext").OnElements("math")
+	policy.AllowAttrs(
+		// global presentation attributes
+		"dir", "displaystyle", "mathbackground", "mathcolor", "mathsize", "mathvariant", "scriptlevel",
+		// operator attributes
+		"accent", "accentunder", "fence", "form", "largeop", "lspace", "maxsize", "minsize", "movablelimits", "rspace", "separator", "stretchy", "symmetric",
+		// space and padding attributes
+		"depth", "height", "voffset", "width",
+		// fraction attribute
+		"linethickness",
+		// table attributes
+		"columnalign", "columnlines", "columnspacing", "frame", "framespacing", "rowalign", "rowlines", "rowspacing",
+		// cell attributes
+		"columnspan",
+		// annotation attribute
+		"encoding",
+	).OnElements(mathMLElements...)
+
 	// Allow generally safe attributes (reference: https://github.com/jch/html-pipeline)
 	generalSafeAttrs := []string{
 		"abbr", "accept", "accept-charset",
diff --git a/modules/markup/sanitizer_default_test.go b/modules/markup/sanitizer_default_test.go
index e66f00c02f..e344a96722 100644
--- a/modules/markup/sanitizer_default_test.go
+++ b/modules/markup/sanitizer_default_test.go
@@ -61,6 +61,9 @@ func TestSanitizer(t *testing.T) {
 		// picture
 		`<picture><source media="a"><source media="b"><img alt="c" src="d"></picture>`, `<picture><source media="a"><source media="b"><img alt="c" src="d"></picture>`,
 
+		// MathML
+		`<math display="display" class="foo"><mi mathcolor="c" class="bar"></mi></math>`, `<math display="display"><mi mathcolor="c"></mi></math>`,
+
 		// Disallow dangerous url schemes
 		`<a href="javascript:alert('xss')">bad</a>`, `bad`,
 		`<a href="vbscript:no">bad</a>`, `bad`,
@@ -72,6 +75,6 @@ func TestSanitizer(t *testing.T) {
 	}
 
 	for i := 0; i < len(testCases); i += 2 {
-		assert.Equal(t, testCases[i+1], string(Sanitize(testCases[i])))
+		assert.Equal(t, testCases[i+1], string(Sanitize(testCases[i])), "input: %s", testCases[i])
 	}
 }
diff --git a/modules/repository/commits.go b/modules/repository/commits.go
index d40af3d82c..318b052ef1 100644
--- a/modules/repository/commits.go
+++ b/modules/repository/commits.go
@@ -9,19 +9,15 @@ import (
 	"net/url"
 	"time"
 
-	"gitea.dev/models/avatars"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/cache"
-	"gitea.dev/modules/cachegroup"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/gitrepo"
-	"gitea.dev/modules/log"
-	"gitea.dev/modules/setting"
 	api "gitea.dev/modules/structs"
 )
 
 // PushCommit represents a commit in a push operation.
+// This struct is marshaled as JSON (see ActionContent2Commits)
 type PushCommit struct {
 	Sha1           string
 	Message        string
@@ -33,6 +29,7 @@ type PushCommit struct {
 }
 
 // PushCommits represents list of commits in a push operation.
+// This struct is marshaled as JSON (see ActionContent2Commits)
 type PushCommits struct {
 	Commits    []*PushCommit
 	HeadCommit *PushCommit
@@ -128,26 +125,6 @@ func (pc *PushCommits) ToAPIPayloadCommits(ctx context.Context, repo *repo_model
 	return commits, headCommit, nil
 }
 
-// AvatarLink tries to match user in database with e-mail
-// in order to show custom avatar, and falls back to general avatar link.
-func (pc *PushCommits) AvatarLink(ctx context.Context, email string) string {
-	size := avatars.DefaultAvatarPixelSize * setting.Avatar.RenderedSizeFactor
-
-	v, _ := cache.GetWithContextCache(ctx, cachegroup.EmailAvatarLink, email, func(ctx context.Context, email string) (string, error) {
-		u, err := user_model.GetUserByEmail(ctx, email)
-		if err != nil {
-			if !user_model.IsErrUserNotExist(err) {
-				log.Error("GetUserByEmail: %v", err)
-				return "", err
-			}
-			return avatars.GenerateEmailAvatarFastLink(ctx, email, size), nil
-		}
-		return u.AvatarLinkWithSize(ctx, size), nil
-	})
-
-	return v
-}
-
 // CommitToPushCommit transforms a git.Commit to PushCommit type.
 func CommitToPushCommit(commit *git.Commit) *PushCommit {
 	return &PushCommit{
diff --git a/modules/repository/commits_test.go b/modules/repository/commits_test.go
index c0f00337b9..5e6266d9f2 100644
--- a/modules/repository/commits_test.go
+++ b/modules/repository/commits_test.go
@@ -4,14 +4,12 @@
 package repository
 
 import (
-	"strconv"
 	"testing"
 	"time"
 
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/git"
-	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -99,38 +97,6 @@ func TestPushCommits_ToAPIPayloadCommits(t *testing.T) {
 	assert.Equal(t, []string{"readme.md"}, headCommit.Modified)
 }
 
-func TestPushCommits_AvatarLink(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	pushCommits := NewPushCommits()
-	pushCommits.Commits = []*PushCommit{
-		{
-			Sha1:           "abcdef1",
-			CommitterEmail: "user2@example.com",
-			CommitterName:  "User Two",
-			AuthorEmail:    "user4@example.com",
-			AuthorName:     "User Four",
-			Message:        "message1",
-		},
-		{
-			Sha1:           "abcdef2",
-			CommitterEmail: "user2@example.com",
-			CommitterName:  "User Two",
-			AuthorEmail:    "user2@example.com",
-			AuthorName:     "User Two",
-			Message:        "message2",
-		},
-	}
-
-	assert.Equal(t,
-		"/avatars/ab53a2911ddf9b4817ac01ddcd3d975f?size="+strconv.Itoa(28*setting.Avatar.RenderedSizeFactor),
-		pushCommits.AvatarLink(t.Context(), "user2@example.com"))
-
-	assert.Equal(t,
-		"/assets/img/avatar_default.png",
-		pushCommits.AvatarLink(t.Context(), "nonexistent@example.com"))
-}
-
 func TestCommitToPushCommit(t *testing.T) {
 	now := time.Now()
 	sig := &git.Signature{
diff --git a/modules/setting/config/value.go b/modules/setting/config/value.go
index 655120c180..240f48243c 100644
--- a/modules/setting/config/value.go
+++ b/modules/setting/config/value.go
@@ -78,11 +78,16 @@ func isZeroOrEmpty(v any) bool {
 	return false
 }
 
+var SkipDatabaseConfig bool
+
 func (opt *Option[T]) ValueRevision(ctx context.Context) (v T, rev int, has bool) {
 	dg := GetDynGetter()
 	if dg == nil {
 		// this is an edge case: the database is not initialized but the system setting is going to be used
 		// it should panic to avoid inconsistent config values (from config / system setting) and fix the code
+		if SkipDatabaseConfig {
+			return opt.DefaultValue(), 0, false
+		}
 		panic("no config dyn value getter")
 	}
 
diff --git a/modules/setting/ssh.go b/modules/setting/ssh.go
index 948ce773c5..683c90f224 100644
--- a/modules/setting/ssh.go
+++ b/modules/setting/ssh.go
@@ -9,6 +9,7 @@ import (
 	"text/template"
 	"time"
 
+	"gitea.dev/modules/consts"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/util"
 
@@ -52,8 +53,8 @@ var SSH = struct {
 	Domain:                        "",
 	Port:                          22,
 	MinimumKeySizeCheck:           true,
-	MinimumKeySizes:               map[string]int{"ed25519": 256, "ed25519-sk": 256, "ecdsa": 256, "ecdsa-sk": 256, "rsa": 3071},
-	ServerHostKeys:                []string{"ssh/gitea.rsa", "ssh/gogs.rsa"},
+	MinimumKeySizes:               map[string]int{"ed25519": consts.AsymKeyMinBitsEC, "ed25519-sk": consts.AsymKeyMinBitsEC, "ecdsa": consts.AsymKeyMinBitsEC, "ecdsa-sk": consts.AsymKeyMinBitsEC, "rsa": consts.AsymKeyMinBitsRsa},
+	ServerHostKeys:                []string{"ssh/gitea.rsa", "ssh/gitea.ed25519", "ssh/gitea.ecdsa", "ssh/gogs.rsa"},
 	AuthorizedKeysCommandTemplate: "{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}",
 	PerWriteTimeout:               PerWriteTimeout,
 	PerWritePerKbTimeout:          PerWritePerKbTimeout,
diff --git a/modules/ssh/ssh.go b/modules/ssh/ssh.go
index 94e29969b0..78e4b0805b 100644
--- a/modules/ssh/ssh.go
+++ b/modules/ssh/ssh.go
@@ -6,9 +6,6 @@ package ssh
 import (
 	"bytes"
 	"context"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
 	"encoding/pem"
 	"errors"
 	"io"
@@ -23,11 +20,11 @@ import (
 	"syscall"
 
 	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/modules/generate"
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/process"
 	"gitea.dev/modules/setting"
-	"gitea.dev/modules/util"
 
 	"github.com/gliderlabs/ssh"
 	gossh "golang.org/x/crypto/ssh"
@@ -59,7 +56,7 @@ func getExitStatusFromError(err error) int {
 		return 0
 	}
 
-	exitErr, ok := err.(*exec.ExitError)
+	exitErr, ok := errors.AsType[*exec.ExitError](err)
 	if !ok {
 		return 1
 	}
@@ -322,7 +319,7 @@ func publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
 }
 
 // sshConnectionFailed logs a failed connection
-// -  this mainly exists to give a nice function name in logging
+// - this mainly exists to give a nice function name in logging
 func sshConnectionFailed(conn net.Conn, err error) {
 	// Log the underlying error with a specific message
 	log.Warn("Failed connection from %s with error: %v", conn.RemoteAddr(), err)
@@ -351,40 +348,37 @@ func Listen(host string, port int, ciphers, keyExchanges, macs []string) {
 		},
 	}
 
-	keys := make([]string, 0, len(setting.SSH.ServerHostKeys))
+	hostKeyFiles := make([]string, 0, len(setting.SSH.ServerHostKeys))
 	for _, key := range setting.SSH.ServerHostKeys {
-		isExist, err := util.IsExist(key)
+		_, err := os.Stat(key)
 		if err != nil {
-			log.Fatal("Unable to check if %s exists. Error: %v", setting.SSH.ServerHostKeys, err)
-		}
-		if isExist {
-			keys = append(keys, key)
+			if !errors.Is(err, os.ErrNotExist) {
+				log.Fatal("Unable to check if %s exists. Error: %v", setting.SSH.ServerHostKeys, err)
+			}
+			continue
 		}
+		hostKeyFiles = append(hostKeyFiles, key)
 	}
 
-	if len(keys) == 0 {
-		filePath := filepath.Dir(setting.SSH.ServerHostKeys[0])
-
-		if err := os.MkdirAll(filePath, os.ModePerm); err != nil {
-			log.Error("Failed to create dir %s: %v", filePath, err)
+	if len(hostKeyFiles) == 0 {
+		hostKeyDir := filepath.Dir(setting.SSH.ServerHostKeys[0])
+		err := os.MkdirAll(hostKeyDir, os.ModePerm)
+		if err != nil {
+			log.Error("Failed to create dir %s: %v", hostKeyDir, err)
 		}
-
-		err := GenKeyPair(setting.SSH.ServerHostKeys[0])
+		hostKeyFiles, err = InitDefaultHostKeys(hostKeyDir)
 		if err != nil {
 			log.Fatal("Failed to generate private key: %v", err)
 		}
-		log.Trace("New private key is generated: %s", setting.SSH.ServerHostKeys[0])
-		keys = append(keys, setting.SSH.ServerHostKeys[0])
 	}
 
-	for _, key := range keys {
-		log.Info("Adding SSH host key: %s", key)
-		err := srv.SetOption(ssh.HostKeyFile(key))
+	for _, keyFile := range hostKeyFiles {
+		log.Info("Adding SSH host key: %s", keyFile)
+		err := srv.SetOption(ssh.HostKeyFile(keyFile))
 		if err != nil {
 			log.Error("Failed to set Host Key. %s", err)
 		}
 	}
-
 	go func() {
 		_, _, finished := process.GetManager().AddTypedContext(graceful.GetManager().HammerContext(), "Service: Built-in SSH server", process.SystemProcessType, true)
 		defer finished()
@@ -395,43 +389,44 @@ func Listen(host string, port int, ciphers, keyExchanges, macs []string) {
 // GenKeyPair make a pair of public and private keys for SSH access.
 // Public key is encoded in the format for inclusion in an OpenSSH authorized_keys file.
 // Private Key generated is PEM encoded
-func GenKeyPair(keyPath string) error {
-	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
+func GenKeyPair(keyPath string, keyType generate.SSHKeyType, bits int) error {
+	publicKey, privateKeyPEM, err := generate.NewSSHKey(keyType, bits)
 	if err != nil {
 		return err
 	}
 
-	privateKeyPEM := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)}
-	f, err := os.OpenFile(keyPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err = f.Close(); err != nil {
-			log.Error("Close: %v", err)
-		}
-	}()
-
-	if err := pem.Encode(f, privateKeyPEM); err != nil {
-		return err
-	}
-
-	// generate public key
-	pub, err := gossh.NewPublicKey(&privateKey.PublicKey)
+	public := gossh.MarshalAuthorizedKey(publicKey)
+	privateKeyBuf := &bytes.Buffer{}
+	err = pem.Encode(privateKeyBuf, privateKeyPEM)
 	if err != nil {
 		return err
 	}
 
-	public := gossh.MarshalAuthorizedKey(pub)
-	p, err := os.OpenFile(keyPath+".pub", os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
+	err = os.WriteFile(keyPath, privateKeyBuf.Bytes(), 0o600)
 	if err != nil {
 		return err
 	}
-	defer func() {
-		if err = p.Close(); err != nil {
-			log.Error("Close: %v", err)
+
+	return os.WriteFile(keyPath+".pub", public, 0o644)
+}
+
+// InitDefaultHostKeys mirrors how ssh-keygen -A operates
+// it runs checks if public and private keys are already defined and creates new ones if not present
+// key naming does not follow the OpenSSH convention due to existing settings being gitea.{KeyType} so generation follows gitea convention
+func InitDefaultHostKeys(path string) (keyFiles []string, _ error) {
+	var errs []error
+	keyTypes := []generate.SSHKeyType{generate.SSHKeyRSA, generate.SSHKeyECDSA, generate.SSHKeyED25519}
+	for _, keyType := range keyTypes {
+		keyPath := filepath.Join(path, "gitea."+string(keyType))
+		_, errStatPriv := os.Stat(keyPath)
+		if errStatPriv != nil {
+			err := GenKeyPair(keyPath, keyType, 0)
+			if err != nil {
+				errs = append(errs, err)
+				continue
+			}
 		}
-	}()
-	_, err = p.Write(public)
-	return err
+		keyFiles = append(keyFiles, keyPath)
+	}
+	return keyFiles, errors.Join(errs...)
 }
diff --git a/modules/ssh/ssh_test.go b/modules/ssh/ssh_test.go
new file mode 100644
index 0000000000..ad9ac813d4
--- /dev/null
+++ b/modules/ssh/ssh_test.go
@@ -0,0 +1,123 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package ssh
+
+import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"gitea.dev/modules/generate"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	gossh "golang.org/x/crypto/ssh"
+)
+
+func TestGenKeyPair(t *testing.T) {
+	testCases := []struct {
+		keyType      generate.SSHKeyType
+		expectedType any
+	}{
+		{
+			keyType:      generate.SSHKeyRSA,
+			expectedType: &rsa.PrivateKey{},
+		},
+		{
+			keyType:      generate.SSHKeyED25519,
+			expectedType: &ed25519.PrivateKey{},
+		},
+		{
+			keyType:      generate.SSHKeyECDSA,
+			expectedType: &ecdsa.PrivateKey{},
+		},
+	}
+	tmpDir := t.TempDir()
+	for _, tc := range testCases {
+		name := "gitea." + string(tc.keyType)
+		fn := filepath.Join(tmpDir, name)
+		t.Run("Generate "+name, func(t *testing.T) {
+			require.NoError(t, GenKeyPair(fn, tc.keyType, 0))
+
+			bytes, err := os.ReadFile(fn)
+			require.NoError(t, err)
+
+			privateKey, err := gossh.ParseRawPrivateKey(bytes)
+			require.NoError(t, err)
+			assert.IsType(t, tc.expectedType, privateKey)
+		})
+	}
+	t.Run("Generate unknown key type", func(t *testing.T) {
+		err := GenKeyPair(t.TempDir()+"gitea.badkey", "badkey", 0)
+		require.Error(t, err)
+	})
+}
+
+func TestInitKeys(t *testing.T) {
+	tempDir := t.TempDir()
+
+	keyTypes := []string{"rsa", "ecdsa", "ed25519"}
+	for _, keyType := range keyTypes {
+		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
+		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")
+		assert.NoFileExists(t, privKeyPath)
+		assert.NoFileExists(t, pubKeyPath)
+	}
+
+	// Test basic creation
+	keyFiles, err := InitDefaultHostKeys(tempDir)
+	require.NoError(t, err)
+	assert.Len(t, keyFiles, len(keyTypes))
+
+	metadata := map[string]os.FileInfo{}
+	for _, keyType := range keyTypes {
+		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
+		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")
+		info, err := os.Stat(privKeyPath)
+		require.NoError(t, err)
+		metadata[privKeyPath] = info
+
+		info, err = os.Stat(pubKeyPath)
+		require.NoError(t, err)
+		metadata[pubKeyPath] = info
+	}
+
+	// Test recreation on missing private key and noop for missing pub key
+	require.NoError(t, os.Remove(filepath.Join(tempDir, "gitea.ecdsa.pub")))
+	require.NoError(t, os.Remove(filepath.Join(tempDir, "gitea.ed25519")))
+
+	keyFiles, err = InitDefaultHostKeys(tempDir)
+	require.NoError(t, err)
+	assert.Len(t, keyFiles, len(keyTypes))
+
+	for _, keyType := range keyTypes {
+		privKeyPath := filepath.Join(tempDir, "gitea."+keyType)
+		pubKeyPath := filepath.Join(tempDir, "gitea."+keyType+".pub")
+
+		infoPriv, err := os.Stat(privKeyPath)
+		require.NoError(t, err)
+
+		switch keyType {
+		case "rsa":
+			// No modification to RSA key
+			infoPub, err := os.Stat(pubKeyPath)
+			require.NoError(t, err)
+			assert.Equal(t, metadata[privKeyPath], infoPriv)
+			assert.Equal(t, metadata[pubKeyPath], infoPub)
+		case "ecdsa":
+			// ECDSA public key should be missing, private unchanged
+			assert.Equal(t, metadata[privKeyPath], infoPriv)
+			assert.NoFileExists(t, pubKeyPath)
+		case "ed25519":
+			// ed25519 private key was removed, so both keys regenerated
+			infoPub, err := os.Stat(pubKeyPath)
+			require.NoError(t, err)
+			assert.NotEqual(t, metadata[privKeyPath], infoPriv)
+			assert.NotEqual(t, metadata[pubKeyPath], infoPub)
+		}
+	}
+}
diff --git a/modules/templates/util_render.go b/modules/templates/util_render.go
index 81941902ae..46f90be78a 100644
--- a/modules/templates/util_render.go
+++ b/modules/templates/util_render.go
@@ -10,8 +10,10 @@ import (
 	"math"
 	"net/url"
 	"regexp"
+	"slices"
 	"strings"
 
+	user_model "gitea.dev/models/gituser"
 	issues_model "gitea.dev/models/issues"
 	"gitea.dev/models/renderhelper"
 	"gitea.dev/models/repo"
@@ -22,6 +24,7 @@ import (
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/markup"
 	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/repository"
 	"gitea.dev/modules/reqctx"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/svg"
@@ -31,11 +34,12 @@ import (
 )
 
 type RenderUtils struct {
-	ctx reqctx.RequestContext
+	ctx         reqctx.RequestContext
+	avatarUtils *AvatarUtils
 }
 
 func NewRenderUtils(ctx reqctx.RequestContext) *RenderUtils {
-	return &RenderUtils{ctx: ctx}
+	return &RenderUtils{ctx: ctx, avatarUtils: NewAvatarUtils(ctx)}
 }
 
 // RenderCommitMessage renders commit message title (only title)
@@ -291,3 +295,134 @@ func (ut *RenderUtils) RenderUnicodeEscapeToggleTd(combined, escapeStatus *chars
 	}
 	return `<td class="lines-escape">` + ut.RenderUnicodeEscapeToggleButton(escapeStatus) + `</td>`
 }
+
+func renderAvatarStackViewEmailLink(data *user_model.AvatarStackData, email string) template.URL {
+	if data.SearchByEmailLink != "" && email != "" {
+		return template.URL(strings.ReplaceAll(data.SearchByEmailLink, "{email}", url.QueryEscape(email)))
+	}
+	return ""
+}
+
+func (ut *RenderUtils) participantHref(data *user_model.AvatarStackData, participant *user_model.CommitParticipant) template.URL {
+	if href := renderAvatarStackViewEmailLink(data, participant.GitIdentity.Email); href != "" {
+		return href
+	}
+	if participant.GiteaUser != nil {
+		return template.URL(participant.GiteaUser.HomeLink())
+	} else if participant.GitIdentity.Email != "" {
+		return template.URL("mailto:" + participant.GitIdentity.Email)
+	}
+	return ""
+}
+
+func (ut *RenderUtils) participantAvatar(participant *user_model.CommitParticipant) template.HTML {
+	if participant.GiteaUser != nil {
+		return ut.avatarUtils.Avatar(participant.GiteaUser, 20)
+	}
+	return ut.avatarUtils.AvatarByEmail(participant.GitIdentity.Email, participant.GitIdentity.Name, 20)
+}
+
+func participantName(participant *user_model.CommitParticipant) string {
+	if participant.GiteaUser != nil {
+		return participant.GiteaUser.GetDisplayName()
+	}
+	return participant.GitIdentity.Name
+}
+
+const renderAvatarStackMaxVisible = 10
+
+// AvatarStack renders overlapping avatars for the stack participants. It emits children in reverse
+// so CSS `flex-direction: row-reverse` places the primary (Participants[0]) leftmost and last-painted (on top).
+func (ut *RenderUtils) AvatarStack(data *user_model.AvatarStackData) template.HTML {
+	visible := data.Participants
+	overflow := len(visible) - renderAvatarStackMaxVisible
+	if overflow > 0 {
+		visible = visible[:renderAvatarStackMaxVisible]
+	}
+
+	var b htmlutil.HTMLBuilder
+	b.WriteHTML(`<span class="avatar-stack">`)
+	if overflow > 0 {
+		b.WriteFormat(`<span class="avatar-stack-overflow-chip tw-text-xs" aria-label="+%d more">+%d</span>`, overflow, overflow)
+	}
+
+	// FIXME: such "backward" breaks a11y like screen readers
+	for _, participant := range slices.Backward(visible) {
+		ut.writeAvatarStackItem(&b, data, participant)
+	}
+	b.WriteHTML(`</span>`)
+	return b.HTMLString()
+}
+
+func (ut *RenderUtils) writeAvatarStackItem(b *htmlutil.HTMLBuilder, data *user_model.AvatarStackData, participant *user_model.CommitParticipant) {
+	avatar := ut.participantAvatar(participant)
+	if href := ut.participantHref(data, participant); href != "" {
+		b.WriteFormat(`<a href="%s">%s</a>`, href, avatar)
+	} else {
+		b.WriteFormat(`<span>%s</span>`, avatar)
+	}
+}
+
+func (ut *RenderUtils) AvatarStackPushCommit(pushCommit *repository.PushCommit) template.HTML {
+	fakeGitCommit := git.Commit{
+		CommitMessage: git.CommitMessage{MessageRaw: pushCommit.Message},
+		Author:        &git.Signature{Name: pushCommit.AuthorName, Email: pushCommit.AuthorEmail},
+		// there is no way to know the real committer, but the field can't be nil
+		Committer: &git.Signature{Name: pushCommit.AuthorName, Email: pushCommit.AuthorEmail},
+	}
+	data := user_model.BuildAvatarStackData(ut.ctx, fakeGitCommit.AllParticipantIdentities(), nil)
+	return ut.AvatarStack(data)
+}
+
+// AvatarStackWithNames renders the avatar stack plus a label: `name` / `a and b` / `N people` (opens popup).
+func (ut *RenderUtils) AvatarStackWithNames(data *user_model.AvatarStackData) template.HTML {
+	locale := ut.ctx.Value(translation.ContextKey).(translation.Locale)
+	participants := data.Participants
+
+	var b htmlutil.HTMLBuilder
+	b.WriteHTML(`<span class="avatar-stack-names">`)
+	b.WriteHTML(ut.AvatarStack(data))
+
+	switch len(participants) {
+	case 1:
+		b.WriteHTML(ut.participantNameLink(data, participants[0]))
+	case 2:
+		b.WriteHTML(ut.participantNameLink(data, participants[0]))
+		b.WriteFormat(`<span>%s</span>`, locale.Tr("repo.commits.avatar_stack_and"))
+		b.WriteHTML(ut.participantNameLink(data, participants[1]))
+	default:
+		b.WriteFormat(`<button type="button" class="avatar-stack-popup-trigger" data-global-init="initAvatarStackPopup">%s</button>`,
+			locale.Tr("repo.commits.avatar_stack_people", len(participants)))
+		b.WriteHTML(`<div class="tippy-target"><div class="avatar-stack-popup">`)
+		for _, participant := range participants {
+			b.WriteHTML(ut.participantPopupRow(data, participant))
+		}
+		b.WriteHTML(`</div></div>`)
+	}
+
+	b.WriteHTML(`</span>`)
+	return b.HTMLString()
+}
+
+// participantNameLink prefers (in order): commits-by-author search, `GetShortDisplayNameLinkHTML` (keeps alt-name tooltip), `mailto:`, bare name.
+func (ut *RenderUtils) participantNameLink(data *user_model.AvatarStackData, participant *user_model.CommitParticipant) template.HTML {
+	if href := renderAvatarStackViewEmailLink(data, participant.GitIdentity.Email); href != "" {
+		return htmlutil.HTMLFormat(`<a class="muted" href="%s">%s</a>`, href, participantName(participant))
+	}
+	if participant.GiteaUser != nil {
+		return participant.GiteaUser.GetShortDisplayNameLinkHTML()
+	}
+	if participant.GitIdentity.Email != "" {
+		return htmlutil.HTMLFormat(`<a class="muted" href="mailto:%s">%s</a>`, participant.GitIdentity.Email, participant.GitIdentity.Name)
+	}
+	return template.HTML(template.HTMLEscapeString(participant.GitIdentity.Name))
+}
+
+func (ut *RenderUtils) participantPopupRow(data *user_model.AvatarStackData, participant *user_model.CommitParticipant) template.HTML {
+	avatar := ut.participantAvatar(participant)
+	name := participantName(participant)
+	if href := ut.participantHref(data, participant); href != "" {
+		return htmlutil.HTMLFormat(`<a class="silenced flex-text-block" href="%s">%s<span>%s</span></a>`, href, avatar, name)
+	}
+	return htmlutil.HTMLFormat(`<span class="flex-text-block">%s<span>%s</span></span>`, avatar, name)
+}
diff --git a/modules/templates/util_render_test.go b/modules/templates/util_render_test.go
index 5a28a1feba..1db87feb79 100644
--- a/modules/templates/util_render_test.go
+++ b/modules/templates/util_render_test.go
@@ -7,15 +7,19 @@ import (
 	"context"
 	"html/template"
 	"os"
+	"strconv"
 	"strings"
 	"testing"
 
+	"gitea.dev/models/gituser"
 	"gitea.dev/models/issues"
 	"gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
 	"gitea.dev/modules/markup"
 	"gitea.dev/modules/reqctx"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
 	"gitea.dev/modules/test"
 	"gitea.dev/modules/translation"
 
@@ -298,3 +302,52 @@ func TestUserMention(t *testing.T) {
 	rendered := newTestRenderUtils(t).MarkdownToHtml("@no-such-user @mention-user @mention-user")
 	assert.Equal(t, `<p>@no-such-user <a href="/mention-user" rel="nofollow">@mention-user</a> <a href="/mention-user" rel="nofollow">@mention-user</a></p>`, strings.TrimSpace(string(rendered)))
 }
+
+func TestAvatarStack(t *testing.T) {
+	defer test.MockVariableValue(&config.SkipDatabaseConfig, true)()
+
+	ut := newTestRenderUtils(t)
+	mkCo := func(name, email string) *git.CommitIdentity {
+		return &git.CommitIdentity{Name: name, Email: email}
+	}
+	authorSig := mkCo("Alice", "alice@example.com")
+	mkData := func(co ...*git.CommitIdentity) *gituser.AvatarStackData {
+		all := append([]*git.CommitIdentity{authorSig}, co...)
+		return gituser.BuildAvatarStackData(t.Context(), all, &user_model.EmailUserMap{})
+	}
+
+	t.Run("lone author renders bare name, no label", func(t *testing.T) {
+		got := string(ut.AvatarStackWithNames(mkData()))
+		assert.Contains(t, got, `<span class="avatar-stack-names">`)
+		assert.Contains(t, got, "Alice")
+		assert.NotContains(t, got, "avatar_stack_and")
+		assert.NotContains(t, got, "avatar_stack_people")
+	})
+
+	t.Run("two participants use and label", func(t *testing.T) {
+		got := string(ut.AvatarStackWithNames(mkData(mkCo("Bob", "bob@example.com"))))
+		assert.Contains(t, got, "repo.commits.avatar_stack_and")
+		assert.Contains(t, got, "Bob")
+		assert.NotContains(t, got, "avatar_stack_people")
+		assert.Contains(t, got, `<span class="avatar-stack">`)
+	})
+
+	t.Run("three participants switch to N people label with tippy popup", func(t *testing.T) {
+		got := string(ut.AvatarStackWithNames(mkData(mkCo("Bob", "bob@example.com"), mkCo("Carol", "carol@example.com"))))
+		assert.Contains(t, got, "repo.commits.avatar_stack_people:3")
+		assert.NotContains(t, got, "repo.commits.avatar_stack_and")
+		assert.Contains(t, got, `data-global-init="initAvatarStackPopup"`)
+		assert.Contains(t, got, `<div class="tippy-target">`)
+		assert.Contains(t, got, `class="avatar-stack-popup"`)
+	})
+
+	t.Run("overflow chip renders beyond 10 participants", func(t *testing.T) {
+		cos := make([]*git.CommitIdentity, 0, renderAvatarStackMaxVisible+1)
+		for i := range renderAvatarStackMaxVisible + 1 {
+			cos = append(cos, mkCo("X", strconv.Itoa(i)+"@example.com"))
+		}
+		got := ut.AvatarStack(gituser.BuildAvatarStackData(t.Context(), cos, &user_model.EmailUserMap{}))
+		assert.Contains(t, got, `class="avatar-stack-overflow-chip`)
+		assert.Contains(t, got, "+1")
+	})
+}
diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
index 9595baebed..90c7c71fb7 100644
--- a/options/locale/locale_en-US.json
+++ b/options/locale/locale_en-US.json
@@ -2205,10 +2205,10 @@
   "repo.settings.trust_model.collaborator.desc": "Valid signatures by collaborators of this repository will be marked \"trusted\", whether they match the committer or not. Otherwise, valid signatures will be marked \"untrusted\" if the signature matches the committer and \"unmatched\" if not.",
   "repo.settings.trust_model.committer": "Committer",
   "repo.settings.trust_model.committer.long": "Committer: Trust signatures that match committers. This matches GitHub's behavior and will force commits signed by Gitea to have Gitea as the committer.",
-  "repo.settings.trust_model.committer.desc": "Valid signatures will only be marked \"trusted\" if they match the committer, otherwise they will be marked \"unmatched\". This forces Gitea to be the committer on signed commits, with the actual committer marked as Co-authored-by: and Co-committed-by: trailer in the commit. The default Gitea key must match a user in the database.",
+  "repo.settings.trust_model.committer.desc": "Valid signatures will only be marked \"trusted\" if they match the committer, otherwise they will be marked \"unmatched\". This forces Gitea to be the committer on signed commits, with the actual committer marked as a Co-authored-by: trailer in the commit. The default Gitea key must match a user in the database.",
   "repo.settings.trust_model.collaboratorcommitter": "Collaborator+Committer",
   "repo.settings.trust_model.collaboratorcommitter.long": "Collaborator+Committer: Trust signatures by collaborators which match the committer",
-  "repo.settings.trust_model.collaboratorcommitter.desc": "Valid signatures by collaborators of this repository will be marked \"trusted\" if they match the committer. Otherwise, valid signatures will be marked \"untrusted\" if the signature matches the committer and \"unmatched\" otherwise. This will force Gitea to be marked as the committer on signed commits, with the actual committer marked as Co-Authored-By: and Co-Committed-By: trailer in the commit. The default Gitea key must match a user in the database.",
+  "repo.settings.trust_model.collaboratorcommitter.desc": "Valid signatures by collaborators of this repository will be marked \"trusted\" if they match the committer. Otherwise, valid signatures will be marked \"untrusted\" if the signature matches the committer and \"unmatched\" otherwise. This will force Gitea to be marked as the committer on signed commits, with the actual committer marked as a Co-Authored-By: trailer in the commit. The default Gitea key must match a user in the database.",
   "repo.settings.wiki_delete": "Delete Wiki Data",
   "repo.settings.wiki_delete_desc": "Deleting repository wiki data is permanent and cannot be undone.",
   "repo.settings.wiki_delete_notices_1": "- This will permanently delete and disable the repository wiki for %s.",
@@ -2599,6 +2599,9 @@
   "repo.diff.review.reject": "Request changes",
   "repo.diff.review.self_approve": "Pull request authors can't approve their own pull request",
   "repo.diff.committed_by": "committed by",
+  "repo.diff.coauthored_by": "co-authored by",
+  "repo.commits.avatar_stack_and": "and",
+  "repo.commits.avatar_stack_people": "%d people",
   "repo.diff.protected": "Protected",
   "repo.diff.image.side_by_side": "Side by Side",
   "repo.diff.image.swipe": "Swipe",
@@ -3795,13 +3798,17 @@
   "actions.runs.view_workflow_file": "View workflow file",
   "actions.runs.summary": "Summary",
   "actions.runs.all_jobs": "All jobs",
+  "actions.runs.job_summaries": "Job summaries",
   "actions.runs.expand_caller_jobs": "Show jobs of this reusable workflow caller",
   "actions.runs.collapse_caller_jobs": "Hide jobs of this reusable workflow caller",
   "actions.runs.attempt": "Attempt",
   "actions.runs.latest": "Latest",
   "actions.runs.latest_attempt": "Latest attempt",
   "actions.runs.triggered_via": "Triggered via %s",
-  "actions.runs.total_duration": "Total duration:",
+  "actions.runs.rerun_triggered": "Re-run triggered",
+  "actions.runs.back_to_pull_request": "Back to pull request",
+  "actions.runs.back_to_workflow": "Back to workflow",
+  "actions.runs.total_duration": "Total duration",
   "actions.runs.workflow_dependencies": "Workflow Dependencies",
   "actions.runs.graph_jobs_count_1": "%d job",
   "actions.runs.graph_jobs_count_n": "%d jobs",
diff --git a/package.json b/package.json
index cc6c270a84..cbd944222b 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "@citation-js/plugin-bibtex": "0.7.21",
     "@citation-js/plugin-csl": "0.7.22",
     "@citation-js/plugin-software-formats": "0.6.2",
-    "@codemirror/autocomplete": "6.20.2",
+    "@codemirror/autocomplete": "6.20.3",
     "@codemirror/commands": "6.10.3",
     "@codemirror/lang-json": "6.0.2",
     "@codemirror/lang-markdown": "6.5.0",
@@ -75,7 +75,7 @@
   },
   "devDependencies": {
     "@eslint-community/eslint-plugin-eslint-comments": "4.7.2",
-    "@eslint/json": "1.2.0",
+    "@eslint/json": "2.0.0",
     "@playwright/test": "1.60.0",
     "@stylistic/eslint-plugin": "5.10.0",
     "@stylistic/stylelint-plugin": "5.2.0",
@@ -102,7 +102,7 @@
     "eslint-plugin-regexp": "3.1.0",
     "eslint-plugin-sonarjs": "4.0.3",
     "eslint-plugin-unicorn": "64.0.0",
-    "eslint-plugin-vue": "10.9.1",
+    "eslint-plugin-vue": "10.9.2",
     "eslint-plugin-vue-scoped-css": "3.1.1",
     "eslint-plugin-wc": "3.1.0",
     "globals": "17.6.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ce5d84c982..948bb2ba5c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -21,8 +21,8 @@ importers:
         specifier: 0.6.2
         version: 0.6.2
       '@codemirror/autocomplete':
-        specifier: 6.20.2
-        version: 6.20.2
+        specifier: 6.20.3
+        version: 6.20.3
       '@codemirror/commands':
         specifier: 6.10.3
         version: 6.10.3
@@ -82,13 +82,13 @@ importers:
         version: 6.5.3(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
       '@replit/codemirror-lang-nix':
         specifier: 6.0.1
-        version: 6.0.1(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)
+        version: 6.0.1(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)
       '@replit/codemirror-lang-svelte':
         specifier: 6.0.0
-        version: 6.0.0(@codemirror/autocomplete@6.20.2)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)
+        version: 6.0.0(@codemirror/autocomplete@6.20.3)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)
       '@replit/codemirror-vscode-keymap':
         specifier: 6.0.2
-        version: 6.0.2(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
+        version: 6.0.2(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
       '@resvg/resvg-wasm':
         specifier: 2.6.2
         version: 2.6.2
@@ -211,8 +211,8 @@ importers:
         specifier: 4.7.2
         version: 4.7.2(eslint@10.4.1(jiti@2.7.0))
       '@eslint/json':
-        specifier: 1.2.0
-        version: 1.2.0
+        specifier: 2.0.0
+        version: 2.0.0
       '@playwright/test':
         specifier: 1.60.0
         version: 1.60.0
@@ -289,8 +289,8 @@ importers:
         specifier: 64.0.0
         version: 64.0.0(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-vue:
-        specifier: 10.9.1
-        version: 10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0)))(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0)))
+        specifier: 10.9.2
+        version: 10.9.2(@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0)))(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0)))
       eslint-plugin-vue-scoped-css:
         specifier: 3.1.1
         version: 3.1.1(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0)))
@@ -446,8 +446,8 @@ packages:
     resolution: {integrity: sha512-3XQOO3u4WXY/7AWZyQ+9SuBzS8bYTlJ+NF1uCgrZO64g36nK5iIc5YV9cBl2TL2QhHF6S36nvAsXsj5fX9FeHw==}
     engines: {node: '>=14.0.0'}
 
-  '@codemirror/autocomplete@6.20.2':
-    resolution: {integrity: sha512-G5FPkgIiLjOgZMjqVjvuKQ1rGPtHogLldJr33eFJdVLtmwY+giGrlv/ewljLz6b9BSQLkjxuwBc6g6omDM+YxQ==}
+  '@codemirror/autocomplete@6.20.3':
+    resolution: {integrity: sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g==}
 
   '@codemirror/commands@6.10.3':
     resolution: {integrity: sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q==}
@@ -797,18 +797,14 @@ packages:
     resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/json@1.2.0':
-    resolution: {integrity: sha512-CEFEyNgvzu8zn5QwVYDg3FaG+ZKUeUsNYitFpMYJAqoAlnw68EQgNbUfheSmexZr4n0wZPrAkPLuvsLaXO6wRw==}
+  '@eslint/json@2.0.0':
+    resolution: {integrity: sha512-P32ZJMIopNWQd1SFhd0tgjfA/hgzUuVSqHmMi2273QaLWHWimXq6V+qL4DNKnjGzO/aNECtYW+rEJ/pWB6uP+w==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
   '@eslint/object-schema@3.0.5':
     resolution: {integrity: sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@eslint/plugin-kit@0.6.1':
-    resolution: {integrity: sha512-iH1B076HoAshH1mLpHMgwdGeTs0CYwL0SPMkGuSebZrwBp16v415e9NZXg2jtrqPVQjf6IANe2Vtlr5KswtcZQ==}
-    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
-
   '@eslint/plugin-kit@0.7.2':
     resolution: {integrity: sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
@@ -2699,8 +2695,8 @@ packages:
       postcss-styl:
         optional: true
 
-  eslint-plugin-vue@10.9.1:
-    resolution: {integrity: sha512-cHB0Tf4Duvzwecwd/AqWzZvF/QszE13BhjVUpVXWCy9AeMR5GjkAjP3i85vqgLgOuTmkHR1OJ5oMeqLHtuw8zg==}
+  eslint-plugin-vue@10.9.2:
+    resolution: {integrity: sha512-4g7ZP3pYcuqd7Zp0pzUKcos0W+RkjBz4EGdhJ92FcYk6v03Ti/GK5NwjgsjxHK+98eXDbHeK7VtX1az7/8doZA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       '@stylistic/eslint-plugin': ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0
@@ -5053,7 +5049,7 @@ snapshots:
       '@citation-js/date': 0.5.1
       '@citation-js/name': 0.4.2
 
-  '@codemirror/autocomplete@6.20.2':
+  '@codemirror/autocomplete@6.20.3':
     dependencies:
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
@@ -5083,7 +5079,7 @@ snapshots:
 
   '@codemirror/lang-css@6.3.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -5091,7 +5087,7 @@ snapshots:
 
   '@codemirror/lang-go@6.0.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -5099,7 +5095,7 @@ snapshots:
 
   '@codemirror/lang-html@6.4.11':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/lang-css': 6.3.1
       '@codemirror/lang-javascript': 6.2.5
       '@codemirror/language': 6.12.3
@@ -5116,7 +5112,7 @@ snapshots:
 
   '@codemirror/lang-javascript@6.2.5':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/lint': 6.9.6
       '@codemirror/state': 6.6.0
@@ -5126,7 +5122,7 @@ snapshots:
 
   '@codemirror/lang-jinja@6.0.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/lang-html': 6.4.11
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
@@ -5150,7 +5146,7 @@ snapshots:
 
   '@codemirror/lang-liquid@6.3.2':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/lang-html': 6.4.11
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
@@ -5161,7 +5157,7 @@ snapshots:
 
   '@codemirror/lang-markdown@6.5.0':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/lang-html': 6.4.11
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
@@ -5179,7 +5175,7 @@ snapshots:
 
   '@codemirror/lang-python@6.2.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -5200,7 +5196,7 @@ snapshots:
 
   '@codemirror/lang-sql@6.10.0':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -5225,7 +5221,7 @@ snapshots:
 
   '@codemirror/lang-xml@6.1.0':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.43.0
@@ -5234,7 +5230,7 @@ snapshots:
 
   '@codemirror/lang-yaml@6.1.3':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -5485,20 +5481,15 @@ snapshots:
 
   '@eslint/js@9.39.4': {}
 
-  '@eslint/json@1.2.0':
+  '@eslint/json@2.0.0':
     dependencies:
       '@eslint/core': 1.2.1
-      '@eslint/plugin-kit': 0.6.1
+      '@eslint/plugin-kit': 0.7.2
       '@humanwhocodes/momoa': 3.3.10
       natural-compare: 1.4.0
 
   '@eslint/object-schema@3.0.5': {}
 
-  '@eslint/plugin-kit@0.6.1':
-    dependencies:
-      '@eslint/core': 1.2.1
-      levn: 0.4.1
-
   '@eslint/plugin-kit@0.7.2':
     dependencies:
       '@eslint/core': 1.2.1
@@ -5754,9 +5745,9 @@ snapshots:
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.43.0
 
-  '@replit/codemirror-lang-nix@6.0.1(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)':
+  '@replit/codemirror-lang-nix@6.0.1(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.43.0
@@ -5764,9 +5755,9 @@ snapshots:
       '@lezer/highlight': 1.2.3
       '@lezer/lr': 1.4.10
 
-  '@replit/codemirror-lang-svelte@6.0.0(@codemirror/autocomplete@6.20.2)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)':
+  '@replit/codemirror-lang-svelte@6.0.0(@codemirror/autocomplete@6.20.3)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/lang-css': 6.3.1
       '@codemirror/lang-html': 6.4.11
       '@codemirror/lang-javascript': 6.2.5
@@ -5778,9 +5769,9 @@ snapshots:
       '@lezer/javascript': 1.5.4
       '@lezer/lr': 1.4.10
 
-  '@replit/codemirror-vscode-keymap@6.0.2(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
+  '@replit/codemirror-vscode-keymap@6.0.2(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
     dependencies:
-      '@codemirror/autocomplete': 6.20.2
+      '@codemirror/autocomplete': 6.20.3
       '@codemirror/commands': 6.10.3
       '@codemirror/language': 6.12.3
       '@codemirror/lint': 6.9.6
@@ -6134,6 +6125,22 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
+      eslint: 10.4.1(jiti@2.7.0)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
@@ -7452,17 +7459,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
-    dependencies:
-      debug: 3.2.7
-    optionalDependencies:
-      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
-      eslint: 10.4.1(jiti@2.7.0)
-      eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0))
-    transitivePeerDependencies:
-      - supports-color
-
   eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       debug: 3.2.7
@@ -7473,7 +7469,6 @@ snapshots:
       eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
-    optional: true
 
   eslint-plugin-array-func@5.1.1(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
@@ -7508,7 +7503,7 @@ snapshots:
       '@eslint/eslintrc': 3.3.5
       '@eslint/js': 9.39.4
       '@github/browserslist-config': 1.0.0
-      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
       '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
       aria-query: 5.3.2
       eslint: 10.4.1(jiti@2.7.0)
@@ -7517,7 +7512,7 @@ snapshots:
       eslint-plugin-eslint-comments: 3.2.0(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-filenames: 1.3.2(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-i18n-text: 1.0.1(eslint@10.4.1(jiti@2.7.0))
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-jsx-a11y: 6.10.2(eslint@10.4.1(jiti@2.7.0))
       eslint-plugin-no-only-tests: 3.4.0
       eslint-plugin-prettier: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.1(jiti@2.7.0)))(eslint@10.4.1(jiti@2.7.0))(prettier@3.8.3)
@@ -7557,35 +7552,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
-    dependencies:
-      '@rtsao/scc': 1.1.0
-      array-includes: 3.1.9
-      array.prototype.findlastindex: 1.2.6
-      array.prototype.flat: 1.3.3
-      array.prototype.flatmap: 1.3.3
-      debug: 3.2.7
-      doctrine: 2.1.0
-      eslint: 10.4.1(jiti@2.7.0)
-      eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0))
-      hasown: 2.0.4
-      is-core-module: 2.16.2
-      is-glob: 4.0.3
-      minimatch: 3.1.5
-      object.fromentries: 2.0.8
-      object.groupby: 1.0.3
-      object.values: 1.2.1
-      semver: 6.3.1
-      string.prototype.trimend: 1.0.9
-      tsconfig-paths: 3.15.0
-    optionalDependencies:
-      '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)
-    transitivePeerDependencies:
-      - eslint-import-resolver-typescript
-      - eslint-import-resolver-webpack
-      - supports-color
-
   eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
       '@rtsao/scc': 1.1.0
@@ -7614,7 +7580,6 @@ snapshots:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
       - supports-color
-    optional: true
 
   eslint-plugin-jsx-a11y@6.10.2(eslint@10.4.1(jiti@2.7.0)):
     dependencies:
@@ -7708,7 +7673,7 @@ snapshots:
       postcss-selector-parser: 7.1.1
       vue-eslint-parser: 10.4.0(eslint@10.4.1(jiti@2.7.0))
 
-  eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0)))(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0))):
+  eslint-plugin-vue@10.9.2(@stylistic/eslint-plugin@5.10.0(eslint@10.4.1(jiti@2.7.0)))(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.1(jiti@2.7.0))):
     dependencies:
       '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.1(jiti@2.7.0))
       eslint: 10.4.1(jiti@2.7.0)
diff --git a/routers/api/actions/artifacts.go b/routers/api/actions/artifacts.go
index d82ac6988c..eeea05c9b4 100644
--- a/routers/api/actions/artifacts.go
+++ b/routers/api/actions/artifacts.go
@@ -121,6 +121,9 @@ func ArtifactsRoutes(prefix string) *web.Router {
 		m.Get("/{artifact_id}/download", r.downloadArtifact)
 	})
 
+	// Job summary upload endpoint (GITHUB_STEP_SUMMARY).
+	m.Put(jobSummaryRouteBase, uploadJobSummary)
+
 	return m
 }
 
diff --git a/routers/api/actions/job_summary.go b/routers/api/actions/job_summary.go
new file mode 100644
index 0000000000..fa21cd6d11
--- /dev/null
+++ b/routers/api/actions/job_summary.go
@@ -0,0 +1,104 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"errors"
+	"io"
+	"mime"
+	"net/http"
+	"slices"
+	"strconv"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+)
+
+const jobSummaryRouteBase = "/_apis/pipelines/workflows/{run_id}/jobs/{job_id}/steps/{step_index}/summary"
+
+func uploadJobSummary(ctx *ArtifactContext) {
+	task, _, ok := validateRunID(ctx)
+	if !ok {
+		return
+	}
+
+	jobID := ctx.PathParamInt64("job_id")
+	if jobID <= 0 || task.Job.ID != jobID {
+		ctx.HTTPError(http.StatusBadRequest, "job_id mismatch")
+		return
+	}
+
+	stepIndex, err := strconv.ParseInt(ctx.PathParam("step_index"), 10, 64)
+	if err != nil || stepIndex < 0 {
+		ctx.HTTPError(http.StatusBadRequest, "invalid step_index")
+		return
+	}
+	steps, err := actions_model.GetTaskStepsByTaskID(ctx, task.ID)
+	if err != nil {
+		log.Error("Error getting task steps: %v", err)
+		ctx.HTTPError(http.StatusInternalServerError, "Error getting task steps")
+		return
+	}
+	if !slices.ContainsFunc(steps, func(s *actions_model.ActionTaskStep) bool { return s.Index == stepIndex }) {
+		ctx.HTTPError(http.StatusBadRequest, "step_index mismatch")
+		return
+	}
+
+	contentType, ok := normalizeJobSummaryContentType(ctx.Req.Header.Get("Content-Type"))
+	if !ok {
+		ctx.HTTPError(http.StatusBadRequest, "invalid summary content type")
+		return
+	}
+
+	body, err := io.ReadAll(io.LimitReader(ctx.Req.Body, actions_model.MaxJobSummarySize+1))
+	if err != nil {
+		log.Error("Error reading job summary request body: %v", err)
+		ctx.HTTPError(http.StatusInternalServerError, "read request body")
+		return
+	}
+	message := "success"
+	if len(body) == 0 {
+		// PUT with an empty body clears any previously-stored summary for this step.
+		if err := actions_model.DeleteActionRunJobSummary(ctx, task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, stepIndex); err != nil {
+			log.Error("Error deleting job summary: %v", err)
+			ctx.HTTPError(http.StatusInternalServerError, "Error deleting job summary")
+			return
+		}
+		message = "cleared"
+	} else if err := actions_model.UpsertActionRunJobSummary(ctx, task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, stepIndex, contentType, body); err != nil {
+		if errors.Is(err, actions_model.ErrJobSummaryAggregateExceeded) {
+			ctx.HTTPError(http.StatusBadRequest, "job summary aggregate size exceeded")
+			return
+		}
+		if errors.Is(err, util.ErrInvalidArgument) {
+			ctx.HTTPError(http.StatusBadRequest, "invalid summary")
+			return
+		}
+		log.Error("Error upsert job summary: %v", err)
+		ctx.HTTPError(http.StatusInternalServerError, "Error upsert job summary")
+		return
+	}
+
+	ctx.JSON(http.StatusOK, map[string]any{
+		"message":    message,
+		"sizeBytes":  len(body),
+		"runAttempt": task.Job.RunAttemptID,
+	})
+}
+
+func normalizeJobSummaryContentType(contentType string) (string, bool) {
+	if contentType == "" || contentType == "application/octet-stream" {
+		return actions_model.JobSummaryContentTypeMarkdown, true
+	}
+
+	mediaType, _, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		return "", false
+	}
+	if mediaType != actions_model.JobSummaryContentTypeMarkdown {
+		return "", false
+	}
+	return actions_model.JobSummaryContentTypeMarkdown, true
+}
diff --git a/routers/api/actions/runner/runner.go b/routers/api/actions/runner/runner.go
index e98aef9515..803b7c13a1 100644
--- a/routers/api/actions/runner/runner.go
+++ b/routers/api/actions/runner/runner.go
@@ -161,7 +161,7 @@ func (s *Service) Declare(
 		return nil, status.Errorf(codes.Internal, "update runner: %v", err)
 	}
 
-	return connect.NewResponse(&runnerv1.DeclareResponse{
+	resp := connect.NewResponse(&runnerv1.DeclareResponse{
 		Runner: &runnerv1.Runner{
 			Id:      runner.ID,
 			Uuid:    runner.UUID,
@@ -170,7 +170,11 @@ func (s *Service) Declare(
 			Version: runner.Version,
 			Labels:  runner.AgentLabels,
 		},
-	}), nil
+	})
+	// Capabilities are communicated via headers to avoid a hard dependency on a proto bump.
+	// Older runners ignore unknown headers; newer runners can use this for feature negotiation.
+	resp.Header().Set("X-Gitea-Actions-Capabilities", actions_model.RunnerCapabilities())
+	return resp, nil
 }
 
 // FetchTask assigns a task to the runner
diff --git a/routers/web/devtest/devtest.go b/routers/web/devtest/devtest.go
index 87c1ffdb2a..294bd7e1cb 100644
--- a/routers/web/devtest/devtest.go
+++ b/routers/web/devtest/devtest.go
@@ -15,6 +15,7 @@ import (
 
 	"gitea.dev/models/asymkey"
 	"gitea.dev/models/db"
+	"gitea.dev/models/gituser"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/badge"
 	"gitea.dev/modules/charset"
@@ -61,8 +62,8 @@ func prepareMockDataBadgeCommitSign(ctx *context.Context) {
 	mockUser := mockUsers[0]
 	commits = append(commits, &asymkey.SignCommit{
 		Verification: &asymkey.CommitVerification{},
-		UserCommit: &user_model.UserCommit{
-			Commit: &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
+		UserCommit: &gituser.UserCommit{
+			GitCommit: &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
 		},
 	})
 	commits = append(commits, &asymkey.SignCommit{
@@ -73,9 +74,9 @@ func prepareMockDataBadgeCommitSign(ctx *context.Context) {
 			SigningKey:  &asymkey.GPGKey{KeyID: "12345678"},
 			TrustStatus: "trusted",
 		},
-		UserCommit: &user_model.UserCommit{
-			User:   mockUser,
-			Commit: &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
+		UserCommit: &gituser.UserCommit{
+			AuthorUser: mockUser,
+			GitCommit:  &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
 		},
 	})
 	commits = append(commits, &asymkey.SignCommit{
@@ -86,9 +87,9 @@ func prepareMockDataBadgeCommitSign(ctx *context.Context) {
 			SigningSSHKey: &asymkey.PublicKey{Fingerprint: "aa:bb:cc:dd:ee"},
 			TrustStatus:   "untrusted",
 		},
-		UserCommit: &user_model.UserCommit{
-			User:   mockUser,
-			Commit: &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
+		UserCommit: &gituser.UserCommit{
+			AuthorUser: mockUser,
+			GitCommit:  &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
 		},
 	})
 	commits = append(commits, &asymkey.SignCommit{
@@ -99,9 +100,9 @@ func prepareMockDataBadgeCommitSign(ctx *context.Context) {
 			SigningSSHKey: &asymkey.PublicKey{Fingerprint: "aa:bb:cc:dd:ee"},
 			TrustStatus:   "other(unmatch)",
 		},
-		UserCommit: &user_model.UserCommit{
-			User:   mockUser,
-			Commit: &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
+		UserCommit: &gituser.UserCommit{
+			AuthorUser: mockUser,
+			GitCommit:  &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
 		},
 	})
 	commits = append(commits, &asymkey.SignCommit{
@@ -110,9 +111,9 @@ func prepareMockDataBadgeCommitSign(ctx *context.Context) {
 			Reason:       "gpg.error",
 			SigningEmail: "test@example.com",
 		},
-		UserCommit: &user_model.UserCommit{
-			User:   mockUser,
-			Commit: &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
+		UserCommit: &gituser.UserCommit{
+			AuthorUser: mockUser,
+			GitCommit:  &git.Commit{ID: git.Sha1ObjectFormat.EmptyObjectID()},
 		},
 	})
 
@@ -159,6 +160,59 @@ func prepareMockDataBadgeActionsSvg(ctx *context.Context) {
 	ctx.Data["SelectedStyle"] = selectedStyle
 }
 
+func prepareMockDataAvatarStack(ctx *context.Context) {
+	/*
+		mockUsers, _ := db.Find[user_model.User](ctx, user_model.SearchUserOptions{ListOptions: db.ListOptions{PageSize: 3}})
+		if len(mockUsers) == 0 {
+			return
+		}
+		u0 := mockUsers[0]
+		u1, u2 := u0, u0
+		if len(mockUsers) >= 2 {
+			u1 = mockUsers[1]
+		}
+		if len(mockUsers) >= 3 {
+			u2 = mockUsers[2]
+		}
+
+		authorSig := func(u *user_model.User) *git.Signature {
+			return &git.Signature{Name: u.Name, Email: u.Email}
+		}
+		coLinked := func(u *user_model.User) *gituser.CommitParticipant {
+			return &gituser.CommitParticipant{GiteaUser: u, GitIdentity: authorSig(u)}
+		}
+		coUnlinked := func(name, email string) *gituser.CommitParticipant {
+			return &gituser.CommitParticipant{GitIdentity: &git.Signature{Name: name, Email: email}}
+		}
+		nUnlinked := func(n int) []*gituser.CommitParticipant {
+			out := make([]*gituser.CommitParticipant, n)
+			for i := range out {
+				out[i] = coUnlinked(fmt.Sprintf("Contributor %d", i+1), fmt.Sprintf("contrib%d@example.com", i+1))
+			}
+			return out
+		}
+
+		type scenario struct {
+			Label string
+			Data  *gituser.AvatarStackData
+		}
+		mk := gituser.BuildAvatarStackData()
+		extSig := &git.Signature{Name: "External Contributor", Email: "external@example.com"}
+		ctx.Data["AvatarStackScenarios"] = []scenario{
+			{Label: "linked author, no co-authors", Data: mk(u0, authorSig(u0), nil)},
+			{Label: "unlinked author, no co-authors", Data: mk(nil, extSig, nil)},
+			{Label: "1 linked co-author", Data: mk(u0, authorSig(u0), []*gituser.CommitParticipant{coLinked(u1)})},
+			{Label: "1 unlinked co-author", Data: mk(u0, authorSig(u0), []*gituser.CommitParticipant{coUnlinked("Bob Smith", "bob@example.com")})},
+			{Label: "2 co-authors (3 people), u1 author", Data: mk(u1, authorSig(u1), []*gituser.CommitParticipant{coLinked(u0), coUnlinked("Bob Smith", "bob@example.com")})},
+			{Label: "3 co-authors mixed (4 people)", Data: mk(u0, authorSig(u0), []*gituser.CommitParticipant{coLinked(u1), coLinked(u2), coUnlinked("Bob Smith", "bob@example.com")})},
+			{Label: "9 co-authors (max visible, no overflow), u2 author", Data: mk(u2, authorSig(u2), nUnlinked(9))},
+			{Label: "10 co-authors (overflow +1)", Data: mk(u0, authorSig(u0), nUnlinked(10))},
+			{Label: "15 co-authors (overflow +6), unlinked author", Data: mk(nil, extSig, nUnlinked(15))},
+			{Label: "30 co-authors (overflow +21)", Data: mk(u0, authorSig(u0), nUnlinked(30))},
+		}
+	*/
+}
+
 func prepareMockDataRelativeTime(ctx *context.Context) {
 	now := time.Now()
 	ctx.Data["TimeNow"] = now
@@ -196,6 +250,8 @@ func prepareMockData(ctx *context.Context) {
 		prepareMockDataToastAndMessage(ctx)
 	case "/devtest/unicode-escape":
 		prepareMockDataUnicodeEscape(ctx)
+	case "/devtest/avatar-stack":
+		prepareMockDataAvatarStack(ctx)
 	}
 }
 
diff --git a/routers/web/devtest/mock_actions.go b/routers/web/devtest/mock_actions.go
index 61f20a3ef4..bc6fdeb907 100644
--- a/routers/web/devtest/mock_actions.go
+++ b/routers/web/devtest/mock_actions.go
@@ -15,6 +15,7 @@ import (
 	actions_model "gitea.dev/models/actions"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
 	"gitea.dev/modules/web"
@@ -87,29 +88,40 @@ func MockActionsRunsJobs(ctx *context.Context) {
 	resp.State.Run.TitleHTML = `mock run title <a href="/">link</a>`
 	resp.State.Run.Link = setting.AppSubURL + "/devtest/repo-action-view/runs/" + strconv.FormatInt(runID, 10)
 	resp.State.Run.CanDeleteArtifact = true
-	resp.State.Run.WorkflowID = "workflow-id"
-	resp.State.Run.WorkflowLink = "./workflow-link"
+	resp.State.Run.WorkflowID = "workflow-id.yml"
 	resp.State.Run.TriggerEvent = "push"
+	renderUtils := templates.NewRenderUtils(ctx)
+	user2, _ := user_model.GetUserByID(ctx, 2)
+	if user2 == nil {
+		user2 = &user_model.User{Name: "user2"}
+	}
+	user3, _ := user_model.GetUserByID(ctx, 3)
+	if user3 == nil {
+		user3 = &user_model.User{Name: "user3"}
+	}
 	resp.State.Run.Commit = actions.ViewCommit{
 		ShortSha: "ccccdddd",
 		Link:     "./commit-link",
 		Pusher: actions.ViewUser{
-			DisplayName: "pusher user",
-			Link:        "./pusher-link",
+			DisplayName: user2.GetDisplayName(),
+			Link:        user2.HomeLink(),
+			AvatarLink:  user2.AvatarLinkWithSize(ctx, 16),
 		},
 		Branch: actions.ViewBranch{
-			Name:      "commit-branch",
+			Name:      "user2:commit-branch",
 			Link:      "./branch-link",
 			IsDeleted: false,
 		},
 	}
+	resp.State.Run.PullRequest = &actions.ViewPullRequest{
+		Index: "#37658",
+		Link:  "./pull/37658",
+	}
 	now := time.Now()
 	currentAttemptNum := int64(1)
 	if attemptID > 0 {
 		currentAttemptNum = attemptID
 	}
-	user2 := &user_model.User{Name: "user2"}
-	user3 := &user_model.User{Name: "user3"}
 	attempts := []*actions_model.ActionRunAttempt{{
 		Attempt:       1,
 		Status:        actions_model.StatusSuccess,
@@ -168,15 +180,16 @@ func MockActionsRunsJobs(ctx *context.Context) {
 			}
 		}
 		resp.State.Run.Attempts = append(resp.State.Run.Attempts, &actions.ViewRunAttempt{
-			Attempt:         attempt.Attempt,
-			Status:          attempt.Status.String(),
-			Done:            attempt.Status.IsDone(),
-			Link:            link,
-			Current:         current,
-			Latest:          attempt.Attempt == latestAttempt.Attempt,
-			TriggeredAt:     attempt.Created.AsTime().Unix(),
-			TriggerUserName: attempt.TriggerUser.GetDisplayName(),
-			TriggerUserLink: attempt.TriggerUser.HomeLink(),
+			Attempt:           attempt.Attempt,
+			Status:            attempt.Status.String(),
+			Done:              attempt.Status.IsDone(),
+			Link:              link,
+			Current:           current,
+			Latest:            attempt.Attempt == latestAttempt.Attempt,
+			TriggeredAt:       attempt.Created.AsTime().Unix(),
+			TriggerUserName:   attempt.TriggerUser.GetDisplayName(),
+			TriggerUserLink:   attempt.TriggerUser.HomeLink(),
+			TriggerUserAvatar: attempt.TriggerUser.AvatarLinkWithSize(ctx, 16),
 		})
 	}
 	isLatestAttempt := currentAttemptNum == latestAttempt.Attempt
@@ -185,6 +198,20 @@ func MockActionsRunsJobs(ctx *context.Context) {
 	resp.State.Run.CanRerun = runID == 30 && isLatestAttempt
 	resp.State.Run.CanRerunFailed = runID == 30 && isLatestAttempt
 
+	// Mock job summaries so the devtest page can preview the Summary panel rendering.
+	resp.State.Run.JobSummaries = []*actions.ViewJobSummary{
+		{
+			JobID:       runID * 10,
+			JobName:     "job 100 (testsubname)",
+			SummaryHTML: renderUtils.MarkdownToHtml("### Devtest job summary\n\n- Markdown rendering\n- Links: [example](https://example.com)\n\n```sh\necho hello\n```\n"),
+		},
+		{
+			JobID:       runID*10 + 2,
+			JobName:     "ULTRA LOOOOOOOOOOOONG job name 102 that exceeds the limit",
+			SummaryHTML: renderUtils.MarkdownToHtml("### Another summary\n\nThis demonstrates multiple job summaries in one run.\n\n- Item A\n- Item B\n"),
+		},
+	}
+
 	resp.Artifacts = append(resp.Artifacts, &actions.ArtifactsViewItem{
 		Name:        "artifact-a",
 		Size:        100 * 1024,
diff --git a/routers/web/repo/actions/view.go b/routers/web/repo/actions/view.go
index da99744449..2f4f1950ec 100644
--- a/routers/web/repo/actions/view.go
+++ b/routers/web/repo/actions/view.go
@@ -20,14 +20,18 @@ import (
 	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unit"
 	"gitea.dev/modules/actions"
 	"gitea.dev/modules/base"
+	"gitea.dev/modules/cache"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/storage"
+	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/templates"
 	"gitea.dev/modules/translation"
 	"gitea.dev/modules/util"
@@ -306,10 +310,13 @@ type ViewResponse struct {
 			Attempts          []*ViewRunAttempt `json:"attempts"`
 			Jobs              []*ViewJob        `json:"jobs"`
 			Commit            ViewCommit        `json:"commit"`
+			PullRequest       *ViewPullRequest  `json:"pullRequest,omitempty"`
 			// Summary view: run duration and trigger time/event
 			Duration     string `json:"duration"`
 			TriggeredAt  int64  `json:"triggeredAt"`  // unix seconds for relative time
 			TriggerEvent string `json:"triggerEvent"` // e.g. pull_request, push, schedule
+
+			JobSummaries []*ViewJobSummary `json:"jobSummaries,omitempty"`
 		} `json:"run"`
 		CurrentJob struct {
 			Title  string         `json:"title"`
@@ -339,16 +346,28 @@ type ViewJob struct {
 	CallUses         string `json:"callUses,omitempty"`
 }
 
+type ViewJobSummary struct {
+	JobID       int64         `json:"jobId"`
+	JobName     string        `json:"jobName"`
+	SummaryHTML template.HTML `json:"summaryHTML"`
+}
+
 type ViewRunAttempt struct {
-	Attempt         int64  `json:"attempt"`
-	Status          string `json:"status"`
-	Done            bool   `json:"done"`
-	Link            string `json:"link"`
-	Current         bool   `json:"current"`
-	Latest          bool   `json:"latest"`
-	TriggeredAt     int64  `json:"triggeredAt"`
-	TriggerUserName string `json:"triggerUserName"`
-	TriggerUserLink string `json:"triggerUserLink"`
+	Attempt           int64  `json:"attempt"`
+	Status            string `json:"status"`
+	Done              bool   `json:"done"`
+	Link              string `json:"link"`
+	Current           bool   `json:"current"`
+	Latest            bool   `json:"latest"`
+	TriggeredAt       int64  `json:"triggeredAt"`
+	TriggerUserName   string `json:"triggerUserName"`
+	TriggerUserLink   string `json:"triggerUserLink"`
+	TriggerUserAvatar string `json:"triggerUserAvatar"`
+}
+
+type ViewPullRequest struct {
+	Index string `json:"index"`
+	Link  string `json:"link"`
 }
 
 type ViewCommit struct {
@@ -361,6 +380,7 @@ type ViewCommit struct {
 type ViewUser struct {
 	DisplayName string `json:"displayName"`
 	Link        string `json:"link"`
+	AvatarLink  string `json:"avatarLink,omitempty"`
 }
 
 type ViewBranch struct {
@@ -388,6 +408,132 @@ type ViewStepLogLine struct {
 	Timestamp float64 `json:"timestamp"`
 }
 
+func viewPullRequestFromRun(ctx context.Context, run *actions_model.ActionRun, prPayload *api.PullRequestPayload) *ViewPullRequest {
+	if run.Repo == nil {
+		return nil
+	}
+	refName := git.RefName(run.Ref)
+	if refName.IsPull() {
+		return &ViewPullRequest{
+			Index: "#" + refName.ShortName(),
+			Link:  run.RefLink(),
+		}
+	}
+	if prPayload != nil && prPayload.Index > 0 {
+		return &ViewPullRequest{
+			Index: fmt.Sprintf("#%d", prPayload.Index),
+			Link:  fmt.Sprintf("%s/pulls/%d", run.Repo.Link(), prPayload.Index),
+		}
+	}
+	// Push-triggered run: surface an open PR whose head matches this branch so
+	// users coming from a PR's check details can navigate back to it.
+	if refName.IsBranch() {
+		prs, err := issues_model.GetUnmergedPullRequestsByHeadInfo(ctx, run.RepoID, refName.ShortName())
+		if err != nil {
+			log.Error("GetUnmergedPullRequestsByHeadInfo: %v", err)
+		} else if len(prs) == 1 {
+			pr := prs[0]
+			if err := pr.LoadBaseRepo(ctx); err != nil {
+				log.Error("LoadBaseRepo: %v", err)
+				return nil
+			}
+			return &ViewPullRequest{
+				Index: fmt.Sprintf("#%d", pr.Index),
+				Link:  fmt.Sprintf("%s/pulls/%d", pr.BaseRepo.Link(), pr.Index),
+			}
+		}
+	}
+	return nil
+}
+
+func viewSummaryBranchFromRun(ctx context.Context, run *actions_model.ActionRun, prPayload *api.PullRequestPayload) ViewBranch {
+	refName := git.RefName(run.Ref)
+	if prPayload != nil && prPayload.PullRequest != nil && prPayload.PullRequest.Head != nil {
+		head := prPayload.PullRequest.Head
+		name := head.Name
+		if name == "" {
+			name = git.RefName(head.Ref).ShortName()
+		}
+		if head.Repository != nil && run.Repo != nil && head.RepoID > 0 && head.RepoID != run.Repo.ID {
+			ownerName := ""
+			if head.Repository.Owner != nil {
+				ownerName = head.Repository.Owner.UserName
+			} else if head.Repository.FullName != "" {
+				ownerName, _, _ = strings.Cut(head.Repository.FullName, "/")
+			}
+			if ownerName != "" && !strings.Contains(name, ":") {
+				name = ownerName + ":" + name
+			}
+		}
+		link := ""
+		if head.Repository != nil && head.Ref != "" {
+			repoLink := head.Repository.Link
+			if repoLink == "" {
+				repoLink = head.Repository.HTMLURL
+			}
+			if repoLink != "" {
+				link = repoLink + "/src/" + git.RefName(head.Ref).RefWebLinkPath()
+			}
+		}
+		return ViewBranch{Name: name, Link: link}
+	}
+
+	branch := ViewBranch{
+		Name: run.PrettyRef(),
+		Link: run.RefLink(),
+	}
+	if refName.IsBranch() {
+		b, err := git_model.GetBranch(ctx, run.RepoID, refName.ShortName())
+		if err != nil && !git_model.IsErrBranchNotExist(err) {
+			log.Error("GetBranch: %v", err)
+		} else if git_model.IsErrBranchNotExist(err) || (b != nil && b.IsDeleted) {
+			branch.IsDeleted = true
+		}
+	}
+	return branch
+}
+
+// actionsSummaryRefCacheTTL bounds how long the resolved PR/branch summary is
+// cached. ViewPost is polled every second, but this metadata is stable for a
+// run, so a short TTL collapses the repeated DB lookups while staying fresh
+// enough for the navigation links.
+const actionsSummaryRefCacheTTL = 10 // seconds
+
+type viewSummaryRefInfo struct {
+	PullRequest *ViewPullRequest `json:"pullRequest"`
+	Branch      ViewBranch       `json:"branch"`
+}
+
+// getViewSummaryRefInfo resolves the run's pull request and head branch summary,
+// caching the result briefly so the per-second poll does not hit the database on
+// every request (GetUnmergedPullRequestsByHeadInfo / GetBranch).
+func getViewSummaryRefInfo(ctx context.Context, run *actions_model.ActionRun) viewSummaryRefInfo {
+	compute := func() viewSummaryRefInfo {
+		// parse the event payload once and share it between both resolvers
+		prPayload, _ := run.GetPullRequestEventPayload() // nil unless this is a pull request event
+		return viewSummaryRefInfo{
+			PullRequest: viewPullRequestFromRun(ctx, run, prPayload),
+			Branch:      viewSummaryBranchFromRun(ctx, run, prPayload),
+		}
+	}
+	c := cache.GetCache()
+	if c == nil {
+		return compute()
+	}
+	cacheKey := fmt.Sprintf("actions_run_summary_ref:%d", run.ID)
+	if cached, ok := c.Get(cacheKey); ok && cached != "" {
+		var info viewSummaryRefInfo
+		if err := json.Unmarshal([]byte(cached), &info); err == nil {
+			return info
+		}
+	}
+	info := compute()
+	if data, err := json.Marshal(info); err == nil {
+		_ = c.Put(cacheKey, string(data), actionsSummaryRefCacheTTL)
+	}
+	return info
+}
+
 func ViewPost(ctx *context_module.Context) {
 	run, attempt, jobs := getCurrentRunJobsByPathParam(ctx)
 	if ctx.Written() {
@@ -482,50 +628,71 @@ func fillViewRunResponseSummary(ctx *context_module.Context, resp *ViewResponse,
 	}
 	for _, runAttempt := range attempts {
 		resp.State.Run.Attempts = append(resp.State.Run.Attempts, &ViewRunAttempt{
-			Attempt:         runAttempt.Attempt,
-			Status:          runAttempt.Status.String(),
-			Done:            runAttempt.Status.IsDone(),
-			Link:            getRunViewLink(run, runAttempt),
-			Current:         runAttempt.ID == attempt.ID,
-			Latest:          runAttempt.ID == run.LatestAttemptID,
-			TriggeredAt:     runAttempt.Created.AsTime().Unix(),
-			TriggerUserName: runAttempt.TriggerUser.GetDisplayName(),
-			TriggerUserLink: runAttempt.TriggerUser.HomeLink(),
+			Attempt:           runAttempt.Attempt,
+			Status:            runAttempt.Status.String(),
+			Done:              runAttempt.Status.IsDone(),
+			Link:              getRunViewLink(run, runAttempt),
+			Current:           runAttempt.ID == attempt.ID,
+			Latest:            runAttempt.ID == run.LatestAttemptID,
+			TriggeredAt:       runAttempt.Created.AsTime().Unix(),
+			TriggerUserName:   runAttempt.TriggerUser.GetDisplayName(),
+			TriggerUserLink:   runAttempt.TriggerUser.HomeLink(),
+			TriggerUserAvatar: runAttempt.TriggerUser.AvatarLinkWithSize(ctx, 16),
 		})
 	}
 
 	pusher := ViewUser{
 		DisplayName: run.TriggerUser.GetDisplayName(),
 		Link:        run.TriggerUser.HomeLink(),
-	}
-	branch := ViewBranch{
-		Name: run.PrettyRef(),
-		Link: run.RefLink(),
-	}
-	refName := git.RefName(run.Ref)
-	if refName.IsBranch() {
-		b, err := git_model.GetBranch(ctx, ctx.Repo.Repository.ID, refName.ShortName())
-		if err != nil && !git_model.IsErrBranchNotExist(err) {
-			log.Error("GetBranch: %v", err)
-		} else if git_model.IsErrBranchNotExist(err) || (b != nil && b.IsDeleted) {
-			branch.IsDeleted = true
-		}
+		AvatarLink:  run.TriggerUser.AvatarLinkWithSize(ctx, 16),
 	}
 
+	refInfo := getViewSummaryRefInfo(ctx, run)
 	resp.State.Run.Commit = ViewCommit{
 		ShortSha: base.ShortSha(run.CommitSHA),
 		Link:     fmt.Sprintf("%s/commit/%s", run.Repo.Link(), run.CommitSHA),
 		Pusher:   pusher,
-		Branch:   branch,
+		Branch:   refInfo.Branch,
 	}
+	resp.State.Run.PullRequest = refInfo.PullRequest
 	resp.State.Run.TriggerEvent = run.TriggerEvent
 
-	// Legacy runs (LatestAttemptID == 0) have no attempt; their artifacts all share run_attempt_id=0,
-	// so passing 0 here scopes to this run's legacy artifacts only.
+	// Legacy runs (LatestAttemptID == 0) have no attempt; their artifacts and summaries all
+	// share run_attempt_id=0, so passing 0 here scopes to this run's legacy rows only.
 	var runAttemptID int64
 	if attempt != nil {
 		runAttemptID = attempt.ID
 	}
+
+	// Each step's markdown is rendered independently so an unclosed construct
+	// in one step can't bleed into the next.
+	// On a single-job view only that job's summaries are needed; the run view shows all.
+	// Scoping server-side avoids rendering every job's markdown on each 1s poll.
+	summaries, err := actions_model.ListActionRunJobSummaries(ctx, ctx.Repo.Repository.ID, run.ID, runAttemptID, ctx.PathParamInt64("job"))
+	if err != nil {
+		ctx.ServerError("ListActionRunJobSummaries", err)
+		return
+	}
+	if len(summaries) > 0 {
+		jobNameByID := make(map[int64]string, len(jobs))
+		for _, j := range jobs {
+			jobNameByID[j.ID] = j.Name
+		}
+		renderUtils := templates.NewRenderUtils(ctx)
+		var current *ViewJobSummary
+		for _, s := range summaries {
+			if s.ContentType != actions_model.JobSummaryContentTypeMarkdown {
+				log.Warn("Skip unsupported job summary content type %q for run %d job %d step %d", s.ContentType, s.RunID, s.JobID, s.StepIndex)
+				continue
+			}
+			if current == nil || current.JobID != s.JobID {
+				current = &ViewJobSummary{JobID: s.JobID, JobName: jobNameByID[s.JobID]}
+				resp.State.Run.JobSummaries = append(resp.State.Run.JobSummaries, current)
+			}
+			current.SummaryHTML += renderUtils.MarkdownToHtml(s.Content)
+		}
+	}
+
 	arts, err := actions_model.ListUploadedArtifactsMetaByRunAttempt(ctx, ctx.Repo.Repository.ID, run.ID, runAttemptID)
 	if err != nil {
 		ctx.ServerError("ListUploadedArtifactsMetaByRunAttempt", err)
diff --git a/routers/web/repo/actions/view_test.go b/routers/web/repo/actions/view_test.go
index 737ac5e1b3..020930eb38 100644
--- a/routers/web/repo/actions/view_test.go
+++ b/routers/web/repo/actions/view_test.go
@@ -7,6 +7,8 @@ import (
 	"testing"
 
 	actions_model "gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/translation"
 
@@ -14,6 +16,66 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestViewPullRequestFromRun(t *testing.T) {
+	repo := &repo_model.Repository{ID: 1, OwnerName: "owner", Name: "repo"}
+
+	t.Run("pull ref", func(t *testing.T) {
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/pull/123/head"}
+		assert.Equal(t, &ViewPullRequest{Index: "#123", Link: "/owner/repo/pulls/123"}, viewPullRequestFromRun(t.Context(), run, nil))
+	})
+
+	t.Run("pull request event payload", func(t *testing.T) {
+		// a non-pull ref forces the payload branch instead of the ref branch
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/heads/feature"}
+		payload := &api.PullRequestPayload{Index: 42}
+		assert.Equal(t, &ViewPullRequest{Index: "#42", Link: "/owner/repo/pulls/42"}, viewPullRequestFromRun(t.Context(), run, payload))
+	})
+
+	t.Run("nil repo", func(t *testing.T) {
+		run := &actions_model.ActionRun{Ref: "refs/pull/1/head"}
+		assert.Nil(t, viewPullRequestFromRun(t.Context(), run, nil))
+	})
+}
+
+func TestViewSummaryBranchFromRun(t *testing.T) {
+	repo := &repo_model.Repository{ID: 1, OwnerName: "owner", Name: "repo"}
+
+	t.Run("pull request event same repo", func(t *testing.T) {
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/pull/7/head"}
+		payload := &api.PullRequestPayload{
+			PullRequest: &api.PullRequest{Head: &api.PRBranchInfo{
+				Name:       "feature",
+				Ref:        "refs/heads/feature",
+				RepoID:     1,
+				Repository: &api.Repository{Link: "/owner/repo"},
+			}},
+		}
+		assert.Equal(t, ViewBranch{Name: "feature", Link: "/owner/repo/src/branch/feature"}, viewSummaryBranchFromRun(t.Context(), run, payload))
+	})
+
+	t.Run("pull request event from fork prefixes owner", func(t *testing.T) {
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/pull/7/head"}
+		payload := &api.PullRequestPayload{
+			PullRequest: &api.PullRequest{Head: &api.PRBranchInfo{
+				Name:   "feature",
+				Ref:    "refs/heads/feature",
+				RepoID: 2,
+				Repository: &api.Repository{
+					Link:  "/forkowner/repo",
+					Owner: &api.User{UserName: "forkowner"},
+				},
+			}},
+		}
+		assert.Equal(t, ViewBranch{Name: "forkowner:feature", Link: "/forkowner/repo/src/branch/feature"}, viewSummaryBranchFromRun(t.Context(), run, payload))
+	})
+
+	t.Run("push to tag does not query branch", func(t *testing.T) {
+		// a tag ref is not a branch, so no GetBranch DB lookup happens
+		run := &actions_model.ActionRun{Repo: repo, Ref: "refs/tags/v1.0.0"}
+		assert.Equal(t, ViewBranch{Name: "v1.0.0", Link: "/owner/repo/src/tag/v1.0.0"}, viewSummaryBranchFromRun(t.Context(), run, nil))
+	})
+}
+
 func TestConvertToViewModel(t *testing.T) {
 	task := &actions_model.ActionTask{
 		Status: actions_model.StatusSuccess,
diff --git a/routers/web/repo/blame.go b/routers/web/repo/blame.go
index 6b97a58c17..457f9795a2 100644
--- a/routers/web/repo/blame.go
+++ b/routers/web/repo/blame.go
@@ -12,8 +12,8 @@ import (
 	"path"
 	"strconv"
 
+	"gitea.dev/models/gituser"
 	repo_model "gitea.dev/models/repo"
-	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/charset"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/git/languagestats"
@@ -29,13 +29,14 @@ import (
 type blameRow struct {
 	RowNumber int
 
-	Avatar         template.HTML
 	PreviousSha    string
 	PreviousShaURL string
 	CommitURL      string
 	CommitMessage  string
 	CommitSince    template.HTML
 
+	AvatarStackData *gituser.AvatarStackData
+
 	Code         template.HTML
 	EscapeStatus *charset.EscapeStatus
 }
@@ -174,9 +175,9 @@ func fillBlameResult(br *gitrepo.BlameReader, r *blameResult) error {
 	return nil
 }
 
-func processBlameParts(ctx *context.Context, blameParts []*gitrepo.BlamePart) map[string]*user_model.UserCommit {
+func processBlameParts(ctx *context.Context, blameParts []*gitrepo.BlamePart) map[string]*gituser.UserCommit {
 	// store commit data by SHA to look up avatar info etc
-	commitNames := make(map[string]*user_model.UserCommit)
+	commitNames := make(map[string]*gituser.UserCommit)
 	// and as blameParts can reference the same commits multiple
 	// times, we cache the lookup work locally
 	commits := make([]*git.Commit, 0, len(blameParts))
@@ -209,33 +210,28 @@ func processBlameParts(ctx *context.Context, blameParts []*gitrepo.BlamePart) ma
 	}
 
 	// populate commit email addresses to later look up avatars.
-	validatedCommits, err := user_model.ValidateCommitsWithEmails(ctx, commits)
+	userCommits, err := gituser.GetUserCommitsByGitCommits(ctx, commits, ctx.Repo.RepoLink, ctx.Repo.RefFullName)
 	if err != nil {
-		ctx.ServerError("ValidateCommitsWithEmails", err)
+		ctx.ServerError("GetUserCommitsByGitCommits", err)
 		return nil
 	}
-	for _, c := range validatedCommits {
-		commitNames[c.ID.String()] = c
+	for _, c := range userCommits {
+		commitNames[c.GitCommit.ID.String()] = c
 	}
 
 	return commitNames
 }
 
-func renderBlameFillFirstBlameRow(repoLink string, avatarUtils *templates.AvatarUtils, part *gitrepo.BlamePart, commit *user_model.UserCommit, br *blameRow) {
-	if commit.User != nil {
-		br.Avatar = avatarUtils.Avatar(commit.User, 18)
-	} else {
-		br.Avatar = avatarUtils.AvatarByEmail(commit.Author.Email, commit.Author.Name, 18)
-	}
-
+func renderBlameFillFirstBlameRow(ctx *context.Context, repoLink string, part *gitrepo.BlamePart, commit *gituser.UserCommit, br *blameRow) {
+	br.AvatarStackData = gituser.BuildAvatarStackData(ctx, commit.GitCommit.AllParticipantIdentities(), nil)
 	br.PreviousSha = part.PreviousSha
 	br.PreviousShaURL = fmt.Sprintf("%s/blame/commit/%s/%s", repoLink, url.PathEscape(part.PreviousSha), util.PathEscapeSegments(part.PreviousPath))
 	br.CommitURL = fmt.Sprintf("%s/commit/%s", repoLink, url.PathEscape(part.Sha))
-	br.CommitMessage = commit.MessageUTF8()
-	br.CommitSince = templates.TimeSince(commit.Author.When)
+	br.CommitMessage = commit.GitCommit.MessageUTF8()
+	br.CommitSince = templates.TimeSince(commit.GitCommit.Author.When)
 }
 
-func renderBlame(ctx *context.Context, blameParts []*gitrepo.BlamePart, commitNames map[string]*user_model.UserCommit) {
+func renderBlame(ctx *context.Context, blameParts []*gitrepo.BlamePart, commitNames map[string]*gituser.UserCommit) {
 	language, err := languagestats.GetFileLanguage(ctx, ctx.Repo.GitRepo, ctx.Repo.CommitID, ctx.Repo.TreePath)
 	if err != nil {
 		log.Error("Unable to get file language for %-v:%s. Error: %v", ctx.Repo.Repository, ctx.Repo.TreePath, err)
@@ -243,7 +239,6 @@ func renderBlame(ctx *context.Context, blameParts []*gitrepo.BlamePart, commitNa
 
 	buf := &bytes.Buffer{}
 	rows := make([]*blameRow, 0)
-	avatarUtils := templates.NewAvatarUtils(ctx)
 	rowNumber := 0 // will be 1-based
 	for _, part := range blameParts {
 		for partLineIdx, line := range part.Lines {
@@ -258,7 +253,7 @@ func renderBlame(ctx *context.Context, blameParts []*gitrepo.BlamePart, commitNa
 			}
 
 			if partLineIdx == 0 {
-				renderBlameFillFirstBlameRow(ctx.Repo.RepoLink, avatarUtils, part, commitNames[part.Sha], br)
+				renderBlameFillFirstBlameRow(ctx, ctx.Repo.RepoLink, part, commitNames[part.Sha], br)
 			}
 		}
 	}
diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index ff3496629f..d895387818 100644
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -14,6 +14,7 @@ import (
 	asymkey_model "gitea.dev/models/asymkey"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/gituser"
 	issues_model "gitea.dev/models/issues"
 	"gitea.dev/models/renderhelper"
 	repo_model "gitea.dev/models/repo"
@@ -49,7 +50,7 @@ func RefCommits(ctx *context.Context) {
 	switch {
 	case len(ctx.Repo.TreePath) == 0:
 		Commits(ctx)
-	case ctx.Repo.TreePath == "search":
+	case ctx.Repo.TreePath == "search": // FIXME: legacy dirty design, it conflicts with the FileHistory
 		SearchCommits(ctx)
 	default:
 		FileHistory(ctx)
@@ -396,7 +397,8 @@ func Diff(ctx *context.Context) {
 
 	verification := asymkey_service.ParseCommitWithSignature(ctx, commit)
 	ctx.Data["Verification"] = verification
-	ctx.Data["Author"] = user_model.ValidateCommitWithEmail(ctx, commit)
+	ctx.Data["Author"] = user_model.GetUserByGitAuthor(ctx, commit)
+	ctx.Data["CommitOtherParticipants"] = gituser.BuildAvatarStackData(ctx, commit.AllParticipantIdentities(), nil).Participants[1:]
 	ctx.Data["Parents"] = parents
 	ctx.Data["DiffNotAvailable"] = diffShortStat.NumFiles == 0
 
@@ -411,7 +413,7 @@ func Diff(ctx *context.Context) {
 	err = git.GetNote(ctx, ctx.Repo.GitRepo, commitID, note)
 	if err == nil {
 		ctx.Data["NoteCommit"] = note.Commit
-		ctx.Data["NoteAuthor"] = user_model.ValidateCommitWithEmail(ctx, note.Commit)
+		ctx.Data["NoteAuthor"] = user_model.GetUserByGitAuthor(ctx, note.Commit)
 		rctx := renderhelper.NewRenderContextRepoComment(ctx, ctx.Repo.Repository, renderhelper.RepoCommentOptions{CurrentRefSubURL: "commit/" + util.PathEscapeSegments(commitID)})
 		htmlMessage := template.HTML(template.HTMLEscapeString(string(charset.ToUTF8WithFallback(note.Message, charset.ConvertOpts{}))))
 		ctx.Data["NoteRendered"] = markup.PostProcessCommitMessage(rctx, htmlMessage)
@@ -461,7 +463,7 @@ func RawDiff(ctx *context.Context) {
 }
 
 func processGitCommits(ctx *context.Context, gitCommits []*git.Commit) ([]*git_model.SignCommitWithStatuses, error) {
-	commits, err := git_service.ConvertFromGitCommit(ctx, gitCommits, ctx.Repo.Repository)
+	commits, err := git_service.ConvertFromGitCommit(ctx, gitCommits, ctx.Repo.Repository, ctx.Repo.RefFullName)
 	if err != nil {
 		return nil, err
 	}
diff --git a/routers/web/repo/compare.go b/routers/web/repo/compare.go
index 2b2848afd1..45735fc8fe 100644
--- a/routers/web/repo/compare.go
+++ b/routers/web/repo/compare.go
@@ -391,14 +391,14 @@ func prepareNewPullRequestTitleContent(ci *git_service.CompareInfo, commits []*g
 	if useFirstCommitAsTitle {
 		// the "commits" are from "ShowPrettyFormatLogToList", which is ordered from newest to oldest, here take the oldest one
 		c := commits[len(commits)-1]
-		title = c.UserCommit.MessageTitle()
+		title = c.UserCommit.GitCommit.MessageTitle()
 	} else {
 		title = autoTitleFromBranchName(ci.HeadRef.ShortName())
 	}
 
 	if len(commits) == 1 {
 		c := commits[0]
-		content = c.MessageBody()
+		content = c.GitCommit.MessageBody()
 	}
 
 	var titleTrailer string
diff --git a/routers/web/repo/compare_test.go b/routers/web/repo/compare_test.go
index d5b67ebe56..af0a735227 100644
--- a/routers/web/repo/compare_test.go
+++ b/routers/web/repo/compare_test.go
@@ -9,8 +9,8 @@ import (
 
 	asymkey_model "gitea.dev/models/asymkey"
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/gituser"
 	issues_model "gitea.dev/models/issues"
-	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/setting"
 	git_service "gitea.dev/services/git"
@@ -52,8 +52,8 @@ func TestNewPullRequestTitleContent(t *testing.T) {
 	mockCommit := func(msg string) *git_model.SignCommitWithStatuses {
 		return &git_model.SignCommitWithStatuses{
 			SignCommit: &asymkey_model.SignCommit{
-				UserCommit: &user_model.UserCommit{
-					Commit: &git.Commit{
+				UserCommit: &gituser.UserCommit{
+					GitCommit: &git.Commit{
 						CommitMessage: git.CommitMessage{MessageRaw: msg},
 					},
 				},
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 437eedc57f..6df4e738c9 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -21,6 +21,7 @@ import (
 	asymkey_model "gitea.dev/models/asymkey"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/gituser"
 	repo_model "gitea.dev/models/repo"
 	unit_model "gitea.dev/models/unit"
 	user_model "gitea.dev/models/user"
@@ -132,8 +133,11 @@ func loadLatestCommitData(ctx *context.Context, latestCommit *git.Commit) bool {
 			ctx.ServerError("CalculateTrustStatus", err)
 			return false
 		}
+
+		avatarStackData := gituser.BuildAvatarStackData(ctx, latestCommit.AllParticipantIdentities(), nil)
+		avatarStackData.SearchByEmailLink = gituser.RepoCommitSearchByEmailLink(ctx.Repo.RepoLink, ctx.Repo.RefFullName)
+		ctx.Data["LatestCommitAvatarStackData"] = avatarStackData
 		ctx.Data["LatestCommitVerification"] = verification
-		ctx.Data["LatestCommitUser"] = user_model.ValidateCommitWithEmail(ctx, latestCommit)
 
 		statuses, err := git_model.GetLatestCommitStatus(ctx, ctx.Repo.Repository.ID, latestCommit.ID.String(), db.ListOptionsAll)
 		if err != nil {
diff --git a/routers/web/repo/wiki.go b/routers/web/repo/wiki.go
index e0881dc9f1..6e2133a945 100644
--- a/routers/web/repo/wiki.go
+++ b/routers/web/repo/wiki.go
@@ -361,7 +361,7 @@ func renderRevisionPage(ctx *context.Context) (*git.Repository, *git.TreeEntry)
 		ctx.ServerError("CommitsByFileAndRange", err)
 		return nil, nil
 	}
-	ctx.Data["Commits"], err = git_service.ConvertFromGitCommit(ctx, commitsHistory, ctx.Repo.Repository)
+	ctx.Data["Commits"], err = git_service.ConvertFromGitCommit(ctx, commitsHistory, ctx.Repo.Repository, "") // no current ref sub path for wiki commit list
 	if err != nil {
 		ctx.ServerError("ConvertFromGitCommit", err)
 		return nil, nil
diff --git a/services/actions/cleanup.go b/services/actions/cleanup.go
index dc8f13cdcb..7bf7c93dca 100644
--- a/services/actions/cleanup.go
+++ b/services/actions/cleanup.go
@@ -232,6 +232,10 @@ func DeleteRun(ctx context.Context, run *actions_model.ActionRun) error {
 		RepoID: repoID,
 		RunID:  run.ID,
 	})
+	recordsToDelete = append(recordsToDelete, &actions_model.ActionRunJobSummary{
+		RepoID: repoID,
+		RunID:  run.ID,
+	})
 
 	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		// TODO: Deleting task records could break current ephemeral runner implementation. This is a temporary workaround suggested by ChristopherHX.
diff --git a/services/git/commit.go b/services/git/commit.go
index 5708e162b9..bc0516b5d6 100644
--- a/services/git/commit.go
+++ b/services/git/commit.go
@@ -9,6 +9,7 @@ import (
 	asymkey_model "gitea.dev/models/asymkey"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/gituser"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/container"
@@ -17,14 +18,14 @@ import (
 )
 
 // ParseCommitsWithSignature checks if signaute of commits are corresponding to users gpg keys.
-func ParseCommitsWithSignature(ctx context.Context, repo *repo_model.Repository, oldCommits []*user_model.UserCommit, repoTrustModel repo_model.TrustModelType) ([]*asymkey_model.SignCommit, error) {
+func ParseCommitsWithSignature(ctx context.Context, repo *repo_model.Repository, oldCommits []*gituser.UserCommit, repoTrustModel repo_model.TrustModelType) ([]*asymkey_model.SignCommit, error) {
 	newCommits := make([]*asymkey_model.SignCommit, 0, len(oldCommits))
 	keyMap := map[string]bool{}
 
 	emails := make(container.Set[string])
 	for _, c := range oldCommits {
-		if c.Committer != nil {
-			emails.Add(c.Committer.Email)
+		if c.GitCommit.Committer != nil {
+			emails.Add(c.GitCommit.Committer.Email)
 		}
 	}
 
@@ -34,10 +35,10 @@ func ParseCommitsWithSignature(ctx context.Context, repo *repo_model.Repository,
 	}
 
 	for _, c := range oldCommits {
-		committerUser := emailUsers.GetByEmail(c.Committer.Email) // FIXME: why ValidateCommitsWithEmails uses "Author", but ParseCommitsWithSignature uses "Committer"?
+		committerUser := emailUsers.GetByEmail(c.GitCommit.Committer.Email) // FIXME: why GetUserCommitsByGitCommits uses "Author", but ParseCommitsWithSignature uses "Committer"?
 		signCommit := &asymkey_model.SignCommit{
 			UserCommit:   c,
-			Verification: asymkey_service.ParseCommitWithSignatureCommitter(ctx, c.Commit, committerUser),
+			Verification: asymkey_service.ParseCommitWithSignatureCommitter(ctx, c.GitCommit, committerUser),
 		}
 
 		isOwnerMemberCollaborator := func(user *user_model.User) (bool, error) {
@@ -52,15 +53,15 @@ func ParseCommitsWithSignature(ctx context.Context, repo *repo_model.Repository,
 }
 
 // ConvertFromGitCommit converts git commits into SignCommitWithStatuses
-func ConvertFromGitCommit(ctx context.Context, commits []*git.Commit, repo *repo_model.Repository) ([]*git_model.SignCommitWithStatuses, error) {
-	validatedCommits, err := user_model.ValidateCommitsWithEmails(ctx, commits)
+func ConvertFromGitCommit(ctx context.Context, commits []*git.Commit, repo *repo_model.Repository, currentRef git.RefName) ([]*git_model.SignCommitWithStatuses, error) {
+	userCommits, err := gituser.GetUserCommitsByGitCommits(ctx, commits, repo.Link(), currentRef)
 	if err != nil {
 		return nil, err
 	}
 	signedCommits, err := ParseCommitsWithSignature(
 		ctx,
 		repo,
-		validatedCommits,
+		userCommits,
 		repo.GetTrustModel(),
 	)
 	if err != nil {
@@ -77,7 +78,7 @@ func ParseCommitsWithStatus(ctx context.Context, oldCommits []*asymkey_model.Sig
 		commit := &git_model.SignCommitWithStatuses{
 			SignCommit: c,
 		}
-		statuses, err := git_model.GetLatestCommitStatus(ctx, repo.ID, commit.ID.String(), db.ListOptionsAll)
+		statuses, err := git_model.GetLatestCommitStatus(ctx, repo.ID, commit.GitCommit.ID.String(), db.ListOptionsAll)
 		if err != nil {
 			return nil, err
 		}
diff --git a/services/issue/comments.go b/services/issue/comments.go
index 46964f5f1a..ff6c9fccf5 100644
--- a/services/issue/comments.go
+++ b/services/issue/comments.go
@@ -184,7 +184,7 @@ func LoadCommentPushCommits(ctx context.Context, c *issues_model.Comment) error
 		}
 		defer closer.Close()
 
-		c.Commits, err = git_service.ConvertFromGitCommit(ctx, gitRepo.GetCommitsFromIDs(data.CommitIDs), c.Issue.Repo)
+		c.Commits, err = git_service.ConvertFromGitCommit(ctx, gitRepo.GetCommitsFromIDs(data.CommitIDs), c.Issue.Repo, "") // no current ref sub path for PR commit list
 		if err != nil {
 			log.Debug("ConvertFromGitCommit: %v", err) // no need to show 500 error to end user when the commit does not exist
 		} else {
diff --git a/services/pull/merge_squash.go b/services/pull/merge_squash.go
index 67ec5bb81c..229730257f 100644
--- a/services/pull/merge_squash.go
+++ b/services/pull/merge_squash.go
@@ -65,9 +65,7 @@ func doMergeStyleSquash(ctx *mergeContext, message string) error {
 	}
 
 	if setting.Repository.PullRequest.AddCoCommitterTrailers && ctx.committer.String() != sig.String() {
-		// add trailer
-		message = AddCommitMessageTailer(message, "Co-authored-by", sig.String())
-		message = AddCommitMessageTailer(message, "Co-committed-by", sig.String()) // FIXME: this one should be removed, it is not really used or widely used
+		message = AddCommitMessageTailer(message, git.CoAuthoredByTrailer, sig.String())
 	}
 	cmdCommit := gitcmd.NewCommand("commit").
 		AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
diff --git a/services/pull/pull.go b/services/pull/pull.go
index 0d4a10ae9e..a601450ff2 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -917,7 +917,7 @@ func GetSquashMergeCommitMessages(ctx context.Context, pr *issues_model.PullRequ
 	}
 
 	for _, author := range authors {
-		stringBuilder.WriteString("Co-authored-by: ")
+		stringBuilder.WriteString(git.CoAuthoredByTrailer + ": ")
 		stringBuilder.WriteString(author)
 		stringBuilder.WriteRune('\n')
 	}
diff --git a/services/repository/delete.go b/services/repository/delete.go
index d1b41f980b..0666a1616b 100644
--- a/services/repository/delete.go
+++ b/services/repository/delete.go
@@ -177,6 +177,7 @@ func DeleteRepositoryDirectly(ctx context.Context, repoID int64, ignoreOrgTeams
 		&actions_model.ActionScheduleSpec{RepoID: repoID},
 		&actions_model.ActionSchedule{RepoID: repoID},
 		&actions_model.ActionArtifact{RepoID: repoID},
+		&actions_model.ActionRunJobSummary{RepoID: repoID},
 		&actions_model.ActionRunnerToken{RepoID: repoID},
 		&issues_model.IssuePin{RepoID: repoID},
 	); err != nil {
diff --git a/services/repository/files/temp_repo.go b/services/repository/files/temp_repo.go
index b36f5f192a..553f4232e2 100644
--- a/services/repository/files/temp_repo.go
+++ b/services/repository/files/temp_repo.go
@@ -300,12 +300,7 @@ func (t *TemporaryUploadRepository) CommitTree(ctx context.Context, opts *Commit
 		cmdCommitTree.AddOptionFormat("-S%s", key.KeyID)
 		if t.repo.GetTrustModel() == repo_model.CommitterTrustModel || t.repo.GetTrustModel() == repo_model.CollaboratorCommitterTrustModel {
 			if committerSig.Name != authorSig.Name || committerSig.Email != authorSig.Email {
-				// Add trailers
-				_, _ = messageBytes.WriteString("\n")
-				_, _ = messageBytes.WriteString("Co-authored-by: ")
-				_, _ = messageBytes.WriteString(committerSig.String())
-				_, _ = messageBytes.WriteString("\n")
-				_, _ = messageBytes.WriteString("Co-committed-by: ")
+				_, _ = messageBytes.WriteString("\n" + git.CoAuthoredByTrailer + ": ")
 				_, _ = messageBytes.WriteString(committerSig.String())
 				_, _ = messageBytes.WriteString("\n")
 			}
diff --git a/services/repository/gitgraph/graph_models.go b/services/repository/gitgraph/graph_models.go
index 82092f71f3..99f8222ca7 100644
--- a/services/repository/gitgraph/graph_models.go
+++ b/services/repository/gitgraph/graph_models.go
@@ -13,8 +13,10 @@ import (
 	asymkey_model "gitea.dev/models/asymkey"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/gituser"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/log"
 	asymkey_service "gitea.dev/services/asymkey"
@@ -93,9 +95,7 @@ func (graph *Graph) AddCommit(row, column int, flowID int64, data []byte) error
 // before finally retrieving the latest status
 func (graph *Graph) LoadAndProcessCommits(ctx context.Context, repository *repo_model.Repository, gitRepo *git.Repository) error {
 	var err error
-	var ok bool
-
-	emails := map[string]*user_model.User{}
+	emailSet := make(container.Set[string])
 	keyMap := map[string]bool{}
 
 	for _, c := range graph.Commits {
@@ -106,14 +106,26 @@ func (graph *Graph) LoadAndProcessCommits(ctx context.Context, repository *repo_
 		if err != nil {
 			return fmt.Errorf("GetCommit: %s Error: %w", c.Rev, err)
 		}
-
 		if c.Commit.Author != nil {
-			email := c.Commit.Author.Email
-			if c.User, ok = emails[email]; !ok {
-				c.User, _ = user_model.GetUserByEmail(ctx, email)
-				emails[email] = c.User
-			}
+			emailSet.Add(c.Commit.Author.Email)
 		}
+		for _, sig := range c.Commit.AllParticipantIdentities() {
+			emailSet.Add(sig.Email)
+		}
+	}
+
+	emailUserMap, err := user_model.GetUsersByEmails(ctx, emailSet.Values())
+	if err != nil {
+		log.Error("GetUsersByEmails: %v", err)
+	}
+
+	for _, c := range graph.Commits {
+		if c.Commit == nil {
+			continue
+		}
+
+		c.User = emailUserMap.GetByEmail(c.Commit.Author.Email)
+		c.AvatarStackData = gituser.BuildAvatarStackData(ctx, c.Commit.AllParticipantIdentities(), emailUserMap)
 
 		c.Verification = asymkey_service.ParseCommitWithSignature(ctx, c.Commit)
 
@@ -246,18 +258,19 @@ func newRefsFromRefNames(refNames []byte) []git.Reference {
 
 // Commit represents a commit at coordinate X, Y with the data
 type Commit struct {
-	Commit       *git.Commit
-	User         *user_model.User
-	Verification *asymkey_model.CommitVerification
-	Status       *git_model.CommitStatus
-	Flow         int64
-	Row          int
-	Column       int
-	Refs         []git.Reference
-	Rev          string
-	Date         time.Time
-	ShortRev     string
-	Subject      string
+	Commit          *git.Commit
+	User            *user_model.User // author
+	AvatarStackData *gituser.AvatarStackData
+	Verification    *asymkey_model.CommitVerification
+	Status          *git_model.CommitStatus
+	Flow            int64
+	Row             int
+	Column          int
+	Refs            []git.Reference
+	Rev             string
+	Date            time.Time // author date from "%ad"
+	ShortRev        string
+	Subject         string
 }
 
 // OnlyRelation returns whether this a relation only commit
diff --git a/templates/devtest/avatar-stack.tmpl b/templates/devtest/avatar-stack.tmpl
new file mode 100644
index 0000000000..12d1ff953b
--- /dev/null
+++ b/templates/devtest/avatar-stack.tmpl
@@ -0,0 +1,18 @@
+{{template "devtest/devtest-header"}}
+<div class="page-content devtest ui container">
+	<div>
+		<h1>Avatar Stack</h1>
+		<table class="ui basic table">
+			<thead><tr><th>Scenario</th><th>Rendered</th></tr></thead>
+			<tbody>
+			{{range $s := .AvatarStackScenarios}}
+				<tr>
+					<td>{{$s.Label}}</td>
+					<td>{{ctx.RenderUtils.AvatarStackWithNames $s.Data}}</td>
+				</tr>
+			{{end}}
+			</tbody>
+		</table>
+	</div>
+</div>
+{{template "devtest/devtest-footer"}}
diff --git a/templates/devtest/badge-commit-sign.tmpl b/templates/devtest/badge-commit-sign.tmpl
index a6677c4495..8cfb63a083 100644
--- a/templates/devtest/badge-commit-sign.tmpl
+++ b/templates/devtest/badge-commit-sign.tmpl
@@ -4,7 +4,7 @@
 		<h1>Commit Sign Badges</h1>
 		{{range $commit := .MockCommits}}
 			<div class="flex-text-block tw-my-2">
-				{{template "repo/commit_sign_badge" dict "Commit" $commit "CommitBaseLink" "/devtest/commit" "CommitSignVerification" $commit.Verification}}
+				{{template "repo/commit_sign_badge" dict "Commit" $commit.GitCommit "CommitBaseLink" "/devtest/commit" "CommitSignVerification" $commit.Verification}}
 				{{template "repo/commit_sign_badge" dict "CommitSignVerification" $commit.Verification}}
 			</div>
 		{{end}}
diff --git a/templates/repo/actions/view_component.tmpl b/templates/repo/actions/view_component.tmpl
index 2ed47ad9df..0d508e69e5 100644
--- a/templates/repo/actions/view_component.tmpl
+++ b/templates/repo/actions/view_component.tmpl
@@ -15,9 +15,14 @@
 		data-locale-runs-pushed-by="{{ctx.Locale.Tr "actions.runs.pushed_by"}}"
 		data-locale-summary="{{ctx.Locale.Tr "actions.runs.summary"}}"
 		data-locale-all-jobs="{{ctx.Locale.Tr "actions.runs.all_jobs"}}"
+		data-locale-job-summaries="{{ctx.Locale.Tr "actions.runs.job_summaries"}}"
 		data-locale-expand-caller-jobs="{{ctx.Locale.Tr "actions.runs.expand_caller_jobs"}}"
 		data-locale-collapse-caller-jobs="{{ctx.Locale.Tr "actions.runs.collapse_caller_jobs"}}"
 		data-locale-triggered-via="{{ctx.Locale.Tr "actions.runs.triggered_via"}}"
+		data-locale-rerun-triggered="{{ctx.Locale.Tr "actions.runs.rerun_triggered"}}"
+		data-locale-back-to-pull-request="{{ctx.Locale.Tr "actions.runs.back_to_pull_request"}}"
+		data-locale-back-to-workflow="{{ctx.Locale.Tr "actions.runs.back_to_workflow"}}"
+		data-locale-status-label="{{ctx.Locale.Tr "actions.runs.status"}}"
 		data-locale-total-duration="{{ctx.Locale.Tr "actions.runs.total_duration"}}"
 		data-locale-run-details="{{ctx.Locale.Tr "actions.runs.run_details"}}"
 		data-locale-workflow-file="{{ctx.Locale.Tr "actions.runs.workflow_file"}}"
diff --git a/templates/repo/blame.tmpl b/templates/repo/blame.tmpl
index 8bdefa5d43..d108ea3379 100644
--- a/templates/repo/blame.tmpl
+++ b/templates/repo/blame.tmpl
@@ -43,7 +43,7 @@
 								<div class="blame-info">
 									<div class="blame-data">
 										<div class="blame-avatar">
-											{{$row.Avatar}}
+											{{if $row.AvatarStackData}}{{ctx.RenderUtils.AvatarStack $row.AvatarStackData}}{{end}}
 										</div>
 										<div class="blame-message muted-links" title="{{$row.CommitMessage}}">
 											{{ctx.RenderUtils.RenderCommitMessageLinkSubject $row.CommitMessage $row.CommitURL $.Repository}}
diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl
index 9618eda761..76fbf3c159 100644
--- a/templates/repo/commit_page.tmpl
+++ b/templates/repo/commit_page.tmpl
@@ -154,6 +154,29 @@
 				{{end}}
 			</div>
 
+			{{if .CommitOtherParticipants}}
+				<div class="flex-text-inline">
+					<span class="tw-text-text-light">{{ctx.Locale.Tr "repo.diff.coauthored_by"}}</span>
+					{{range $participant := .CommitOtherParticipants}}
+						{{$user := $participant.GiteaUser}}
+						{{$gitIdentity := $participant.GitIdentity}}
+						{{if $user}}
+							{{ctx.AvatarUtils.Avatar $user 20}}
+							<a class="muted" href="{{$user.HomeLink}}"><strong>{{$user.GetDisplayName}}</strong></a>
+						{{else}}
+							{{$gitName := $gitIdentity.Name}}
+							{{$gitEmail := $gitIdentity.Email}}
+							{{ctx.AvatarUtils.AvatarByEmail $gitEmail $gitName 20}}
+							{{if $gitEmail}}
+								<a class="muted" href="mailto:{{$gitEmail}}"><strong>{{$gitName}}</strong></a>
+							{{else}}
+								<strong>{{$gitName}}</strong>
+							{{end}}
+						{{end}}
+					{{end}}
+				</div>
+			{{end}}
+
 			{{if .Verification}}
 				{{template "repo/commit_sign_badge" dict "CommitSignVerification" .Verification}}
 			{{end}}
diff --git a/templates/repo/commit_sign_badge.tmpl b/templates/repo/commit_sign_badge.tmpl
index f63e4ec899..bf8185fd0b 100644
--- a/templates/repo/commit_sign_badge.tmpl
+++ b/templates/repo/commit_sign_badge.tmpl
@@ -64,10 +64,10 @@ so this template should be kept as small as possible, DO NOT put large component
 		{{- if $verified -}}
 			{{- if and $signingUser $signingUser.ID -}}
 				<span data-tooltip-content="{{$msgReason}}">{{svg "gitea-lock"}}</span>
-				<span data-tooltip-content="{{$msgSigningKey}}">{{ctx.AvatarUtils.Avatar $signingUser 16}}</span>
+				<span data-tooltip-content="{{$msgSigningKey}}">{{ctx.AvatarUtils.Avatar $signingUser 20}}</span>
 			{{- else -}}
 				<span data-tooltip-content="{{$msgReason}}">{{svg "gitea-lock-cog"}}</span>
-				<span data-tooltip-content="{{$msgSigningKey}}">{{ctx.AvatarUtils.AvatarByEmail $signingEmail "" 16}}</span>
+				<span data-tooltip-content="{{$msgSigningKey}}">{{ctx.AvatarUtils.AvatarByEmail $signingEmail "" 20}}</span>
 			{{- end -}}
 		{{- else -}}
 			<span data-tooltip-content="{{$msgReason}}">{{svg "gitea-unlock"}}</span>
diff --git a/templates/repo/commits_list.tmpl b/templates/repo/commits_list.tmpl
index e79d189b8d..7a99bc7ac2 100644
--- a/templates/repo/commits_list.tmpl
+++ b/templates/repo/commits_list.tmpl
@@ -2,27 +2,21 @@
 	<table class="ui very basic table unstackable" id="commits-table">
 		<thead>
 			<tr>
-				<th class="three wide">{{ctx.Locale.Tr "repo.commits.author"}}</th>
+				<th class="four wide">{{ctx.Locale.Tr "repo.commits.author"}}</th>
 				<th class="two wide sha">{{StringUtils.ToUpper $.Repository.ObjectFormatName}}</th>
-				<th class="eight wide message">{{ctx.Locale.Tr "repo.commits.message"}}</th>
+				<th class="seven wide message">{{ctx.Locale.Tr "repo.commits.message"}}</th>
 				<th class="two wide tw-text-right">{{ctx.Locale.Tr "repo.commits.date"}}</th>
 				<th class="one wide"></th>
 			</tr>
 		</thead>
 		<tbody class="commit-list">
 			{{$commitRepoLink := $.RepoLink}}{{if $.CommitRepoLink}}{{$commitRepoLink = $.CommitRepoLink}}{{end}}
-			{{range $commit := .Commits}}
+			{{range $commit := $.Commits}}
+				{{$gitCommit := $commit.GitCommit}}
+				{{$commitID := $gitCommit.ID.String}}
 				<tr>
 					<td class="author">
-						<span class="author-wrapper">
-							{{- if .User -}}
-								{{- ctx.AvatarUtils.Avatar .User 20 "tw-mr-2" -}}
-								{{- .User.GetShortDisplayNameLinkHTML -}}
-							{{- else -}}
-								{{- ctx.AvatarUtils.AvatarByEmail .Author.Email .Author.Name 20 "tw-mr-2" -}}
-								{{- .Author.Name -}}
-							{{- end -}}
-						</span>
+						{{ctx.RenderUtils.AvatarStackWithNames $commit.AvatarStackData}}
 					</td>
 					<td class="sha">
 						{{$commitBaseLink := ""}}
@@ -33,52 +27,48 @@
 						{{else}}
 							{{$commitBaseLink = printf "%s/commit" $commitRepoLink}}
 						{{end}}
-						{{template "repo/commit_sign_badge" dict "Commit" . "CommitBaseLink" $commitBaseLink "CommitSignVerification" .Verification}}
+						{{template "repo/commit_sign_badge" dict "Commit" $gitCommit "CommitBaseLink" $commitBaseLink "CommitSignVerification" .Verification}}
 					</td>
 					<td class="message">
 						<span class="message-wrapper">
 						{{if $.PageIsWiki}}
-							<span class="commit-summary {{if gt $commit.ParentCount 1}} grey text{{end}}" title="{{$commit.MessageTitle}}">
-								{{$commit.MessageTitle | ctx.RenderUtils.RenderEmoji}}
+							<span class="commit-summary {{if gt $gitCommit.ParentCount 1}} grey text{{end}}" title="{{$gitCommit.MessageTitle}}">
+								{{$gitCommit.MessageTitle | ctx.RenderUtils.RenderEmoji}}
 							</span>
 						{{else}}
-							{{$commitLink:= printf "%s/commit/%s" $commitRepoLink (PathEscape $commit.ID.String)}}
-							<span class="commit-summary {{if gt $commit.ParentCount 1}} grey text{{end}}" title="{{$commit.MessageTitle}}">
-								{{ctx.RenderUtils.RenderCommitMessageLinkSubject $commit.MessageUTF8 $commitLink $.Repository}}
+							{{$commitLink:= printf "%s/commit/%s" $commitRepoLink (PathEscape $commitID)}}
+							<span class="commit-summary {{if gt $gitCommit.ParentCount 1}} grey text{{end}}" title="{{$gitCommit.MessageTitle}}">
+								{{ctx.RenderUtils.RenderCommitMessageLinkSubject $gitCommit.MessageUTF8 $commitLink $.Repository}}
 							</span>
 						{{end}}
 						</span>
-						{{if $commit.MessageBody}}
+						{{if $gitCommit.MessageBody}}
 						<button class="ui button ellipsis-button" aria-expanded="false" data-global-click="onRepoEllipsisButtonClick">...</button>
 						{{end}}
 						{{template "repo/commit_statuses" dict "Status" .Status "Statuses" .Statuses}}
-						{{if $commit.MessageBody}}
-						<pre class="commit-body tw-hidden">{{ctx.RenderUtils.RenderCommitBody $commit.MessageUTF8 $.Repository}}</pre>
+						{{if $gitCommit.MessageBody}}
+						<pre class="commit-body tw-hidden">{{ctx.RenderUtils.RenderCommitBody $gitCommit.MessageUTF8 $.Repository}}</pre>
 						{{end}}
 						{{if $.CommitsTagsMap}}
-							{{range (index $.CommitsTagsMap .ID.String)}}
+							{{range (index $.CommitsTagsMap $commitID)}}
 								{{- template "repo/tag/name" dict "AdditionalClasses" "tw-py-0" "RepoLink" $.Repository.Link "TagName" .TagName "IsRelease" (not .IsTag) -}}
 							{{end}}
 						{{end}}
 					</td>
-					{{if .Committer}}
-						<td class="tw-text-right">{{DateUtils.TimeSince .Committer.When}}</td>
-					{{else}}
-						<td class="tw-text-right">{{DateUtils.TimeSince .Author.When}}</td>
-					{{end}}
+					<td class="tw-text-right">{{DateUtils.TimeSince $gitCommit.Committer.When}}</td>
 					<td class="tw-text-right tw-py-0">
-						<button class="btn interact-bg tw-p-2 copy-commit-id" data-tooltip-content="{{ctx.Locale.Tr "copy_hash"}}" data-clipboard-text="{{.ID}}">{{svg "octicon-copy"}}</button>
+						<button class="btn interact-bg tw-p-2 copy-commit-id" data-tooltip-content="{{ctx.Locale.Tr "copy_hash"}}" data-clipboard-text="{{$commitID}}">{{svg "octicon-copy"}}</button>
 						{{/* at the moment, wiki doesn't support these "view" links like "view at history point" */}}
 						{{if not $.PageIsWiki}}
 							{{/* view single file diff */}}
 							{{if $.FileTreePath}}
 							<a class="btn interact-bg tw-p-2 view-single-diff" data-tooltip-content="{{ctx.Locale.Tr "repo.commits.view_file_diff"}}"
-								href="{{$commitRepoLink}}/commit/{{.ID.String}}?files={{$.FileTreePath}}"
+								href="{{$commitRepoLink}}/commit/{{$commitID}}?files={{$.FileTreePath}}"
 							>{{svg "octicon-file-diff"}}</a>
 							{{end}}
 
 							{{/* view at history point */}}
-							{{$viewCommitLink := printf "%s/src/commit/%s" $commitRepoLink (PathEscape .ID.String)}}
+							{{$viewCommitLink := printf "%s/src/commit/%s" $commitRepoLink (PathEscape $commitID)}}
 							{{if $.FileTreePath}}{{$viewCommitLink = printf "%s/%s" $viewCommitLink (PathEscapeSegments $.FileTreePath)}}{{end}}
 							<a class="btn interact-bg tw-p-2 view-commit-path" data-tooltip-content="{{ctx.Locale.Tr "repo.commits.view_path"}}" href="{{$viewCommitLink}}">{{svg "octicon-file-code"}}</a>
 						{{end}}
diff --git a/templates/repo/commits_list_small.tmpl b/templates/repo/commits_list_small.tmpl
index c5f0d5b590..2dd6727e93 100644
--- a/templates/repo/commits_list_small.tmpl
+++ b/templates/repo/commits_list_small.tmpl
@@ -1,35 +1,32 @@
 {{$index := 0}}
 <div class="timeline-item commits-list">
-{{range $commit := .comment.Commits}}
+{{range $commit := $.comment.Commits}}
+	{{$gitCommit := $commit.GitCommit}}
 	{{$tag := printf "%s-%d" $.comment.HashTag $index}}
 	{{$index = Eval $index "+" 1}}
 	<div class="flex-text-block" id="{{$tag}}">{{/*singular-commit*/}}
 		<span class="badge badge-commit">{{svg "octicon-git-commit"}}</span>
-		{{if .User}}
-			<a class="avatar" href="{{.User.HomeLink}}">{{ctx.AvatarUtils.Avatar .User 20}}</a>
-		{{else}}
-			{{ctx.AvatarUtils.AvatarByEmail .Author.Email .Author.Name 20}}
-		{{end}}
+		{{ctx.RenderUtils.AvatarStack $commit.AvatarStackData}}
 
 		{{$commitBaseLink := printf "%s/commit" $.comment.Issue.PullRequest.BaseRepo.Link}}
-		{{$commitLink:= printf "%s/%s" $commitBaseLink (PathEscape .ID.String)}}
+		{{$commitLink:= printf "%s/%s" $commitBaseLink (PathEscape $gitCommit.ID.String)}}
 
-		<span class="tw-flex-1 tw-font-mono gt-ellipsis" title="{{$commit.MessageTitle}}">
-			{{- ctx.RenderUtils.RenderCommitMessageLinkSubject $commit.MessageUTF8 $commitLink $.comment.Issue.PullRequest.BaseRepo -}}
+		<span class="tw-flex-1 tw-font-mono gt-ellipsis" title="{{$gitCommit.MessageTitle}}">
+			{{- ctx.RenderUtils.RenderCommitMessageLinkSubject $gitCommit.MessageUTF8 $commitLink $.comment.Issue.PullRequest.BaseRepo -}}
 		</span>
 
-		{{if $commit.MessageBody}}
+		{{if $gitCommit.MessageBody}}
 			<button class="ui button ellipsis-button show-panel toggle" data-panel="[data-singular-commit-body-for='{{$tag}}']">...</button>
 		{{end}}
 
 		<span class="flex-text-block">
-			{{template "repo/commit_statuses" dict "Status" .Status "Statuses" .Statuses}}
-			{{template "repo/commit_sign_badge" dict "Commit" . "CommitBaseLink" $commitBaseLink "CommitSignVerification" .Verification}}
+			{{template "repo/commit_statuses" dict "Status" $commit.Status "Statuses" $commit.Statuses}}
+			{{template "repo/commit_sign_badge" dict "Commit" $gitCommit "CommitBaseLink" $commitBaseLink "CommitSignVerification" $commit.Verification}}
 		</span>
 	</div>
-	{{if $commit.MessageBody}}
+	{{if $gitCommit.MessageBody}}
 	<pre class="commit-body tw-ml-[33px] tw-hidden" data-singular-commit-body-for="{{$tag}}">
-		{{- ctx.RenderUtils.RenderCommitBody $commit.MessageUTF8 $.comment.Issue.PullRequest.BaseRepo -}}
+		{{- ctx.RenderUtils.RenderCommitBody $gitCommit.MessageUTF8 $.comment.Issue.PullRequest.BaseRepo -}}
 	</pre>
 	{{end}}
 {{end}}
diff --git a/templates/repo/graph/commits.tmpl b/templates/repo/graph/commits.tmpl
index d86f73fe65..b9288da911 100644
--- a/templates/repo/graph/commits.tmpl
+++ b/templates/repo/graph/commits.tmpl
@@ -41,14 +41,7 @@
 					</span>
 
 					<span class="flex-text-inline tw-text-12">
-						{{if $commit.User}}
-							{{ctx.AvatarUtils.Avatar $commit.User 18}}
-							{{$commit.User.GetShortDisplayNameLinkHTML}}
-						{{else}}
-							{{$gitUserName := $commit.Commit.Author.Name}}
-							{{ctx.AvatarUtils.AvatarByEmail $commit.Commit.Author.Email $gitUserName 18}}
-							{{$gitUserName}}
-						{{end}}
+						{{ctx.RenderUtils.AvatarStackWithNames $commit.AvatarStackData}}
 					</span>
 
 					<span class="time flex-text-inline">{{DateUtils.FullTime $commit.Date}}</span>
diff --git a/templates/repo/latest_commit.tmpl b/templates/repo/latest_commit.tmpl
index c0518189b8..b2aebf0d42 100644
--- a/templates/repo/latest_commit.tmpl
+++ b/templates/repo/latest_commit.tmpl
@@ -2,15 +2,7 @@
 {{if not .LatestCommit}}
 	…
 {{else}}
-	<span class="author-wrapper">
-	{{- if .LatestCommitUser -}}
-		{{- ctx.AvatarUtils.Avatar .LatestCommitUser 20 "tw-mr-2" -}}
-		<strong>{{.LatestCommitUser.GetShortDisplayNameLinkHTML}}</strong>
-	{{- else if .LatestCommit.Author -}}
-		{{- ctx.AvatarUtils.AvatarByEmail .LatestCommit.Author.Email .LatestCommit.Author.Name 20 "tw-mr-2" -}}
-		<strong>{{.LatestCommit.Author.Name}}</strong>
-	{{- end -}}
-	</span>
+	{{ctx.RenderUtils.AvatarStackWithNames .LatestCommitAvatarStackData}}
 
 	{{template "repo/commit_sign_badge" dict "Commit" .LatestCommit "CommitBaseLink" (print .RepoLink "/commit") "CommitSignVerification" .LatestCommitVerification}}
 
diff --git a/templates/user/dashboard/feeds.tmpl b/templates/user/dashboard/feeds.tmpl
index 9afb61887c..ab02522c20 100644
--- a/templates/user/dashboard/feeds.tmpl
+++ b/templates/user/dashboard/feeds.tmpl
@@ -89,10 +89,10 @@
 					{{$repo := .Repo}}
 					<div class="tw-flex tw-flex-col tw-gap-1">
 						{{range $pushCommit := $push.Commits}}
-							{{$commitLink := printf "%s/commit/%s" $repoLink .Sha1}}
+							{{$commitLink := printf "%s/commit/%s" $repoLink $pushCommit.Sha1}}
 							<div class="flex-text-block">
-								<img loading="lazy" alt class="ui avatar" src="{{$push.AvatarLink ctx .AuthorEmail}}" title="{{.AuthorName}}" width="16" height="16">
-								<a class="ui sha label" href="{{$commitLink}}">{{ShortSha .Sha1}}</a>
+								{{ctx.RenderUtils.AvatarStackPushCommit $pushCommit}}
+								<a class="ui sha label" href="{{$commitLink}}">{{ShortSha $pushCommit.Sha1}}</a>
 								<span class="tw-inline-block tw-truncate">
 									{{ctx.RenderUtils.RenderCommitMessage $pushCommit.Message $repo}}
 								</span>
diff --git a/tests/integration/actions_route_test.go b/tests/integration/actions_route_test.go
index 1591a17ae0..862656186b 100644
--- a/tests/integration/actions_route_test.go
+++ b/tests/integration/actions_route_test.go
@@ -63,18 +63,51 @@ jobs:
 	task2 := runner2.fetchTask(t)
 	_, job2, run2 := getTaskAndJobAndRunByTaskID(t, task2.Id)
 
+	require.NoError(t, actions_model.UpsertActionRunJobSummary(t.Context(), repo1.ID, run1.ID, job1.RunAttemptID, job1.ID, 0, "text/markdown", []byte("### Hello summary\n\nFrom first step.\n")))
+	require.NoError(t, actions_model.UpsertActionRunJobSummary(t.Context(), repo1.ID, run1.ID, job1.RunAttemptID, job1.ID, 1, "text/markdown", []byte("From second step.\n")))
+	// A second job's summary in the same run/attempt: the run view must include it,
+	// but the single-job view must scope it out.
+	otherJobID := job1.ID + 1
+	require.NoError(t, actions_model.UpsertActionRunJobSummary(t.Context(), repo1.ID, run1.ID, job1.RunAttemptID, otherJobID, 0, "text/markdown", []byte("### Other job summary\n")))
+
 	req := NewRequest(t, "GET", fmt.Sprintf("/%s/%s/actions/runs/%d", user2.Name, repo1.Name, run1.ID))
 	user2Session.MakeRequest(t, req, http.StatusOK)
 
 	req = NewRequest(t, "GET", fmt.Sprintf("/%s/%s/actions/runs/%d", user2.Name, repo1.Name, 999999))
 	user2Session.MakeRequest(t, req, http.StatusNotFound)
 
-	// run1 and job1 belong to repo1, success
-	req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d", user2.Name, repo1.Name, run1.ID, job1.ID))
+	findSummary := func(viewResp *actions_web.ViewResponse, jobID int64) *actions_web.ViewJobSummary {
+		for _, s := range viewResp.State.Run.JobSummaries {
+			if s.JobID == jobID {
+				return s
+			}
+		}
+		return nil
+	}
+	assertJob1Summary := func(t *testing.T, s *actions_web.ViewJobSummary) {
+		t.Helper()
+		require.NotNil(t, s)
+		assert.Contains(t, string(s.SummaryHTML), "Hello summary")
+		assert.Contains(t, string(s.SummaryHTML), "From second step")
+	}
+
+	// Run view: summaries for every job in the run.
+	req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d", user2.Name, repo1.Name, run1.ID))
 	resp := user2Session.MakeRequest(t, req, http.StatusOK)
 	viewResp := DecodeJSON(t, resp, &actions_web.ViewResponse{})
+	require.Len(t, viewResp.State.Run.JobSummaries, 2)
+	assertJob1Summary(t, findSummary(viewResp, job1.ID))
+	assert.Contains(t, string(findSummary(viewResp, otherJobID).SummaryHTML), "Other job summary")
+
+	// Job view: scoped server-side to the requested job, the other job's summary excluded.
+	req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d", user2.Name, repo1.Name, run1.ID, job1.ID))
+	resp = user2Session.MakeRequest(t, req, http.StatusOK)
+	viewResp = DecodeJSON(t, resp, &actions_web.ViewResponse{})
 	assert.Len(t, viewResp.State.Run.Jobs, 1)
 	assert.Equal(t, job1.ID, viewResp.State.Run.Jobs[0].ID)
+	require.Len(t, viewResp.State.Run.JobSummaries, 1)
+	assertJob1Summary(t, findSummary(viewResp, job1.ID))
+	assert.Nil(t, findSummary(viewResp, otherJobID))
 
 	// run2 and job2 do not belong to repo1, failure
 	req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d", user2.Name, repo1.Name, run2.ID, job2.ID))
diff --git a/tests/integration/api_actions_artifact_test.go b/tests/integration/api_actions_artifact_test.go
index 9e8444525f..75b91b6135 100644
--- a/tests/integration/api_actions_artifact_test.go
+++ b/tests/integration/api_actions_artifact_test.go
@@ -17,10 +17,13 @@ import (
 	"testing"
 
 	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
 	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -44,6 +47,148 @@ func prepareTestEnvActionsArtifacts(t *testing.T) func() {
 	return f
 }
 
+func getArtifactFixtureTask(t *testing.T) *actions_model.ActionTask {
+	t.Helper()
+
+	task, err := actions_model.GetRunningTaskByToken(t.Context(), "8061e833a55f6fc0157c98b883e91fcfeeb1a71a")
+	require.NoError(t, err)
+	require.NoError(t, task.LoadJob(t.Context()))
+	ensureArtifactFixtureTaskSteps(t, task)
+	return task
+}
+
+func ensureArtifactFixtureTaskSteps(t *testing.T, task *actions_model.ActionTask) {
+	t.Helper()
+
+	steps, err := actions_model.GetTaskStepsByTaskID(t.Context(), task.ID)
+	require.NoError(t, err)
+
+	existingIndexes := make(map[int64]bool, len(steps))
+	for _, step := range steps {
+		existingIndexes[step.Index] = true
+	}
+
+	var stepsToInsert []*actions_model.ActionTaskStep
+	for _, idx := range []int64{0, 1} {
+		if existingIndexes[idx] {
+			continue
+		}
+		stepsToInsert = append(stepsToInsert, &actions_model.ActionTaskStep{
+			TaskID: task.ID,
+			Index:  idx,
+			RepoID: task.RepoID,
+			Status: actions_model.StatusWaiting,
+		})
+	}
+	if len(stepsToInsert) == 0 {
+		return
+	}
+
+	_, err = db.GetEngine(t.Context()).Insert(stepsToInsert)
+	require.NoError(t, err)
+}
+
+func TestActionsJobSummaryUpload(t *testing.T) {
+	defer prepareTestEnvActionsArtifacts(t)()
+
+	const runnerToken = "8061e833a55f6fc0157c98b883e91fcfeeb1a71a"
+	task := getArtifactFixtureTask(t)
+	summaryURL := func(stepIndex int64) string {
+		return fmt.Sprintf("/api/actions_pipeline/_apis/pipelines/workflows/%d/jobs/%d/steps/%d/summary", task.Job.RunID, task.Job.ID, stepIndex)
+	}
+	putSummary := func(stepIndex int64, body, contentType string) *RequestWrapper {
+		return NewRequestWithBody(t, "PUT", summaryURL(stepIndex), strings.NewReader(body)).
+			AddTokenAuth(runnerToken).
+			SetHeader("Content-Type", contentType)
+	}
+
+	t.Run("success", func(t *testing.T) {
+		body := "### Uploaded summary\n\n- line one\n"
+		MakeRequest(t, putSummary(0, body, "text/markdown; charset=utf-8"), http.StatusOK)
+
+		summary, err := actions_model.GetActionRunJobSummary(t.Context(), task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, 0)
+		require.NoError(t, err)
+		assert.Equal(t, actions_model.JobSummaryContentTypeMarkdown, summary.ContentType)
+		assert.Equal(t, body, summary.Content)
+
+		staleUpdated := summary.Updated - 60
+		_, err = db.GetEngine(t.Context()).ID(summary.ID).Cols("updated").Update(&actions_model.ActionRunJobSummary{Updated: staleUpdated})
+		require.NoError(t, err)
+
+		updatedBody := "### Updated summary\n\n- refreshed\n"
+		MakeRequest(t, putSummary(0, updatedBody, actions_model.JobSummaryContentTypeMarkdown), http.StatusOK)
+
+		summary, err = actions_model.GetActionRunJobSummary(t.Context(), task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, 0)
+		require.NoError(t, err)
+		assert.Equal(t, updatedBody, summary.Content)
+		assert.Greater(t, summary.Updated, staleUpdated)
+
+		stepTwoBody := "### Second step summary\n\n- another step\n"
+		MakeRequest(t, putSummary(1, stepTwoBody, actions_model.JobSummaryContentTypeMarkdown), http.StatusOK)
+
+		summary, err = actions_model.GetActionRunJobSummary(t.Context(), task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, 1)
+		require.NoError(t, err)
+		assert.Equal(t, stepTwoBody, summary.Content)
+
+		summaries, err := actions_model.ListActionRunJobSummaries(t.Context(), task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, 0)
+		require.NoError(t, err)
+		require.Len(t, summaries, 2)
+		assert.Equal(t, int64(0), summaries[0].StepIndex)
+		assert.Equal(t, int64(1), summaries[1].StepIndex)
+	})
+
+	t.Run("invalid-content-type", func(t *testing.T) {
+		resp := MakeRequest(t, putSummary(0, "summary", "text/html"), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "invalid summary content type")
+	})
+
+	t.Run("size-limit", func(t *testing.T) {
+		resp := MakeRequest(t, putSummary(0, strings.Repeat("a", actions_model.MaxJobSummarySize+1), actions_model.JobSummaryContentTypeMarkdown), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "invalid summary")
+	})
+
+	t.Run("aggregate-size-limit", func(t *testing.T) {
+		require.NoError(t, actions_model.UpsertActionRunJobSummary(t.Context(), task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, 0,
+			actions_model.JobSummaryContentTypeMarkdown, []byte(strings.Repeat("a", actions_model.MaxJobSummaryAggregateSize-1024))))
+		resp := MakeRequest(t, putSummary(1, strings.Repeat("b", 4096), actions_model.JobSummaryContentTypeMarkdown), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "aggregate size exceeded")
+	})
+
+	t.Run("job-mismatch", func(t *testing.T) {
+		req := NewRequestWithBody(t, "PUT", fmt.Sprintf("/api/actions_pipeline/_apis/pipelines/workflows/%d/jobs/%d/steps/0/summary", task.Job.RunID, task.Job.ID+1), strings.NewReader("summary")).
+			AddTokenAuth(runnerToken).
+			SetHeader("Content-Type", actions_model.JobSummaryContentTypeMarkdown)
+		resp := MakeRequest(t, req, http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "job_id mismatch")
+	})
+
+	t.Run("run-mismatch", func(t *testing.T) {
+		req := NewRequestWithBody(t, "PUT", fmt.Sprintf("/api/actions_pipeline/_apis/pipelines/workflows/%d/jobs/%d/steps/0/summary", task.Job.RunID+1, task.Job.ID), strings.NewReader("summary")).
+			AddTokenAuth(runnerToken).
+			SetHeader("Content-Type", actions_model.JobSummaryContentTypeMarkdown)
+		resp := MakeRequest(t, req, http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "run-id does not match")
+	})
+
+	t.Run("invalid-step-index", func(t *testing.T) {
+		resp := MakeRequest(t, putSummary(-1, "summary", actions_model.JobSummaryContentTypeMarkdown), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "invalid step_index")
+	})
+
+	t.Run("step-index-mismatch", func(t *testing.T) {
+		resp := MakeRequest(t, putSummary(999, "summary", actions_model.JobSummaryContentTypeMarkdown), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "step_index mismatch")
+	})
+
+	t.Run("empty-body-clears", func(t *testing.T) {
+		MakeRequest(t, putSummary(0, "### keep me", actions_model.JobSummaryContentTypeMarkdown), http.StatusOK)
+		MakeRequest(t, putSummary(0, "", actions_model.JobSummaryContentTypeMarkdown), http.StatusOK)
+
+		_, err := actions_model.GetActionRunJobSummary(t.Context(), task.Job.RepoID, task.Job.RunID, task.Job.RunAttemptID, task.Job.ID, 0)
+		require.ErrorIs(t, err, util.ErrNotExist)
+	})
+}
+
 func TestActionsArtifactUploadSingleFile(t *testing.T) {
 	defer prepareTestEnvActionsArtifacts(t)()
 
diff --git a/tests/integration/git_helper_for_declarative_test.go b/tests/integration/git_helper_for_declarative_test.go
index 3b374a094e..bd0aedf6c9 100644
--- a/tests/integration/git_helper_for_declarative_test.go
+++ b/tests/integration/git_helper_for_declarative_test.go
@@ -15,6 +15,7 @@ import (
 	"testing"
 	"time"
 
+	"gitea.dev/modules/generate"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/git/gitcmd"
 	"gitea.dev/modules/setting"
@@ -33,7 +34,7 @@ func withKeyFile(t *testing.T, keyname string, callback func(string)) {
 	assert.NoError(t, err)
 
 	keyFile := filepath.Join(tmpDir, keyname)
-	err = ssh.GenKeyPair(keyFile)
+	err = ssh.GenKeyPair(keyFile, generate.SSHKeyECDSA, 0)
 	assert.NoError(t, err)
 
 	err = os.WriteFile(filepath.Join(tmpDir, "ssh"), []byte("#!/bin/bash\n"+
diff --git a/tests/integration/repo_commits_test.go b/tests/integration/repo_commits_test.go
index 9335ef7065..b55e1372c9 100644
--- a/tests/integration/repo_commits_test.go
+++ b/tests/integration/repo_commits_test.go
@@ -38,11 +38,15 @@ func TestRepoCommits(t *testing.T) {
 		doc.doc.Find("#commits-table .commit-id-short").Each(func(i int, s *goquery.Selection) {
 			commits = append(commits, path.Base(s.AttrOr("href", "")))
 		})
-		doc.doc.Find("#commits-table .author-wrapper a").Each(func(i int, s *goquery.Selection) {
+		doc.doc.Find("#commits-table .avatar-stack-names a.muted").Each(func(i int, s *goquery.Selection) {
 			userHrefs = append(userHrefs, s.AttrOr("href", ""))
 		})
 		assert.Equal(t, []string{"69554a64c1e6030f051e5c3f94bfbd773cd6a324", "27566bd5738fc8b4e3fef3c5e72cce608537bd95", "5099b81332712fe655e34e8dd63574f503f61811"}, commits)
-		assert.Equal(t, []string{"/user2", "/user21", "/user2"}, userHrefs)
+		assert.Equal(t, []string{
+			"/user2/repo16/commits/branch/master/search?q=author%3Auser2%40example.com",
+			"/user2/repo16/commits/branch/master/search?q=author%3Auser21%40example.com",
+			"/user2/repo16/commits/branch/master/search?q=author%3Auser2%40example.com",
+		}, userHrefs)
 	})
 
 	t.Run("LastCommit", func(t *testing.T) {
@@ -50,9 +54,9 @@ func TestRepoCommits(t *testing.T) {
 		resp := session.MakeRequest(t, req, http.StatusOK)
 		doc := NewHTMLParser(t, resp.Body)
 		commitHref := doc.doc.Find(".latest-commit .commit-id-short").AttrOr("href", "")
-		authorHref := doc.doc.Find(".latest-commit .author-wrapper a").AttrOr("href", "")
+		authorHref := doc.doc.Find(".latest-commit .avatar-stack-names a").AttrOr("href", "")
 		assert.Equal(t, "/user2/repo16/commit/69554a64c1e6030f051e5c3f94bfbd773cd6a324", commitHref)
-		assert.Equal(t, "/user2", authorHref)
+		assert.Equal(t, "/user2/repo16/commits/branch/master/search?q=author%3Auser2%40example.com", authorHref)
 	})
 
 	t.Run("CommitListNonExistingCommiter", func(t *testing.T) {
@@ -65,7 +69,7 @@ func TestRepoCommits(t *testing.T) {
 		doc := NewHTMLParser(t, resp.Body)
 		commitHref := doc.doc.Find("#commits-table tr:first-child .commit-id-short").AttrOr("href", "")
 		assert.Equal(t, "/user2/repo1/commit/985f0301dba5e7b34be866819cd15ad3d8f508ee", commitHref)
-		authorElem := doc.doc.Find("#commits-table tr:first-child .author-wrapper")
+		authorElem := doc.doc.Find("#commits-table tr:first-child .avatar-stack-names")
 		assert.Equal(t, "6543", strings.TrimSpace(authorElem.Text()))
 	})
 
@@ -97,7 +101,7 @@ func TestRepoCommits(t *testing.T) {
 		doc := NewHTMLParser(t, resp.Body)
 		commitHref := doc.doc.Find(".latest-commit .commit-id-short").AttrOr("href", "")
 		assert.Equal(t, "/user2/repo1/commit/985f0301dba5e7b34be866819cd15ad3d8f508ee", commitHref)
-		authorElem := doc.doc.Find(".latest-commit .author-wrapper")
+		authorElem := doc.doc.Find(".latest-commit .avatar-stack-names")
 		assert.Equal(t, "6543", strings.TrimSpace(authorElem.Text()))
 	})
 }
diff --git a/web_src/css/avatar.css b/web_src/css/avatar.css
new file mode 100644
index 0000000000..3b34b8207f
--- /dev/null
+++ b/web_src/css/avatar.css
@@ -0,0 +1,125 @@
+img.ui.avatar,
+.ui.avatar img,
+.ui.avatar svg {
+  border-radius: var(--border-radius);
+  object-fit: contain;
+  aspect-ratio: 1;
+}
+
+.avatar-stack-names {
+  display: inline-flex;
+  align-items: center;
+  align-self: center;
+  gap: 4px;
+  white-space: nowrap;
+  vertical-align: middle;
+}
+
+.avatar-stack-names > a.muted,
+.avatar-stack-names > .avatar-stack-popup-trigger {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  max-width: 240px;
+}
+
+/* use semibold for latest commit author */
+.latest-commit .avatar-stack-names > a,
+.latest-commit .avatar-stack-names > .avatar-stack-popup-trigger {
+  font-weight: var(--font-weight-semibold);
+}
+
+/* template emits children reversed; row-reverse re-orders visually and keeps the author last-painted (on top) */
+.avatar-stack {
+  display: inline-flex;
+  align-items: center;
+  flex-direction: row-reverse;
+}
+
+.avatar-stack > * {
+  margin-left: -16px;
+  transition: transform 0.15s ease, opacity 0.15s ease;
+  position: relative;
+  display: inline-flex;
+}
+
+.avatar-stack > *:last-child { margin-left: 0; }
+.avatar-stack > *:nth-last-child(2) { margin-left: -14px; }
+
+/* hover spreads via transform (no layout shift); positions count from visual-left = last DOM child = :nth-last-child */
+.avatar-stack:hover > *:nth-last-child(2) { transform: translateX(14px); }
+.avatar-stack:hover > *:nth-last-child(3) { transform: translateX(30px); }
+.avatar-stack:hover > *:nth-last-child(4) { transform: translateX(46px); }
+.avatar-stack:hover > *:nth-last-child(5) { transform: translateX(62px); }
+.avatar-stack:hover > *:nth-last-child(6) { transform: translateX(78px); }
+.avatar-stack:hover > *:nth-last-child(7) { transform: translateX(94px); }
+.avatar-stack:hover > *:nth-last-child(8) { transform: translateX(110px); }
+.avatar-stack:hover > *:nth-last-child(9) { transform: translateX(126px); }
+.avatar-stack:hover > *:nth-last-child(10) { transform: translateX(142px); }
+.avatar-stack:hover > *:nth-last-child(11) { transform: translateX(158px); }
+
+.avatar-stack .avatar {
+  border: 1px solid var(--color-body);
+  background: var(--color-body);
+  transition: border-color 0.15s ease, background-color 0.15s ease;
+}
+
+.avatar-stack:hover .avatar {
+  background-color: var(--color-body);
+}
+
+.avatar-stack-overflow-chip {
+  align-items: center;
+  justify-content: center;
+  width: 0;
+  height: 20px;
+  margin-left: 0;
+  border: 0 solid var(--color-body);
+  border-radius: var(--border-radius);
+  color: var(--color-text);
+  font-weight: var(--font-weight-semibold);
+  overflow: hidden;
+  opacity: 0;
+  transition: all 0.15s ease;
+}
+
+.avatar-stack:hover .avatar-stack-overflow-chip {
+  width: 20px;
+  margin-left: -16px;
+  border-width: 1px;
+  opacity: 1;
+}
+
+.avatar-stack-popup-trigger {
+  cursor: pointer;
+  background: none;
+  border: none;
+  padding: 0;
+  font: inherit;
+  color: inherit;
+}
+
+.avatar-stack-popup-trigger:hover {
+  color: var(--color-primary);
+}
+
+.avatar-stack-popup {
+  min-width: 200px;
+  display: flex;
+  flex-direction: column;
+  padding: 4px 0;
+}
+
+.avatar-stack-popup > a {
+  padding: 6px 12px;
+  gap: 8px;
+}
+
+.avatar-stack-popup > a:hover {
+  background: var(--color-hover);
+}
+
+@media (max-width: 767.98px) {
+  .avatar-stack-names {
+    max-width: 80px;
+  }
+}
diff --git a/web_src/css/base.css b/web_src/css/base.css
index 0716ad1913..8b8cfac2d1 100644
--- a/web_src/css/base.css
+++ b/web_src/css/base.css
@@ -386,14 +386,6 @@ a.label,
   color: var(--color-text-light-2);
 }
 
-img.ui.avatar,
-.ui.avatar img,
-.ui.avatar svg {
-  border-radius: var(--border-radius);
-  object-fit: contain;
-  aspect-ratio: 1;
-}
-
 .full.height {
   flex-grow: 1;
   padding-bottom: var(--page-space-bottom);
diff --git a/web_src/css/index.css b/web_src/css/index.css
index a56982efcf..6d9280c67f 100644
--- a/web_src/css/index.css
+++ b/web_src/css/index.css
@@ -56,6 +56,7 @@
 
 @import "./font_i18n.css";
 @import "./base.css";
+@import "./avatar.css";
 @import "./home.css";
 @import "./install.css";
 
diff --git a/web_src/css/repo.css b/web_src/css/repo.css
index b7cb5e1dcd..0682290e1a 100644
--- a/web_src/css/repo.css
+++ b/web_src/css/repo.css
@@ -1386,8 +1386,7 @@ tbody.commit-list {
   vertical-align: baseline;
 }
 
-.message-wrapper,
-.author-wrapper {
+.message-wrapper {
   overflow: hidden;
   text-overflow: ellipsis;
   max-width: 100%;
@@ -1395,12 +1394,6 @@ tbody.commit-list {
   vertical-align: middle;
 }
 
-.author-wrapper {
-  max-width: 180px;
-  align-self: center;
-  white-space: nowrap;
-}
-
 .latest-commit .message-wrapper {
   max-width: calc(100% - 2.5rem);
 }
@@ -1415,9 +1408,6 @@ tbody.commit-list {
   tr.commit-list {
     width: 100%;
   }
-  .author-wrapper {
-    max-width: 80px;
-  }
 }
 
 @media (min-width: 768px) and (max-width: 991.98px) {
diff --git a/web_src/js/components/ActionRunSummaryView.vue b/web_src/js/components/ActionRunSummaryView.vue
index 17b7e2802e..e3813e9e17 100644
--- a/web_src/js/components/ActionRunSummaryView.vue
+++ b/web_src/js/components/ActionRunSummaryView.vue
@@ -1,5 +1,4 @@
 <script setup lang="ts">
-import ActionStatusIcon from './ActionStatusIcon.vue';
 import WorkflowGraph from './WorkflowGraph.vue';
 import type {ActionRunViewStore} from "./ActionRunView.ts";
 import {computed, onBeforeUnmount, onMounted, toRefs} from "vue";
@@ -11,6 +10,7 @@ defineOptions({
 const props = defineProps<{
   store: ActionRunViewStore;
   locale: Record<string, any>;
+  artifactCount: number;
 }>();
 
 const locale = props.locale;
@@ -25,12 +25,27 @@ const topLevelJobs = computed(() => (run.value.jobs || []).filter((j) => !j.pare
 const triggerUser = computed(() => {
   const currentAttempt = run.value.attempts.find((attempt) => attempt.current);
   if (currentAttempt) {
-    return {name: currentAttempt.triggerUserName, link: currentAttempt.triggerUserLink};
+    return {
+      name: currentAttempt.triggerUserName,
+      link: currentAttempt.triggerUserLink,
+      avatar: currentAttempt.triggerUserAvatar,
+    };
   }
   const pusher = run.value.commit.pusher;
-  return pusher.displayName ? {name: pusher.displayName, link: pusher.link} : null;
+  return pusher.displayName ? {
+    name: pusher.displayName,
+    link: pusher.link,
+    avatar: pusher.avatarLink,
+  } : null;
 });
 
+const triggerLabel = computed(() => {
+  if (isRerun.value) return locale.rerunTriggered;
+  return locale.triggeredVia.replace('%s', run.value.triggerEvent);
+});
+
+const artifactsDisplay = computed(() => props.artifactCount > 0 ? String(props.artifactCount) : '–');
+
 onMounted(async () => {
   await props.store.startPollingCurrentRun();
 });
@@ -42,19 +57,60 @@ onBeforeUnmount(() => {
 <template>
   <div class="action-run-summary-view">
     <div class="action-run-summary-block">
-      <div class="flex-text-block">
-        <span>{{ isRerun ? locale.rerun : locale.triggeredVia.replace('%s', run.triggerEvent) }}</span>
-        <template v-if="triggerUser">
-          <span>•</span>
-          <a v-if="triggerUser.link" class="muted" :href="triggerUser.link">{{ triggerUser.name }}</a>
-          <span v-else class="muted">{{ triggerUser.name }}</span>
-        </template>
-        <span>•</span>
-        <relative-time :datetime="run.triggeredAt || ''" prefix=""/>
+      <div class="action-run-summary-trigger">
+        <span class="action-run-summary-label">
+          {{ triggerLabel }} <relative-time :datetime="run.triggeredAt || ''" prefix=""/>
+        </span>
+        <div class="flex-text-block tw-flex-wrap action-run-summary-trigger-content">
+          <component
+            :is="triggerUser.link ? 'a' : 'span'"
+            v-if="triggerUser"
+            class="flex-text-inline action-run-summary-user"
+            :class="{silenced: triggerUser.link}"
+            :href="triggerUser.link || undefined"
+          >
+            <img
+              v-if="triggerUser.avatar"
+              class="ui avatar tw-align-middle"
+              :src="triggerUser.avatar"
+              width="16"
+              height="16"
+              :alt="triggerUser.name"
+            >
+            <span>{{ triggerUser.name }}</span>
+          </component>
+          <a v-if="run.pullRequest" class="action-run-summary-pr silenced" :href="run.pullRequest.link">{{ run.pullRequest.index }}</a>
+          <span v-else-if="run.commit.branch.name" class="action-run-summary-branch-label tw-max-w-full">
+            <a
+              v-if="!run.commit.branch.isDeleted && run.commit.branch.link"
+              class="gt-ellipsis silenced"
+              :href="run.commit.branch.link"
+              :title="run.commit.branch.name"
+            >{{ run.commit.branch.name }}</a>
+            <span
+              v-else
+              class="gt-ellipsis tw-line-through"
+              :title="run.commit.branch.name"
+            >{{ run.commit.branch.name }}</span>
+          </span>
+        </div>
       </div>
-      <div class="flex-text-block">
-        <ActionStatusIcon :locale-status="locale.status[run.status]" :status="run.status" :size="16" icon-variant="circle-fill"/>
-        <span>{{ locale.status[run.status] }}</span> • <span>{{ locale.totalDuration }} {{ run.duration || '–' }}</span>
+
+      <div class="action-run-summary-stat-divider"/>
+
+      <div class="action-run-summary-stat">
+        <span class="action-run-summary-label">{{ locale.statusLabel }}</span>
+        <span class="action-run-summary-stat-value">{{ locale.status[run.status] }}</span>
+      </div>
+
+      <div class="action-run-summary-stat">
+        <span class="action-run-summary-label">{{ locale.totalDuration }}</span>
+        <span class="action-run-summary-stat-value">{{ run.duration || '–' }}</span>
+      </div>
+
+      <div class="action-run-summary-stat action-run-summary-stat-last">
+        <span class="action-run-summary-label">{{ locale.artifactsTitle }}</span>
+        <span class="action-run-summary-stat-value">{{ artifactsDisplay }}</span>
       </div>
     </div>
     <WorkflowGraph
@@ -63,6 +119,8 @@ onBeforeUnmount(() => {
       :jobs="topLevelJobs"
       :run-link="run.link"
       :workflow-id="run.workflowID"
+      :workflow-link="`${run.link}/workflow`"
+      :trigger-event="run.triggerEvent"
       :locale="locale"
     />
   </div>
@@ -77,13 +135,119 @@ onBeforeUnmount(() => {
 
 .action-run-summary-block {
   display: flex;
-  justify-content: space-between;
-  align-items: center;
   flex-wrap: wrap;
-  gap: 6px;
-  padding: 12px;
+  align-items: stretch; /* equal-height columns so labels align at top and values at bottom */
+  padding: 12px 16px;
   border-bottom: 1px solid var(--color-secondary);
-  border-radius: var(--border-radius) var(--border-radius) 0 0;
-  background: var(--color-box-header);
+  background: var(--color-console-bg);
+}
+
+.action-run-summary-trigger {
+  display: flex;
+  flex-direction: column;
+  flex: 0 1 auto;
+  min-width: 0;
+  max-width: 100%;
+  margin-right: 24px;
+}
+
+.action-run-summary-label {
+  display: block;
+  margin-bottom: 4px;
+  font-size: 12px;
+  line-height: 1.4;
+  color: var(--color-text-light-2);
+}
+
+.action-run-summary-trigger-content {
+  margin-top: auto; /* pin trigger content to the bottom, aligned with the stat values */
+  color: var(--color-text-light-2);
+  align-items: center;
+}
+
+.action-run-summary-user {
+  font-weight: var(--font-weight-semibold);
+  color: var(--color-text);
+  line-height: 16px;
+}
+
+.action-run-summary-user .ui.avatar {
+  margin: 0;
+}
+
+.action-run-summary-pr {
+  color: var(--color-text);
+  line-height: 16px;
+}
+
+.action-run-summary-branch-label {
+  display: inline-flex;
+  align-items: center;
+  max-width: 200px;
+  min-height: 20px;
+  padding: 0 6px;
+  border-radius: var(--border-radius);
+  background: var(--color-primary-light-6);
+  color: var(--color-primary);
+  font-size: 12px;
+  line-height: 20px;
+  font-family: var(--fonts-monospace);
+}
+
+.action-run-summary-branch-label a {
+  color: inherit;
+}
+
+.action-run-summary-branch-label a:hover {
+  text-decoration: underline;
+}
+
+.action-run-summary-user:hover span {
+  color: var(--color-primary);
+}
+
+.action-run-summary-stat {
+  display: flex;
+  flex-direction: column;
+  flex: 0 0 auto;
+  min-width: 72px;
+  margin-left: 24px;
+  margin-right: 24px;
+}
+
+.action-run-summary-stat-last {
+  margin-right: 0;
+}
+
+.action-run-summary-stat-divider {
+  display: none;
+  flex: 0 0 100%;
+  margin: 8px 0;
+  border-bottom: 1px solid var(--color-secondary);
+}
+
+.action-run-summary-stat-value {
+  display: block;
+  margin-top: auto; /* pin value to the bottom so all column values share a baseline */
+  font-size: 16px;
+  line-height: 1.25;
+  font-weight: var(--font-weight-semibold);
+  color: var(--color-text);
+}
+
+@media (max-width: 767.98px) {
+  .action-run-summary-trigger {
+    flex: 0 0 100%;
+    margin-right: 0;
+  }
+
+  .action-run-summary-stat {
+    margin-left: 0;
+    margin-right: 24px;
+  }
+
+  .action-run-summary-stat-divider {
+    display: block;
+  }
 }
 </style>
diff --git a/web_src/js/components/ActionRunView.ts b/web_src/js/components/ActionRunView.ts
index 0d6ae9a61b..582ae0431f 100644
--- a/web_src/js/components/ActionRunView.ts
+++ b/web_src/js/components/ActionRunView.ts
@@ -126,7 +126,9 @@ export function createEmptyActionsRun(): ActionsRun {
     duration: '',
     triggeredAt: 0,
     triggerEvent: '',
+    pullRequest: null,
     jobs: [] as Array<ActionsJob>,
+    jobSummaries: [],
     commit: {
       localeCommit: '',
       localePushedBy: '',
@@ -135,6 +137,7 @@ export function createEmptyActionsRun(): ActionsRun {
       pusher: {
         displayName: '',
         link: '',
+        avatarLink: '',
       },
       branch: {
         name: '',
diff --git a/web_src/js/components/RepoActionView.vue b/web_src/js/components/RepoActionView.vue
index a96e7bc09d..03d62bd7cc 100644
--- a/web_src/js/components/RepoActionView.vue
+++ b/web_src/js/components/RepoActionView.vue
@@ -22,6 +22,11 @@ const props = defineProps<{
 const locale = props.locale;
 const store = createActionRunViewStore(props.actionsViewUrl);
 const {currentRun: run, runArtifacts: artifacts} = toRefs(store.viewData);
+const visibleJobSummaries = computed(() => {
+  const summaries = run.value.jobSummaries || [];
+  if (!props.jobId) return summaries;
+  return summaries.filter((summary) => summary.jobId === props.jobId);
+});
 
 type JobListItem = {
   job: ActionsJob;
@@ -85,6 +90,16 @@ function formatCurrentAttemptTitle(attempt: ActionsRunAttempt) {
   return attempt.latest ? `${locale.latest} #${attempt.attempt}` : formatAttemptTitle(attempt);
 }
 
+const backLink = computed(() => {
+  if (run.value.pullRequest) {
+    return {href: run.value.pullRequest.link, prefix: locale.backToPullRequest, name: run.value.pullRequest.index};
+  }
+  if (run.value.workflowLink) {
+    return {href: run.value.workflowLink, prefix: locale.backToWorkflow, name: run.value.workflowID.replace(/\.(yml|yaml)$/i, '')};
+  }
+  return null;
+});
+
 function buildArtifactLink(name: string) {
   const searchString = run.value.runAttempt > 0 ? `?attempt=${run.value.runAttempt}` : '';
   return `${run.value.link}/artifacts/${encodeURIComponent(name)}${searchString}`;
@@ -108,9 +123,13 @@ async function deleteArtifact(name: string) {
   <!-- make the view container full width to make users easier to read logs -->
   <div class="ui fluid container">
     <div class="action-view-header">
+      <a v-if="backLink" class="action-view-back silenced" :href="backLink.href">
+        <SvgIcon name="octicon-arrow-left" :size="14"/>
+        <span>{{ backLink.prefix }} <span class="action-view-back-name">{{ backLink.name }}</span></span>
+      </a>
       <div class="action-info-summary">
         <div class="action-info-summary-title">
-          <ActionStatusIcon :locale-status="locale.status[run.status]" :status="run.status" :size="20" icon-variant="circle-fill"/>
+          <ActionStatusIcon :locale-status="locale.status[run.status]" :status="run.status" :size="22" icon-variant="circle-fill"/>
           <!-- eslint-disable-next-line vue/no-v-html -->
           <h2 class="action-info-summary-title-text" v-html="run.titleHTML"/>
         </div>
@@ -172,26 +191,6 @@ async function deleteArtifact(name: string) {
           </div>
         </div>
       </div>
-      <div class="action-commit-summary">
-        <span>
-          <a v-if="run.workflowLink" class="muted" :href="run.workflowLink"><b>{{ run.workflowID }}</b></a>
-          <b v-else>{{ run.workflowID }}</b>
-          :
-        </span>
-        <template v-if="run.isSchedule">
-          {{ locale.scheduled }}
-        </template>
-        <template v-else>
-          {{ locale.commit }}
-          <a class="muted" :href="run.commit.link">{{ run.commit.shortSHA }}</a>
-          {{ locale.pushedBy }}
-          <a class="muted" :href="run.commit.pusher.link">{{ run.commit.pusher.displayName }}</a>
-        </template>
-        <span class="ui label tw-max-w-full" v-if="run.commit.shortSHA">
-          <span v-if="run.commit.branch.isDeleted" class="gt-ellipsis tw-line-through" :data-tooltip-content="run.commit.branch.name">{{ run.commit.branch.name }}</span>
-          <a v-else class="gt-ellipsis" :href="run.commit.branch.link" :data-tooltip-content="run.commit.branch.name">{{ run.commit.branch.name }}</a>
-        </span>
-      </div>
     </div>
     <div class="action-view-body">
       <div class="action-view-left">
@@ -283,18 +282,35 @@ async function deleteArtifact(name: string) {
       </div>
 
       <div class="action-view-right">
-        <ActionRunSummaryView
-          v-if="!props.jobId"
-          :store="store"
-          :locale="locale"
-        />
-        <ActionRunJobView
-          v-else
-          :store="store"
-          :locale="locale"
-          :actions-view-url="props.actionsViewUrl"
-          :job-id="props.jobId"
-        />
+        <div class="action-view-right-panel">
+          <ActionRunSummaryView
+            v-if="!props.jobId"
+            :store="store"
+            :locale="locale"
+            :artifact-count="artifacts.length"
+          />
+          <ActionRunJobView
+            v-else
+            :store="store"
+            :locale="locale"
+            :actions-view-url="props.actionsViewUrl"
+            :job-id="props.jobId"
+          />
+        </div>
+        <div v-if="visibleJobSummaries.length" class="action-view-right-panel job-summary-section">
+          <div class="job-summary-section-header">
+            {{ locale.jobSummaries }}
+          </div>
+          <div class="job-summary-list">
+            <div v-for="s in visibleJobSummaries" :key="s.jobId" class="job-summary-item">
+              <div class="job-summary-header">
+                <strong class="gt-ellipsis">{{ s.jobName || `Job ${s.jobId}` }}</strong>
+              </div>
+              <!-- eslint-disable-next-line vue/no-v-html -->
+              <div class="markup job-summary-body" v-html="s.summaryHTML"/>
+            </div>
+          </div>
+        </div>
       </div>
     </div>
   </div>
@@ -311,9 +327,30 @@ async function deleteArtifact(name: string) {
 /* action view header */
 
 .action-view-header {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
   margin-top: 8px;
 }
 
+.action-view-back {
+  display: inline-flex;
+  align-items: center;
+  align-self: flex-start;
+  gap: 4px;
+  font-size: 13px;
+  color: var(--color-text-light-1);
+}
+
+.action-view-back:hover {
+  color: var(--color-primary);
+}
+
+.action-view-back-name {
+  font-weight: var(--font-weight-bold);
+  color: var(--color-text);
+}
+
 .action-info-summary {
   display: flex;
   flex-wrap: wrap;
@@ -340,21 +377,6 @@ async function deleteArtifact(name: string) {
   white-space: nowrap;
 }
 
-.action-commit-summary {
-  display: flex;
-  align-items: center;
-  flex-wrap: wrap;
-  gap: 5px;
-  margin-left: 28px;
-}
-
-@media (max-width: 767.98px) {
-  .action-commit-summary {
-    margin-left: 0;
-    margin-top: 8px;
-  }
-}
-
 /* ================ */
 /* action view left */
 
@@ -462,25 +484,32 @@ async function deleteArtifact(name: string) {
   width: 70%;
   display: flex;
   flex-direction: column;
+  gap: 12px;
+}
+
+.action-view-right-panel {
   border: 1px solid var(--color-console-border);
   border-radius: var(--border-radius);
   background: var(--color-console-bg);
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
 }
 
 /* begin fomantic button overrides */
 
-.action-view-right .ui.button,
-.action-view-right .ui.button:focus {
+.action-view-right-panel .ui.button,
+.action-view-right-panel .ui.button:focus {
   background: transparent;
   color: var(--color-console-fg-subtle);
 }
 
-.action-view-right .ui.button:hover {
+.action-view-right-panel .ui.button:hover {
   background: var(--color-console-hover-bg);
   color: var(--color-console-fg);
 }
 
-.action-view-right .ui.button:active {
+.action-view-right-panel .ui.button:active {
   background: var(--color-console-active-bg);
   color: var(--color-console-fg);
 }
@@ -498,4 +527,39 @@ async function deleteArtifact(name: string) {
     max-width: none;
   }
 }
+
+.job-summary-section {
+  overflow: hidden;
+}
+
+.job-summary-section-header {
+  padding: 12px;
+  border-bottom: 1px solid var(--color-console-border);
+  background: var(--color-console-bg);
+  color: var(--color-console-fg);
+  font-weight: var(--font-weight-semibold);
+}
+
+.job-summary-list {
+  padding: 12px;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.job-summary-item {
+  padding: 12px;
+  border-radius: var(--border-radius);
+  background: var(--color-console-hover-bg);
+  border: 1px solid var(--color-console-border);
+}
+
+.job-summary-header {
+  color: var(--color-console-fg);
+  margin-bottom: 8px;
+}
+
+.job-summary-body {
+  color: var(--color-console-fg);
+}
 </style>
diff --git a/web_src/js/components/WorkflowGraph.vue b/web_src/js/components/WorkflowGraph.vue
index 4c8762dc39..96e3448f25 100644
--- a/web_src/js/components/WorkflowGraph.vue
+++ b/web_src/js/components/WorkflowGraph.vue
@@ -30,6 +30,8 @@ const props = defineProps<{
   jobs: ActionsJob[];
   runLink: string;
   workflowId: string;
+  workflowLink?: string;
+  triggerEvent?: string;
   locale: Record<string, string>;
 }>();
 
@@ -231,9 +233,13 @@ function onNodeClick(job: GraphNode | ActionsJob, event: MouseEvent) {
 <template>
   <div v-if="jobs.length > 0" class="workflow-graph">
     <div class="graph-header">
-      <h4 class="graph-title">{{ locale.workflowDependencies }}</h4>
+      <div class="graph-workflow-info">
+        <a v-if="workflowLink" class="graph-workflow-name silenced" :href="workflowLink">{{ workflowId }}</a>
+        <span v-else class="graph-workflow-name">{{ workflowId }}</span>
+        <div v-if="triggerEvent" class="graph-workflow-trigger">on: {{ triggerEvent }}</div>
+      </div>
       <div class="graph-stats">{{ graphStats }}</div>
-      <div class="flex-text-block">
+      <div class="flex-text-block graph-controls">
         <button
           type="button"
           @click="zoomIn"
@@ -424,20 +430,29 @@ function onNodeClick(job: GraphNode | ActionsJob, event: MouseEvent) {
   display: flex;
   justify-content: space-between;
   align-items: center;
-  padding: 8px 14px;
-  background: var(--color-box-header);
-  border-bottom: 1px solid var(--color-secondary);
+  padding: 16px 16px 8px;
+  background: var(--color-console-bg);
   gap: var(--gap-block);
   flex-wrap: wrap;
 }
 
-.graph-title {
-  margin: 0;
+.graph-workflow-info {
+  min-width: 0;
+}
+
+.graph-workflow-name {
+  display: block;
   color: var(--color-text);
   font-size: 16px;
   font-weight: var(--font-weight-semibold);
-  flex: 1;
-  min-width: 200px;
+  line-height: 1.25;
+}
+
+.graph-workflow-trigger {
+  margin-top: 4px;
+  color: var(--color-text-light-2);
+  font-size: 12px;
+  line-height: 1.4;
 }
 
 .graph-stats {
@@ -447,6 +462,12 @@ function onNodeClick(job: GraphNode | ActionsJob, event: MouseEvent) {
   color: var(--color-text-light-1);
   font-size: 13px;
   white-space: nowrap;
+  margin-left: auto;
+  padding: 0 16px;
+}
+
+.graph-controls {
+  flex-shrink: 0;
 }
 
 .graph-container {
diff --git a/web_src/js/features/repo-actions.ts b/web_src/js/features/repo-actions.ts
index 1b99499248..3d4bd49a4f 100644
--- a/web_src/js/features/repo-actions.ts
+++ b/web_src/js/features/repo-actions.ts
@@ -27,9 +27,14 @@ export function initRepositoryActionView() {
       pushedBy: el.getAttribute('data-locale-runs-pushed-by'),
       summary: el.getAttribute('data-locale-summary'),
       allJobs: el.getAttribute('data-locale-all-jobs'),
+      jobSummaries: el.getAttribute('data-locale-job-summaries'),
       expandCallerJobs: el.getAttribute('data-locale-expand-caller-jobs'),
       collapseCallerJobs: el.getAttribute('data-locale-collapse-caller-jobs'),
       triggeredVia: el.getAttribute('data-locale-triggered-via'),
+      rerunTriggered: el.getAttribute('data-locale-rerun-triggered'),
+      backToPullRequest: el.getAttribute('data-locale-back-to-pull-request'),
+      backToWorkflow: el.getAttribute('data-locale-back-to-workflow'),
+      statusLabel: el.getAttribute('data-locale-status-label'),
       totalDuration: el.getAttribute('data-locale-total-duration'),
       artifactsTitle: el.getAttribute('data-locale-artifacts-title'),
       artifactExpired: el.getAttribute('data-locale-artifact-expired'),
diff --git a/web_src/js/features/repo-commit.ts b/web_src/js/features/repo-commit.ts
index 17130427a6..6103766202 100644
--- a/web_src/js/features/repo-commit.ts
+++ b/web_src/js/features/repo-commit.ts
@@ -25,6 +25,22 @@ export function initCommitStatuses() {
   });
 }
 
+export function initAvatarStackPopup() {
+  registerGlobalInitFunc('initAvatarStackPopup', (el: HTMLElement) => {
+    const nextEl = el.nextElementSibling!;
+    if (!nextEl.matches('.tippy-target')) throw new Error('Expected next element to be a tippy target');
+    createTippy(el, {
+      content: nextEl,
+      placement: 'bottom-start',
+      interactive: true,
+      role: 'dialog',
+      theme: 'menu',
+      trigger: 'click',
+      hideOnClick: true,
+    });
+  });
+}
+
 export function initCommitFileHistoryFollowRename() {
   registerGlobalInitFunc('initCommitHistoryFollowRename', (el: HTMLInputElement) => {
     el.addEventListener('change', () => {
diff --git a/web_src/js/index.ts b/web_src/js/index.ts
index 5ada9558e1..863b65c871 100644
--- a/web_src/js/index.ts
+++ b/web_src/js/index.ts
@@ -21,7 +21,7 @@ import {initMarkupContent} from './markup/content.ts';
 import {initRepoFileView} from './features/file-view.ts';
 import {initUserExternalLogins, initUserCheckAppUrl} from './features/user-auth.ts';
 import {initRepoPullRequestReview, initRepoIssueFilterItemLabel} from './features/repo-issue.ts';
-import {initRepoEllipsisButton, initCommitStatuses, initCommitFileHistoryFollowRename} from './features/repo-commit.ts';
+import {initRepoEllipsisButton, initCommitStatuses, initAvatarStackPopup, initCommitFileHistoryFollowRename} from './features/repo-commit.ts';
 import {initRepoTopicBar} from './features/repo-home.ts';
 import {initAdminCommon} from './features/admin/common.ts';
 import {initRepoCodeView} from './features/repo-code.ts';
@@ -150,6 +150,7 @@ const initPerformanceTracer = callInitFunctions([
   initRepoRecentCommits,
 
   initCommitStatuses,
+  initAvatarStackPopup,
   initCaptcha,
 
   initUserCheckAppUrl,
diff --git a/web_src/js/modules/gitea-actions.ts b/web_src/js/modules/gitea-actions.ts
index 005138a4d4..bdaac6ef81 100644
--- a/web_src/js/modules/gitea-actions.ts
+++ b/web_src/js/modules/gitea-actions.ts
@@ -23,7 +23,12 @@ export type ActionsRun = {
   duration: string,
   triggeredAt: number,
   triggerEvent: string,
+  pullRequest?: {
+    index: string,
+    link: string,
+  } | null,
   jobs: Array<ActionsJob>,
+  jobSummaries?: Array<ActionsJobSummary>,
   commit: {
     localeCommit: string,
     localePushedBy: string,
@@ -32,6 +37,7 @@ export type ActionsRun = {
     pusher: {
       displayName: string,
       link: string,
+      avatarLink: string,
     },
     branch: {
       name: string,
@@ -41,6 +47,12 @@ export type ActionsRun = {
   },
 };
 
+export type ActionsJobSummary = {
+  jobId: number,
+  jobName: string,
+  summaryHTML: string,
+};
+
 export type ActionsRunAttempt = {
   attempt: number;
   status: ActionsStatus;
@@ -51,6 +63,7 @@ export type ActionsRunAttempt = {
   triggeredAt: number;
   triggerUserName: string;
   triggerUserLink: string;
+  triggerUserAvatar: string;
 };
 
 export type ActionsJob = {
diff --git a/web_src/js/svg.ts b/web_src/js/svg.ts
index 23c3e7ee01..4d86930de0 100644
--- a/web_src/js/svg.ts
+++ b/web_src/js/svg.ts
@@ -7,6 +7,7 @@ import giteaEmptyCheckbox from '../../public/assets/img/svg/gitea-empty-checkbox
 import giteaExclamation from '../../public/assets/img/svg/gitea-exclamation.svg';
 import giteaRunning from '../../public/assets/img/svg/gitea-running.svg';
 import octiconArchive from '../../public/assets/img/svg/octicon-archive.svg';
+import octiconArrowLeft from '../../public/assets/img/svg/octicon-arrow-left.svg';
 import octiconArrowSwitch from '../../public/assets/img/svg/octicon-arrow-switch.svg';
 import octiconBlocked from '../../public/assets/img/svg/octicon-blocked.svg';
 import octiconBold from '../../public/assets/img/svg/octicon-bold.svg';
@@ -94,6 +95,7 @@ const svgs = {
   'gitea-exclamation': giteaExclamation,
   'gitea-running': giteaRunning,
   'octicon-archive': octiconArchive,
+  'octicon-arrow-left': octiconArrowLeft,
   'octicon-arrow-switch': octiconArrowSwitch,
   'octicon-blocked': octiconBlocked,
   'octicon-bold': octiconBold,
-- 
2.54.0


From 17a8b6d310512b86d543b402e55565c9ceef7382 Mon Sep 17 00:00:00 2001
From: Danila Fominykh <d@m8sh.su>
Date: Tue, 9 Jun 2026 22:10:13 +0300
Subject: [PATCH 4/4] add translations for several languages

---
 options/locale/locale_cs-CZ.json              | 13 +++++++++++-
 options/locale/locale_de-DE.json              | 13 +++++++++++-
 options/locale/locale_en-US.json              | 13 +++++++++++-
 options/locale/locale_es-ES.json              | 13 +++++++++++-
 options/locale/locale_fr-FR.json              | 13 +++++++++++-
 options/locale/locale_ko-KR.json              | 13 +++++++++++-
 options/locale/locale_ru-RU.json              | 13 +++++++++++-
 options/locale/locale_zh-CN.json              | 13 +++++++++++-
 templates/shared/user/profile_big_avatar.tmpl |  4 +++-
 templates/user/auth/signin_inner.tmpl         | 12 +++++------
 templates/user/auth/signup_inner.tmpl         | 20 +++++++++----------
 11 files changed, 115 insertions(+), 25 deletions(-)

diff --git a/options/locale/locale_cs-CZ.json b/options/locale/locale_cs-CZ.json
index 52e9940db1..8b2045b5ae 100644
--- a/options/locale/locale_cs-CZ.json
+++ b/options/locale/locale_cs-CZ.json
@@ -3057,6 +3057,17 @@
   "gpg.error.no_gpg_keys_found": "V databázi nebyl nalezen žádný známý klíč pro tento podpis",
   "gpg.error.not_signed_commit": "Nepodepsaná revize",
   "gpg.error.failed_retrieval_gpg_keys": "Nelze získat žádný klíč propojený s účtem přispěvatele",
+  "gpg.signin.title": "Přihlásit se",
+  "gpg.signin.nonce_label": "Podepište tento nonce svým soukromým klíčem",
+  "gpg.signin.command_hint": "Spusťte tento příkaz a vložte výstup níže:",
+  "gpg.signin.copy": "Kopírovat",
+  "gpg.signin.signed_output": "Podepsaný výstup",
+  "gpg.signin.submit": "Přihlásit se",
+  "gpg.signup.title": "Vytvořit účet",
+  "gpg.signup.paste_key": "Vložte svůj veřejný GPG klíč",
+  "gpg.signup.proceed": "Pokračovat",
+  "gpg.signup.submit": "Ověřit a vytvořit účet",
+  "gpg.signup.already_have_account": "Již máte účet?",
   "units.unit": "Jednotka",
   "units.error.no_unit_allowed_repo": "Nejste oprávněni přistupovat k žádné části tohoto repozitáře.",
   "units.error.unit_not_allowed": "Nejste oprávněni přistupovat k této části repozitáře.",
@@ -3307,4 +3318,4 @@
   "git.filemode.executable_file": "Spustitelný soubor",
   "git.filemode.symbolic_link": "Symbolický odkaz",
   "git.filemode.submodule": "Submodul"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_de-DE.json b/options/locale/locale_de-DE.json
index 53d7d4d97d..3642e38391 100644
--- a/options/locale/locale_de-DE.json
+++ b/options/locale/locale_de-DE.json
@@ -3005,6 +3005,17 @@
   "gpg.error.no_gpg_keys_found": "Es konnte kein GPG-Schlüssel zu dieser Signatur gefunden werden",
   "gpg.error.not_signed_commit": "Kein signierter Commit",
   "gpg.error.failed_retrieval_gpg_keys": "Fehler beim Abrufen eines Keys des Commiter-Kontos",
+  "gpg.signin.title": "Anmelden",
+  "gpg.signin.nonce_label": "Signiere diesen Nonce mit deinem privaten Schlüssel",
+  "gpg.signin.command_hint": "Führe diesen Befehl aus und füge die Ausgabe unten ein:",
+  "gpg.signin.copy": "Kopieren",
+  "gpg.signin.signed_output": "Signierte Ausgabe",
+  "gpg.signin.submit": "Anmelden",
+  "gpg.signup.title": "Konto erstellen",
+  "gpg.signup.paste_key": "Füge deinen öffentlichen GPG-Schlüssel ein",
+  "gpg.signup.proceed": "Weiter",
+  "gpg.signup.submit": "Verifizieren & Konto erstellen",
+  "gpg.signup.already_have_account": "Bereits ein Konto?",
   "units.unit": "Einheit",
   "units.error.no_unit_allowed_repo": "Du hast keine Berechtigung, auf etwas in diesem Repository zuzugreifen.",
   "units.error.unit_not_allowed": "Du hast keine Berechtigung, um auf diesen Repository-Bereich zuzugreifen.",
@@ -3249,4 +3260,4 @@
   "git.filemode.executable_file": "Ausführbare Datei",
   "git.filemode.symbolic_link": "Softlink",
   "git.filemode.submodule": "Submodul"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
index 90c7c71fb7..5245072519 100644
--- a/options/locale/locale_en-US.json
+++ b/options/locale/locale_en-US.json
@@ -3503,6 +3503,17 @@
   "gpg.error.failed_retrieval_gpg_keys": "Failed to retrieve any key attached to the committer's account",
   "gpg.error.probable_bad_signature": "WARNING! Although there is a key with this ID in the database, it does not verify this commit! This commit is SUSPICIOUS.",
   "gpg.error.probable_bad_default_signature": "WARNING! Although the default key has this ID, it does not verify this commit! This commit is SUSPICIOUS.",
+  "gpg.signin.title": "Sign In",
+  "gpg.signin.nonce_label": "Sign this nonce with your private key",
+  "gpg.signin.command_hint": "Run this command, then paste the output below:",
+  "gpg.signin.copy": "Copy",
+  "gpg.signin.signed_output": "Signed output",
+  "gpg.signin.submit": "Sign In",
+  "gpg.signup.title": "Create your account",
+  "gpg.signup.paste_key": "Paste your GPG public key",
+  "gpg.signup.proceed": "Proceed",
+  "gpg.signup.submit": "Verify & Create Account",
+  "gpg.signup.already_have_account": "Already have an account?",
   "units.unit": "Unit",
   "units.error.no_unit_allowed_repo": "You are not allowed to access any section of this repository.",
   "units.error.unit_not_allowed": "You are not allowed to access this repository section.",
@@ -3888,4 +3899,4 @@
   "actions.general.cross_repo_selected": "Selected repositories",
   "actions.general.cross_repo_target_repos": "Target Repositories",
   "actions.general.cross_repo_add": "Add Target Repository"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_es-ES.json b/options/locale/locale_es-ES.json
index 04727abb5b..c2e1fa7a4c 100644
--- a/options/locale/locale_es-ES.json
+++ b/options/locale/locale_es-ES.json
@@ -2732,6 +2732,17 @@
   "gpg.error.no_gpg_keys_found": "No se encontró ninguna clave conocida en la base de datos para esta firma",
   "gpg.error.not_signed_commit": "No es un commit firmado",
   "gpg.error.failed_retrieval_gpg_keys": "No se pudo recuperar cualquier clave adjunta a la cuenta del committer",
+  "gpg.signin.title": "Iniciar sesión",
+  "gpg.signin.nonce_label": "Firma este nonce con tu clave privada",
+  "gpg.signin.command_hint": "Ejecuta este comando y pega el resultado abajo:",
+  "gpg.signin.copy": "Copiar",
+  "gpg.signin.signed_output": "Salida firmada",
+  "gpg.signin.submit": "Iniciar sesión",
+  "gpg.signup.title": "Crear tu cuenta",
+  "gpg.signup.paste_key": "Pega tu clave pública GPG",
+  "gpg.signup.proceed": "Continuar",
+  "gpg.signup.submit": "Verificar y crear cuenta",
+  "gpg.signup.already_have_account": "¿Ya tienes una cuenta?",
   "units.unit": "Unidad",
   "units.error.no_unit_allowed_repo": "No tiene permisos para acceder a ninguna sección de este repositorio.",
   "units.error.unit_not_allowed": "No tiene permisos para acceder a esta sección del repositorio.",
@@ -2960,4 +2971,4 @@
   "git.filemode.executable_file": "Archivo ejecutable",
   "git.filemode.symbolic_link": "Enlace simbólico",
   "git.filemode.submodule": "Submódulo"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_fr-FR.json b/options/locale/locale_fr-FR.json
index 5cfa7498b9..b07f81deae 100644
--- a/options/locale/locale_fr-FR.json
+++ b/options/locale/locale_fr-FR.json
@@ -3498,6 +3498,17 @@
   "gpg.error.failed_retrieval_gpg_keys": "Impossible de récupérer la clé liée au compte de l'auteur",
   "gpg.error.probable_bad_signature": "AVERTISSEMENT ! Bien qu’il y ait une clé avec cet ID dans la base de données, elle ne vérifie pas cette révision ! Cette révision est SUSPECTE.",
   "gpg.error.probable_bad_default_signature": "AVERTISSEMENT ! Bien que la clé par défaut ait cet ID, elle ne vérifie pas cette révision ! Cette révision est SUSPECTE.",
+  "gpg.signin.title": "Se connecter",
+  "gpg.signin.nonce_label": "Signez ce nonce avec votre clé privée",
+  "gpg.signin.command_hint": "Exécutez cette commande puis collez le résultat ci-dessous :",
+  "gpg.signin.copy": "Copier",
+  "gpg.signin.signed_output": "Sortie signée",
+  "gpg.signin.submit": "Se connecter",
+  "gpg.signup.title": "Créer votre compte",
+  "gpg.signup.paste_key": "Collez votre clé publique GPG",
+  "gpg.signup.proceed": "Continuer",
+  "gpg.signup.submit": "Vérifier & créer le compte",
+  "gpg.signup.already_have_account": "Vous avez déjà un compte ?",
   "units.unit": "Ressource",
   "units.error.no_unit_allowed_repo": "Vous n'êtes pas autorisé à accéder à n'importe quelle section de ce dépôt.",
   "units.error.unit_not_allowed": "Vous n'êtes pas autorisé à accéder à cette section du dépôt.",
@@ -3866,4 +3877,4 @@
   "actions.general.cross_repo_selected": "Dépôts sélectionnés",
   "actions.general.cross_repo_target_repos": "Dépôts cibles",
   "actions.general.cross_repo_add": "Ajouter un dépôt cible"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_ko-KR.json b/options/locale/locale_ko-KR.json
index 121d0fb8bf..7c96863d93 100644
--- a/options/locale/locale_ko-KR.json
+++ b/options/locale/locale_ko-KR.json
@@ -3499,6 +3499,17 @@
   "gpg.error.failed_retrieval_gpg_keys": "커미터 계정에 연결된 키를 가져오지 못함",
   "gpg.error.probable_bad_signature": "경고! 이 ID를 가진 키가 데이터베이스에 있지만 이 커밋을 검증하지 않습니다! 이 커밋은 의심스럽습니다.",
   "gpg.error.probable_bad_default_signature": "경고! 기본 키는 이 ID를 가지지만 이 커밋을 검증하지 않습니다! 이 커밋은 의심스럽습니다.",
+  "gpg.signin.title": "로그인",
+  "gpg.signin.nonce_label": "개인 키로 이 nonce에 서명하세요",
+  "gpg.signin.command_hint": "이 명령을 실행하고 아래에 출력을 붙여넣으세요:",
+  "gpg.signin.copy": "복사",
+  "gpg.signin.signed_output": "서명된 출력",
+  "gpg.signin.submit": "로그인",
+  "gpg.signup.title": "계정 만들기",
+  "gpg.signup.paste_key": "GPG 공개 키를 붙여넣으세요",
+  "gpg.signup.proceed": "계속",
+  "gpg.signup.submit": "확인 및 계정 생성",
+  "gpg.signup.already_have_account": "이미 계정이 있으신가요?",
   "units.unit": "단위",
   "units.error.no_unit_allowed_repo": "이 리포지토리의 어떤 섹션에도 접근할 수 없습니다.",
   "units.error.unit_not_allowed": "이 리포지토리 섹션에 접근할 수 없습니다.",
@@ -3879,4 +3890,4 @@
   "actions.general.cross_repo_selected": "선택된 리포지토리",
   "actions.general.cross_repo_target_repos": "대상 리포지토리",
   "actions.general.cross_repo_add": "대상 리포지토리 추가"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_ru-RU.json b/options/locale/locale_ru-RU.json
index 9dc16ab820..1eba4af8b7 100644
--- a/options/locale/locale_ru-RU.json
+++ b/options/locale/locale_ru-RU.json
@@ -2755,6 +2755,17 @@
   "gpg.error.no_gpg_keys_found": "Не найден ключ, соответствующий данной подписи",
   "gpg.error.not_signed_commit": "Неподписанный коммит",
   "gpg.error.failed_retrieval_gpg_keys": "Не удалось получить ни одного ключа GPG автора коммита",
+  "gpg.signin.title": "Войти",
+  "gpg.signin.nonce_label": "Подпишите этот nonce своим приватным ключом",
+  "gpg.signin.command_hint": "Выполните команду и вставьте результат ниже:",
+  "gpg.signin.copy": "Копировать",
+  "gpg.signin.signed_output": "Подписанный вывод",
+  "gpg.signin.submit": "Войти",
+  "gpg.signup.title": "Создать аккаунт",
+  "gpg.signup.paste_key": "Вставьте ваш публичный GPG-ключ",
+  "gpg.signup.proceed": "Продолжить",
+  "gpg.signup.submit": "Подтвердить и создать аккаунт",
+  "gpg.signup.already_have_account": "Уже есть аккаунт?",
   "units.unit": "Элемент",
   "units.error.no_unit_allowed_repo": "У вас нет доступа ни к одному разделу этого репозитория.",
   "units.error.unit_not_allowed": "У вас нет доступа к этому разделу репозитория.",
@@ -2983,4 +2994,4 @@
   "git.filemode.executable_file": "Исполняемый файл",
   "git.filemode.symbolic_link": "Символическая ссылка",
   "git.filemode.submodule": "Подмодуль"
-}
+}
\ No newline at end of file
diff --git a/options/locale/locale_zh-CN.json b/options/locale/locale_zh-CN.json
index ba52e2e79d..b1761f3d40 100644
--- a/options/locale/locale_zh-CN.json
+++ b/options/locale/locale_zh-CN.json
@@ -3498,6 +3498,17 @@
   "gpg.error.failed_retrieval_gpg_keys": "找不到任何与该提交者账号相关的密钥",
   "gpg.error.probable_bad_signature": "警告！虽然数据库中有一个此 ID 的密钥，但它没有验证此提交！此提交是可疑的。",
   "gpg.error.probable_bad_default_signature": "警告！虽然默认密钥拥有此 ID，但它没有验证此提交！此提交是可疑的。",
+  "gpg.signin.title": "登录",
+  "gpg.signin.nonce_label": "使用您的私钥签署此随机数",
+  "gpg.signin.command_hint": "运行此命令，然后将输出粘贴到下方：",
+  "gpg.signin.copy": "复制",
+  "gpg.signin.signed_output": "签名输出",
+  "gpg.signin.submit": "登录",
+  "gpg.signup.title": "创建账户",
+  "gpg.signup.paste_key": "粘贴您的 GPG 公钥",
+  "gpg.signup.proceed": "继续",
+  "gpg.signup.submit": "验证并创建账户",
+  "gpg.signup.already_have_account": "已有账户？",
   "units.unit": "单元",
   "units.error.no_unit_allowed_repo": "您没有被允许访问此仓库的任何单元。",
   "units.error.unit_not_allowed": "您没有权限访问此仓库单元",
@@ -3866,4 +3877,4 @@
   "actions.general.cross_repo_selected": "选择的仓库",
   "actions.general.cross_repo_target_repos": "目标仓库",
   "actions.general.cross_repo_add": "添加目标仓库"
-}
+}
\ No newline at end of file
diff --git a/templates/shared/user/profile_big_avatar.tmpl b/templates/shared/user/profile_big_avatar.tmpl
index a249d3955d..f12edc263a 100644
--- a/templates/shared/user/profile_big_avatar.tmpl
+++ b/templates/shared/user/profile_big_avatar.tmpl
@@ -84,7 +84,9 @@
 				{{if .GPGKeys}}
 					<li>
 						{{svg "octicon-key"}}
-						<a class="tw-font-mono tw-text-sm" href="{{AppSubUrl}}/{{$.ContextUser.Name}}.gpg" target="_blank">GPG: {{(index .GPGKeys 0).PaddedKeyID}}{{if gt (len .GPGKeys) 1}} +{{sub (len .GPGKeys) 1}}{{end}}</a>
+						<a class="tw-font-mono tw-text-sm" href="{{AppSubUrl}}/{{$.ContextUser.Name}}.gpg" target="_blank">
+							GPG: {{(index .GPGKeys 0).PaddedKeyID}}{{if gt (len .GPGKeys) 1}} +{{.GPGKeysExtra}}{{end}}
+						</a>
 					</li>
 				{{end}}
 			{{end}}
diff --git a/templates/user/auth/signin_inner.tmpl b/templates/user/auth/signin_inner.tmpl
index c9eb7b993a..1fc62961ec 100644
--- a/templates/user/auth/signin_inner.tmpl
+++ b/templates/user/auth/signin_inner.tmpl
@@ -1,6 +1,6 @@
 <div class="ui container fluid">
 	<h4 class="ui top attached header center">
-		Sign In
+		{{ctx.Locale.Tr "gpg.signin.nonce_label"}}
 	</h4>
 	<div class="ui attached segment">
 		<form class="ui form" action="{{.SignInLink}}" method="post" id="signin-form">
@@ -9,25 +9,25 @@
 			<input type="hidden" id="hidden-nonce" name="nonce">
 
 			<div class="field">
-				<label>Sign this nonce with your private key</label>
+				<label>{{ctx.Locale.Tr "gpg.signin.nonce_label"}}</label>
 				<input id="token-field" type="text" readonly style="font-family: monospace;">
 			</div>
 			<div class="ui info message">
-				<p>Run this command, then paste the output below:</p>
+				<p>{{ctx.Locale.Tr "gpg.signin.command_hint"}}</p>
 				<div style="display: flex; gap: 6px;">
 					<input id="sign-command" type="text" readonly
 						style="font-family: monospace; min-width: 0; flex: 1;">
-					<button class="ui button" type="button" id="btn-copy-cmd">Copy</button>
+					<button class="ui button" type="button" id="btn-copy-cmd">{{ctx.Locale.Tr "gpg.signin.copy"}}</button>
 				</div>
 			</div>
 			<div class="required field {{if .Err_GPGSign}}error{{end}}">
-				<label for="gpg_signature">Signed output</label>
+				<label for="gpg_signature">{{ctx.Locale.Tr "gpg.signin.signed_output"}}</label>
 				<textarea id="gpg_signature" name="gpg_signature" rows="7"
 					placeholder="-----BEGIN PGP SIGNED MESSAGE-----" style="font-family: monospace;"
 					required>{{.gpg_signature}}</textarea>
 			</div>
 			<div class="inline field">
-				<button class="ui primary button tw-w-full" type="submit">Sign In</button>
+				<button class="ui primary button tw-w-full" type="submit">{{ctx.Locale.Tr "gpg.signin.submit"}}</button>
 			</div>
 		</form>
 	</div>
diff --git a/templates/user/auth/signup_inner.tmpl b/templates/user/auth/signup_inner.tmpl
index f80459a8f6..a7815f4d35 100644
--- a/templates/user/auth/signup_inner.tmpl
+++ b/templates/user/auth/signup_inner.tmpl
@@ -1,6 +1,6 @@
 <div class="ui container fluid">
 	<h4 class="ui top attached header center">
-		Create your account
+		{{ctx.Locale.Tr "gpg.signup.title"}}
 	</h4>
 	<div class="ui attached segment">
 		<form class="ui form" action="{{.SignUpLink}}" method="post" id="signup-form">
@@ -11,33 +11,33 @@
 			<div id="step-key">
 				{{template "base/alert" .}}
 				<div class="required field {{if .Err_GPGKey}}error{{end}}">
-					<label>Paste your GPG public key</label>
+					<label>{{ctx.Locale.Tr "gpg.signup.paste_key"}}</label>
 					<textarea id="gpg_key" rows="7" placeholder="-----BEGIN PGP PUBLIC KEY BLOCK-----" style="font-family: monospace;" required>{{.gpg_key}}</textarea>
 				</div>
 				<div class="inline field">
-					<button class="ui primary button tw-w-full" type="button" id="btn-proceed">Proceed</button>
+					<button class="ui primary button tw-w-full" type="button" id="btn-proceed">{{ctx.Locale.Tr "gpg.signup.proceed"}}</button>
 				</div>
 			</div>
 
 			<div id="step-sign" style="display: none;">
 				{{template "base/alert" .}}
 				<div class="field">
-					<label>Sign this nonce with your private key</label>
+					<label>{{ctx.Locale.Tr "gpg.signin.nonce"}}</label>
 					<input id="token-field" type="text" readonly style="font-family: monospace;">
 				</div>
 				<div class="ui info message">
-					<p>Run this command, then paste the output below:</p>
+					<p>{{ctx.Locale.Tr "gpg.signin.command_hint"}}</p>
 					<div style="display: flex; gap: 6px;">
 						<input id="sign-command" type="text" readonly style="font-family: monospace; min-width: 0; flex: 1;">
-						<button class="ui button" type="button" id="btn-copy-cmd">Copy</button>
+						<button class="ui button" type="button" id="btn-copy-cmd">{{ctx.Locale.Tr "gpg.signin.copy"}}</button>
 					</div>
 				</div>
 				<div class="required field {{if .Err_GPGSign}}error{{end}}">
-					<label for="gpg_signature">Signed output</label>
+					<label for="gpg_signature">{{ctx.Locale.Tr "gpg.signin.signed_output"}}</label>
 					<textarea id="gpg_signature" name="gpg_signature" rows="7" placeholder="-----BEGIN PGP SIGNED MESSAGE-----" style="font-family: monospace;" required>{{.gpg_signature}}</textarea>
 				</div>
 				<div class="inline field">
-					<button class="ui primary button tw-w-full" type="submit">Verify &amp; Create Account</button>
+					<button class="ui primary button tw-w-full" type="submit">{{ctx.Locale.Tr "gpg.signup.submit"}}</button>
 				</div>
 			</div>
 		</form>
@@ -47,8 +47,8 @@
 <div class="ui container fluid">
 	<div class="ui attached segment header top tw-flex tw-flex-col tw-items-center">
 		<div class="field">
-			<span>Already have an account?</span>
-			<a href="{{AppSubUrl}}/user/login">Sign in</a>
+			<span>{{ctx.Locale.Tr "gpg.signup.already_have_account"}}</span>
+			<a href="{{AppSubUrl}}/user/login">{{ctx.Locale.Tr "gpg.signin.title"}}</a>
 		</div>
 	</div>
 </div>
\ No newline at end of file
-- 
2.54.0