Merge branch 'main' into lifei/ui-acp-direct-spike

* main:
  fix: tolerate partial Responses output items (#10108)
  fix(databricks): always use OpenAI-compatible "parameters" for tools (#10101)
  fix(providers): unescape shell-escaped image paths (#10098)
  chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 in /documentation (#10107)
  regenerate schema (#10166)
  chore(deps): bump actions/stale from 10.1.1 to 10.3.0 (#10050)
  chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 (#10049)
  chore(deps): bump pnpm/action-setup from 6.0.8 to 6.0.9 (#9892)
  Update EmpirioLabs provider display name to EmpirioLabs AI (#10126)
  add declarative provider support to goose-providers crate (#9992)
  fix(desktop): seed mac auto-update config (#10132)
  Update release testing instructions (#10122)

.github/actions/generate-release-pr-body/pr_body_template.txt

@@ -2,7 +2,7 @@
 
 ## Test before Release
 
-1. Close and reopen this PR to trigger CI and produce the Desktop bundle for testing. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+1. Approve the workflows for this PR (scroll to bottom) to trigger CI and produce the Desktop bundle for testing.
 2. Make sure all check workflows pass.
 3. Install the Desktop bundle from the download links (posted as a comment below when it is ready).
 4. Complete the goose Release Manual Testing Checklist (posted as a comment below).

.github/workflows/bundle-desktop-intel.yml

@@ -156,6 +156,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-x64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/bundle-desktop.yml

@@ -190,6 +190,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-arm64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/canary.yml

@@ -138,7 +138,7 @@ jobs:
           merge-multiple: true
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2

.github/workflows/create-version-bump-pr.yaml

@@ -85,7 +85,7 @@ jobs:
 
           **Please follow these steps:**
 
-          1. Close and reopen this PR to trigger CI checks. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+          1. Approve workflows for this PR to trigger CI checks.
           2. Review and resolve any merge conflicts.
           3. Approve and merge this PR.
           4. The `release/${{ env.version }}` PR will be created automatically.

.github/workflows/publish-docker.yml

@@ -65,7 +65,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
       - name: Attest Docker image
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/goose
           subject-digest: ${{ steps.docker-push.outputs.digest }}

.github/workflows/publish-npm.yml

@@ -32,7 +32,7 @@ jobs:
           always-auth: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
 
@@ -164,7 +164,7 @@ jobs:
           always-auth: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
 

.github/workflows/release.yml

@@ -17,6 +17,11 @@ permissions:
   pull-requests: write  # Required for npm publish workflow
   attestations: write  # Required for SLSA build provenance attestations
 
+env:
+  # Set this repository Actions variable to "true" in GitHub Settings > Secrets and variables
+  # > Actions > Variables after a release containing desktop app-update.yml has shipped.
+  ENABLE_MAC_NATIVE_AUTO_UPDATE: ${{ vars.ENABLE_MAC_NATIVE_AUTO_UPDATE || 'false' }}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -119,10 +124,17 @@ jobs:
           merge-multiple: true
 
       - name: Generate macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
         run: node ui/desktop/scripts/generate-mac-update-manifest.js --version "${GITHUB_REF_NAME}" --directory .
 
+      - name: Attest macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-path: latest-mac.yml
+
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2
@@ -132,7 +144,6 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
 
       # Create/update the versioned release
@@ -148,7 +159,6 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
           allowUpdates: true
           omitBody: true
@@ -169,8 +179,15 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
           allowUpdates: true
           omitBody: true
           omitPrereleaseDuringUpdate: true
+
+      - name: Upload macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${GITHUB_REF_NAME}" latest-mac.yml --clobber
+          gh release upload stable latest-mac.yml --clobber

.github/workflows/stale.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       # Use the official stale action from GitHub
       - name: 'Close Stale PRs'
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d  # v10.1.1
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899  # v10.3.0
         with:
           # Authentication token with required permissions
           repo-token: ${{ secrets.GITHUB_TOKEN }}