Merge branch 'main' into lifei/ui-acp-direct-spike

* main:
  fix: tolerate partial Responses output items (#10108)
  fix(databricks): always use OpenAI-compatible "parameters" for tools (#10101)
  fix(providers): unescape shell-escaped image paths (#10098)
  chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 in /documentation (#10107)
  regenerate schema (#10166)
  chore(deps): bump actions/stale from 10.1.1 to 10.3.0 (#10050)
  chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 (#10049)
  chore(deps): bump pnpm/action-setup from 6.0.8 to 6.0.9 (#9892)
  Update EmpirioLabs provider display name to EmpirioLabs AI (#10126)
  add declarative provider support to goose-providers crate (#9992)
  fix(desktop): seed mac auto-update config (#10132)
  Update release testing instructions (#10122)

.github/workflows/bundle-desktop-intel.yml

@@ -156,6 +156,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-x64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/bundle-desktop.yml

@@ -190,6 +190,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-arm64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/canary.yml

@@ -138,7 +138,7 @@ jobs:
           merge-multiple: true
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2

.github/workflows/create-version-bump-pr.yaml

@@ -85,7 +85,7 @@ jobs:
 
           **Please follow these steps:**
 
-          1. Close and reopen this PR to trigger CI checks. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+          1. Approve workflows for this PR to trigger CI checks.
           2. Review and resolve any merge conflicts.
           3. Approve and merge this PR.
           4. The `release/${{ env.version }}` PR will be created automatically.

.github/workflows/publish-docker.yml

@@ -65,7 +65,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
       - name: Attest Docker image
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/goose
           subject-digest: ${{ steps.docker-push.outputs.digest }}

.github/workflows/publish-npm.yml

@@ -32,7 +32,7 @@ jobs:
           always-auth: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
 
@@ -164,7 +164,7 @@ jobs:
           always-auth: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
 

.github/workflows/release.yml

@@ -17,6 +17,11 @@ permissions:
   pull-requests: write  # Required for npm publish workflow
   attestations: write  # Required for SLSA build provenance attestations
 
+env:
+  # Set this repository Actions variable to "true" in GitHub Settings > Secrets and variables
+  # > Actions > Variables after a release containing desktop app-update.yml has shipped.
+  ENABLE_MAC_NATIVE_AUTO_UPDATE: ${{ vars.ENABLE_MAC_NATIVE_AUTO_UPDATE || 'false' }}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -119,10 +124,17 @@ jobs:
           merge-multiple: true
 
       - name: Generate macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
         run: node ui/desktop/scripts/generate-mac-update-manifest.js --version "${GITHUB_REF_NAME}" --directory .
 
+      - name: Attest macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-path: latest-mac.yml
+
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2
@@ -132,7 +144,6 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
 
       # Create/update the versioned release
@@ -148,7 +159,6 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
           allowUpdates: true
           omitBody: true
@@ -169,8 +179,15 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
           allowUpdates: true
           omitBody: true
           omitPrereleaseDuringUpdate: true
+
+      - name: Upload macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${GITHUB_REF_NAME}" latest-mac.yml --clobber
+          gh release upload stable latest-mac.yml --clobber

.github/workflows/stale.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       # Use the official stale action from GitHub
       - name: 'Close Stale PRs'
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d  # v10.1.1
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899  # v10.3.0
         with:
           # Authentication token with required permissions
           repo-token: ${{ secrets.GITHUB_TOKEN }}